Vulnerability database

4,221 results · page 19 of 85

• Sep 5, 2025Bulk Watermark: Cross-Site Request Forgery (CSRF)CVE-2025-58845 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Bulk Watermark bulk-watermark allows Reflected XSS.This issue affects Bulk Watermark: from n/a through <= 1.6.10.

  Product

  Bulk Watermark

  Affected

  up to 1.6.10

  What to do

  Affects up to 1.6.10. Update Bulk Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Database to Excel: Cross-Site Request Forgery (CSRF)CVE-2025-58844 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Subhash Kumar Database to Excel database-to-excel allows Stored XSS.This issue affects Database to Excel: from n/a through <= 1.0.

  Product

  Database to Excel

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Database to Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Auto Last Youtube Video: Cross-Site Request Forgery (CSRF)CVE-2025-58843 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Auto Last Youtube Video auto-last-youtube-video allows Stored XSS.This issue affects Auto Last Youtube Video: from n/a through <= 1.0.7.

  Product

  Auto Last Youtube Video

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Auto Last Youtube Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Invelity MyGLS connect: Cross-Site Request Forgery (CSRF)CVE-2025-58833 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in INVELITY Invelity MyGLS connect invelity-mygls-connect allows Object Injection.This issue affects Invelity MyGLS connect: from n/a through <= 1.1.1.

  Product

  Invelity MyGLS connect

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Invelity MyGLS connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Parallax Scrolling Enllax.js: Cross-Site Request Forgery (CSRF)CVE-2025-58831 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Cross Site Request Forgery.This issue affects Parallax Scrolling Enllax.js: from n/a through <= 0.0.6.

  Product

  Parallax Scrolling Enllax.js

  Affected

  up to 0.0.6

  What to do

  Affects up to 0.0.6. Update Parallax Scrolling Enllax.js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: Server-Side Request Forgery (SSRF)CVE-2025-58829 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Server Side Request Forgery.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.3.3.

  Product

  Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Developer Tools Blocker: Cross-Site Request Forgery (CSRF)CVE-2025-58818 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in SwiftNinjaPro Developer Tools Blocker swiftninjapro-inspect-element-console-blocker allows Cross Site Request Forgery.This issue affects Developer Tools Blocker: from n/a through <= 3.2.1.

  Product

  Developer Tools Blocker

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update Developer Tools Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025To Lead For Salesforce: Cross-Site Request Forgery (CSRF)CVE-2025-58809 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Nick Ciske To Lead For Salesforce salesforce-wordpress-to-lead allows Reflected XSS.This issue affects To Lead For Salesforce: from n/a through <= 2.7.3.9.

  Product

  To Lead For Salesforce

  Affected

  up to 2.7.3.9

  What to do

  Affects up to 2.7.3.9. Update To Lead For Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Purge Varnish Cache: Cross-Site Request Forgery (CSRF)CVE-2025-58807 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dsingh Purge Varnish Cache purge-varnish allows Stored XSS.This issue affects Purge Varnish Cache: from n/a through <= 2.6.

  Product

  Purge Varnish Cache

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update Purge Varnish Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WordPress Error Monitoring by Bugsnag: Cross-Site Request Forgery (CSRF)CVE-2025-58806 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Tom Longridge WordPress Error Monitoring by Bugsnag bugsnag allows Stored XSS.This issue affects WordPress Error Monitoring by Bugsnag: from n/a through <= 1.6.3.

  Product

  WordPress Error Monitoring by Bugsnag

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update WordPress Error Monitoring by Bugsnag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WooCommerce Single Page Checkout: Cross-Site Request Forgery (CSRF)CVE-2025-58804 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in brijrajs WooCommerce Single Page Checkout woo-single-page-checkout allows Cross Site Request Forgery.This issue affects WooCommerce Single Page Checkout: from n/a through <= 1.2.7.

  Product

  WooCommerce Single Page Checkout

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update WooCommerce Single Page Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025TrustMate.io – WooCommerce integration: Cross-Site Request Forgery (CSRF)CVE-2025-58802 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in michalzagdan TrustMate.io – WooCommerce integration trustmate-io-integration-for-woocommerce allows Cross Site Request Forgery.This issue affects TrustMate.io – WooCommerce integration: from n/a through <= 1.16.0.

  Product

  TrustMate.io – WooCommerce integration

  Affected

  up to 1.16.0

  What to do

  Affects up to 1.16.0. Update TrustMate.io – WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Responder: Cross-Site Request Forgery (CSRF)CVE-2025-58801 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in KCS Responder responder allows Cross Site Request Forgery.This issue affects Responder: from n/a through <= 4.3.8.

  Product

  Responder

  Affected

  up to 4.3.8

  What to do

  Affects up to 4.3.8. Update Responder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025WP Email Template: Cross-Site Request Forgery (CSRF)CVE-2025-58800 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Steve Truman WP Email Template wp-email-template allows Cross Site Request Forgery.This issue affects WP Email Template: from n/a through <= 2.8.5.

