Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,857 results · page 18 of 38
Jul 18, 2025Terms descriptions: Stored Cross-Site ScriptingCVE-2025-6719 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Terms descriptions
- Affected
- up to 3.4.8
- What to do
- Affects up to 3.4.8. Update Terms descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 18, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Time-based SQL InjectionCVE-2025-7638 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the `order_by` parameter in all versions up to, and including, 1.45.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.45.0
- What to do
- Affects up to 1.45.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 16, 2025CoSchool LMS: Deserialization of Untrusted DataCVE-2025-30973 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Codexpert, Inc CoSchool LMS coschool allows Object Injection.This issue affects CoSchool LMS: from n/a through <= 1.4.3.
- Product
- CoSchool LMS
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update CoSchool LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2025GB Forms DB: Remote Code ExecutionCVE-2025-5392 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdb_talk_to_front() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leverage to inject backdoors or create new administrative user accounts to name a few things.
- Product
- GB Forms DB
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update GB Forms DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2025SureForms – Drag and Drop Form Builder for: PHP Object InjectionCVE-2025-6742 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- SureForms – Drag and Drop Form Builder for
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 9, 2025SureForms – Drag and Drop Form Builder for: Arbitrary file deletionCVE-2025-6691 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- SureForms – Drag and Drop Form Builder for
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 4, 2025LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52833 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS lms allows SQL Injection.This issue affects LMS: from n/a through <= 9.2.
- Product
- LMS
- Affected
- up to 9.2
- What to do
- Affects up to 9.2. Update LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025CMSMasters Content Composer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-4414 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows PHP Local File Inclusion.This issue affects CMSMasters Content Composer: from n/a through < 2.5.7.
- Product
- CMSMasters Content Composer
- What to do
- Update CMSMasters Content Composer to the newest version.
Jul 4, 2025LMSACE Connect: Missing AuthorizationCVE-2025-29007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LMSACE Connect: from n/a through <= 3.4.
- Product
- LMSACE Connect
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update LMSACE Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 3, 2025GoZen Forms: SQL InjectionCVE-2025-6783 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- GoZen Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update GoZen Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 3, 2025GoZen Forms: SQL InjectionCVE-2025-6782 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- GoZen Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update GoZen Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 2, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: PHP Object InjectionCVE-2025-6464 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization occurs when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.44.2
- What to do
- Affects up to 1.44.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary file deletionCVE-2025-6463 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.44.2
- What to do
- Affects up to 1.44.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2025CMS Blocks: Missing AuthorizationCVE-2025-53284 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMS Blocks: from n/a through <= 1.1.
- Product
- CMS Blocks
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CMS Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Popup addon for Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53279 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows DOM-Based XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.4.
- Product
- Popup addon for Ninja Forms
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Popup addon for Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Address Autocomplete via Google for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2025-53263 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Site Request Forgery.This issue affects Address Autocomplete via Google for Gravity Forms: from n/a through <= 1.3.4.
- Product
- Address Autocomplete via Google for Gravity Forms
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Address Autocomplete via Google for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52799 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS lms allows Reflected XSS.This issue affects LMS: from n/a through <= 9.2.
- Product
- LMS
- Affected
- up to 9.2
- What to do
- Affects up to 9.2. Update LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025LifterLMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52717 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through <= 8.0.6.
- Product
- LifterLMS
- Affected
- up to 8.0.6
- What to do
- Affects up to 8.0.6. Update LifterLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025FormLift for Infusionsoft Web Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47654 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift allows Reflected XSS.This issue affects FormLift for Infusionsoft Web Forms: from n/a through <= 7.5.20.
- Product
- FormLift for Infusionsoft Web Forms
- Affected
- up to 7.5.20
- What to do
- Affects up to 7.5.20. Update FormLift for Infusionsoft Web Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2025-5398 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ninja Forms – The Contact Form Builder That Grows With You
- Affected
- up to 3.10.2.1
- What to do
- Affects up to 3.10.2.1. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2025The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server.CVE-2021-4457 · WordPress plugins & themes · reported by WPScanCritical 9.1
The ZoomSounds plugin before 6.05 contains a PHP file allowing unauthenticated users to upload an arbitrary file anywhere on the web server.
- Product
- ZoomSounds
- Fixed in
- 6.05
- What to do
- Update ZoomSounds to 6.05 or newer.