  Product

  WP Email Template

  Affected

  up to 2.8.5

  What to do

  Affects up to 2.8.5. Update WP Email Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Custom WooCommerce Checkout Fields Editor: Cross-Site Request Forgery (CSRF)CVE-2025-58799 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in themelocation Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce allows Cross Site Request Forgery.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through <= 1.3.4.

  Product

  Custom WooCommerce Checkout Fields Editor

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Custom WooCommerce Checkout Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025BCM Duplicate Menu: Cross-Site Request Forgery (CSRF)CVE-2025-58798 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Bjorn Manintveld BCM Duplicate Menu bcm-duplicate-menu allows Cross Site Request Forgery.This issue affects BCM Duplicate Menu: from n/a through <= 1.1.3.

  Product

  BCM Duplicate Menu

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update BCM Duplicate Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Notification for Telegram: Cross-Site Request Forgery (CSRF)CVE-2025-58794 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.

  Product

  Notification for Telegram

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 5, 2025Authors List: Cross-Site Request Forgery (CSRF)CVE-2025-58792 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a through <= 2.0.6.2.

  Product

  Authors List

  Affected

  up to 2.0.6.2

  What to do

  Affects up to 2.0.6.2. Update Authors List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 4, 2025PopAd: Cross-Site Request ForgeryCVE-2025-9616 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the PopAd_reset_cookie_time function. This makes it possible for unauthenticated attackers to reset cookie time settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  PopAd

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update PopAd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Sep 3, 2025Exit Intent Popup: Server-Side Request Forgery (SSRF)CVE-2025-58641 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in kamleshyadav Exit Intent Popup exitintentpopup allows Server Side Request Forgery.This issue affects Exit Intent Popup: from n/a through <= 1.0.1.

  Product

  Exit Intent Popup

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Exit Intent Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025WP Bannerize Pro: Server-Side Request Forgery (SSRF)CVE-2025-58615 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Bannerize Pro: from n/a through <= 1.10.0.

  Product

  WP Bannerize Pro

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update WP Bannerize Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Sep 3, 2025Tickera: Cross-Site Request Forgery (CSRF)CVE-2025-58611 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera: from n/a through <= 3.5.5.6.

  Product

  Tickera

  Affected

  up to 3.5.5.6

  What to do

  Affects up to 3.5.5.6. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 29, 2025Related Posts Lite: Cross-Site Request ForgeryCVE-2025-9618 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Related Posts Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Related Posts Lite

  Affected

  up to 1.12

  What to do

  Affects up to 1.12. Update Related Posts Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Aug 29, 2025Ultimate Tag Warrior Importer: Cross-Site Request ForgeryCVE-2025-9374 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Ultimate Tag Warrior Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to import tags granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Ultimate Tag Warrior Importer

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Ultimate Tag Warrior Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• Aug 28, 2025Chartbeat: Server-Side Request Forgery (SSRF)CVE-2025-53250 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Server-Side Request Forgery (SSRF) vulnerability in Chartbeat Chartbeat chartbeat allows Server Side Request Forgery.This issue affects Chartbeat: from n/a through <= 2.0.7.

  Product

  Chartbeat

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Chartbeat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025rajce: Server-Side Request Forgery (SSRF)CVE-2025-48364 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce rajce allows Server Side Request Forgery.This issue affects rajce: from n/a through <= 0.4.2.

  Product

  rajce

  Affected

  up to 0.4.2

  What to do

  Affects up to 0.4.2. Update rajce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Popup for CF7 with Sweet Alert: Cross-Site Request Forgery (CSRF)CVE-2025-48363 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Metin Saraç Popup for CF7 with Sweet Alert cf7-sweet-alert-popup allows Cross Site Request Forgery.This issue affects Popup for CF7 with Sweet Alert: from n/a through <= 1.6.5.

  Product

  Popup for CF7 with Sweet Alert

  Affected

  up to 1.6.5

  What to do

  Affects up to 1.6.5. Update Popup for CF7 with Sweet Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Hesabfa Accounting: Cross-Site Request Forgery (CSRF)CVE-2025-48362 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affects Hesabfa Accounting: from n/a through <= 2.2.5.

  Product

  Hesabfa Accounting

  Affected

  up to 2.2.5

  What to do

  Affects up to 2.2.5. Update Hesabfa Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025ATT YouTube Widget: Cross-Site Request Forgery (CSRF)CVE-2025-48359 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through <= 1.0.

  Product

  ATT YouTube Widget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update ATT YouTube Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Century ToolKit: Cross-Site Request Forgery (CSRF)CVE-2025-48357 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Theme Century Century ToolKit century-toolkit allows Cross Site Request Forgery.This issue affects Century ToolKit: from n/a through <= 1.2.1.

  Product

  Century ToolKit

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Century ToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Clickbank WordPress Plugin (Niche Storefront): Cross-Site Request Forgery (CSRF)CVE-2025-48353 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) clickbank-niche-storefronts allows Stored XSS.This issue affects Clickbank WordPress Plugin (Niche Storefront): from n/a through <= 1.3.5.

  Product

  Clickbank WordPress Plugin (Niche Storefront)

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Clickbank WordPress Plugin (Niche Storefront) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Kento Splash Screen: Cross-Site Request Forgery (CSRF)CVE-2025-48351 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in PluginsPoint Kento Splash Screen kento-splash-screen allows Stored XSS.This issue affects Kento Splash Screen: from n/a through <= 1.4.

  Product

  Kento Splash Screen

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Kento Splash Screen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025WPMU Ldap Authentication: Cross-Site Request Forgery (CSRF)CVE-2025-48343 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authentication: from n/a through <= 5.0.1.

  Product

  WPMU Ldap Authentication

  Affected

  up to 5.0.1

  What to do

  Affects up to 5.0.1. Update WPMU Ldap Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025WP Admin: Cross-Site Request Forgery (CSRF)CVE-2025-48325 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme wp-admin-theme allows Stored XSS.This issue affects WP Admin Theme: from n/a through <= 1.0.

  Product

  WP Admin

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Ultimate twitter profile widget: Cross-Site Request Forgery (CSRF)CVE-2025-48321 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through <= 1.0.

  Product

  Ultimate twitter profile widget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Ultimate twitter profile widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025百度分享按钮: Cross-Site Request Forgery (CSRF)CVE-2025-48320 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello 百度分享按钮 baidushare-wp allows Stored XSS.This issue affects 百度分享按钮: from n/a through <= 1.0.6.

  Product

  百度分享按钮

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update 百度分享按钮 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025多说社会化评论框: Cross-Site Request Forgery (CSRF)CVE-2025-48318 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 duoshuo allows Cross Site Request Forgery.This issue affects 多说社会化评论框: from n/a through <= 1.2.

  Product

  多说社会化评论框

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update 多说社会化评论框 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Invisible Optin: Cross-Site Request Forgery (CSRF)CVE-2025-48311 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a through <= 1.0.

  Product

  Invisible Optin

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Invisible Optin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Table Editor: Cross-Site Request Forgery (CSRF)CVE-2025-48310 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor wp-table-editor allows Cross Site Request Forgery.This issue affects Table Editor: from n/a through <= 1.6.4.

  Product

  Table Editor

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Table Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025BetPress: Cross-Site Request Forgery (CSRF)CVE-2025-48309 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through <= 1.0.1 Lite.

  Product

  BetPress

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update BetPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Newsletter subscription optin module: Cross-Site Request Forgery (CSRF)CVE-2025-48308 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through <= 1.2.9.

  Product

  Newsletter subscription optin module

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update Newsletter subscription optin module to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025SEO For Images: Cross-Site Request Forgery (CSRF)CVE-2025-48307 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through <= 1.0.0.

  Product

  SEO For Images

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update SEO For Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Savyour Affiliate Partner: Cross-Site Request Forgery (CSRF)CVE-2025-48306 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects Savyour Affiliate Partner: from n/a through <= 2.1.4.

  Product

  Savyour Affiliate Partner

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Savyour Affiliate Partner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025Google XML News Sitemap: Cross-Site Request Forgery (CSRF)CVE-2025-48304 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin gn-xml-sitemap allows Stored XSS.This issue affects Google XML News Sitemap plugin: from n/a through <= 0.02.

  Product

  Google XML News Sitemap

  Affected

  up to 0.02

  What to do

  Affects up to 0.02. Update Google XML News Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 28, 2025XM-Backup: Cross-Site Request Forgery (CSRF)CVE-2025-48109 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through <= 0.9.1.

  Product

  XM-Backup

  Affected

  up to 0.9.1

  What to do

  Affects up to 0.9.1. Update XM-Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2025Video Share VOD – Turnkey Video Site Builder Script: Cross-Site Request ForgeryCVE-2025-7812 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6. This is due to missing or incorrect nonce validation on the adminExport() function. This makes it possible for unauthenticated attackers to update settings and execute remote code when the Server command execution setting is enabled via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Video Share VOD – Turnkey Video Site Builder Script

  Affected

  up to 2.7.6

  What to do

  Affects up to 2.7.6. Update Video Share VOD – Turnkey Video Site Builder Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 27, 2025Instant Breaking News: Cross-Site Request Forgery (CSRF)CVE-2025-58217 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in GeroNikolov Instant Breaking News instant-breaking-news allows Stored XSS.This issue affects Instant Breaking News: from n/a through <= 1.0.

  Product

  Instant Breaking News

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Instant Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2025Solace Extra: Server-Side Request Forgery (SSRF)CVE-2025-58203 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.2.

  Product

  Solace Extra

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Solace Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2025Simple Page Access Restriction: Cross-Site Request Forgery (CSRF)CVE-2025-58202 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Plugins and Snippets Simple Page Access Restriction simple-page-access-restriction allows Cross Site Request Forgery.This issue affects Simple Page Access Restriction: from n/a through <= 1.0.32.

  Product

  Simple Page Access Restriction

  Affected

  up to 1.0.32

  What to do

  Affects up to 1.0.32. Update Simple Page Access Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 27, 2025Backup Bolt: Cross-Site Request Forgery (CSRF)CVE-2025-49040 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through <= 1.5.0.

  Product

  Backup Bolt

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Backup Bolt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.