Jun 25, 2025Everest Forms (Pro): Arbitrary file deletionCVE-2025-5927 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability requires an admin to trigger the deletion via deletion of a form entry and cannot be carried out by the attacker alone.
- Product
- Everest Forms (Pro)
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update Everest Forms (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordeverestforms.networdpress.org
Jun 17, 2025CubeWP Forms: Missing AuthorizationCVE-2025-49880 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.5.
- Product
- CubeWP Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Persian Woocommerce SMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49315 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows SQL Injection.This issue affects Persian Woocommerce SMS: from n/a through <= 7.0.10.
- Product
- Persian Woocommerce SMS
- Affected
- up to 7.0.10
- What to do
- Affects up to 7.0.10. Update Persian Woocommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025PDF for WPForms: Missing AuthorizationCVE-2025-49289 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.5.0.
- Product
- PDF for WPForms
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: Cross-Site Request Forgery (CSRF)CVE-2025-49283 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recaptcha-for-all-forms allows Cross Site Request Forgery.This issue affects Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: from n/a through <= 4.1.1.
- Product
- Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Gravity Forms Constant Contact: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30954 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.0.
- Product
- WP Gravity Forms Constant Contact
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WP Gravity Forms Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Gravity Forms Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30953 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.4.7.
- Product
- WP Gravity Forms Salesforce
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Real Time Validation for Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48329 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Reflected XSS.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.
- Product
- Real Time Validation for Gravity Forms
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Real Time Validation for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2025-48328 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.
- Product
- Real Time Validation for Gravity Forms
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2025-2935 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ss_option_maint.php' and 'ss_user_filter_list' files. This makes it possible for unauthenticated attackers to delete pending comments, and re-enable a previously blocked user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms
- Affected
- up to 2024.7
- What to do
- Affects up to 2024.7. Update Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-5341 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.44.1
- What to do
- Affects up to 1.44.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2025Contact Forms by Cimatti: Cross-Site Request Forgery (CSRF)CVE-2025-49069 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in cimatti Contact Forms by Cimatti contact-forms allows Cross Site Request Forgery.This issue affects Contact Forms by Cimatti: from n/a through <= 1.9.8.
- Product
- Contact Forms by Cimatti
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Contact Forms by Cimatti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: Full Path DisclosureCVE-2025-4659 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 28, 2025MasterStudy LMS Pro: Arbitrary file uploadsCVE-2025-4800 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
- Product
- MasterStudy LMS Pro
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update MasterStudy LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.stylemixthemes.comstylemixthemes.com
May 26, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized modification of dataCVE-2025-4683 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
- Product
- MStore API – Create Native Android & iOS Apps On The Cloud
- Affected
- up to 4.17.5
- What to do
- Affects up to 4.17.5. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 23, 2025Smart Forms – when you need more than just a contact form: Stored Cross-Site ScriptingCVE-2025-5055 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.98 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Smart Forms – when you need more than just a contact form
- Affected
- up to 2.6.98
- What to do
- Affects up to 2.6.98. Update Smart Forms – when you need more than just a contact form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 23, 2025ZoomSounds: Deserialization of Untrusted DataCVE-2025-47568 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91.
- Product
- ZoomSounds
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Infocob CRM Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47513 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in James Laforge Infocob CRM Forms infocob-crm-forms allows Path Traversal.This issue affects Infocob CRM Forms: from n/a through <= 2.4.0.
- Product
- Infocob CRM Forms
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Infocob CRM Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Drag and Drop File Upload for Elementor Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47492 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Path Traversal.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.4.3.
- Product
- Drag and Drop File Upload for Elementor Forms
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Drag and Drop File Upload for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39402 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39401 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39395 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39406 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS apartment-management allows PHP Local File Inclusion.This issue affects WPAMS: from n/a through <= 44.0.
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Incorrect Privilege AssignmentCVE-2025-39405 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in mojoomla WPAMS apartment-management allows Privilege Escalation.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39403 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
- Product
- WPAMS
- Affected
- up to 44.0
- What to do
- Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Masteriyo - LMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-33939 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.
- Product
- Masteriyo - LMS
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2561 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ninja Forms
- Fixed in
- 3.10.1
- What to do
- Update Ninja Forms to 3.10.1 or newer.
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2560 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ninja Forms
- Fixed in
- 3.10.1
- What to do
- Update Ninja Forms to 3.10.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.