Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,809 results · page 19 of 37
May 19, 2025WPBot Pro Wordpress Chatbot: Deserialization of Untrusted DataCVE-2025-47582 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chatbot: from n/a through 12.7.0.
- Product
- WPBot Pro Wordpress Chatbot
- Affected
- up to 12.7.0
- What to do
- Affects up to 12.7.0. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025WP Tabs: Deserialization of Untrusted DataCVE-2025-48134 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a through <= 2.2.12.
- Product
- WP Tabs
- Affected
- up to 2.2.12
- What to do
- Affects up to 2.2.12. Update WP Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2025mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data.CVE-2025-32363 · Other software · reported by MITRECritical 9.8
mediDOK before 2.5.18.43 allows remote attackers to achieve remote code execution on a target system via deserialization of untrusted data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.commedidok.de
May 13, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-30384 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.4
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-30382 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.8
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.CVE-2025-30378 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025SAP NetWeaver Deserialization VulnerabilityCVE-2025-42999 · Network & remote access · SAP · reported by cna@sap.comExploitedRansomwareCritical 9.1
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
- Product
- NetWeaver
- On CISA’s list since
- May 15, 2025 (federal fix deadline Jun 5, 2025)
- What to do
- Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogme.sap.comurl.sap
May 8, 2025Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.CVE-2025-47732 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.7
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.
- Product
- Microsoft Dataverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025WP Maintenance: Deserialization of Untrusted DataCVE-2025-47683 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Florent Maillefaud WP Maintenance wp-maintenance allows Object Injection.This issue affects WP Maintenance: from n/a through <= 6.1.9.7.
- Product
- WP Maintenance
- Affected
- up to 6.1.9.7
- What to do
- Affects up to 6.1.9.7. Update WP Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP-CRM System: Deserialization of Untrusted DataCVE-2025-47629 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through <= 3.4.5.
- Product
- WP-CRM System
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 28, 2025GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue.CVE-2025-34491 · Other software · GFI · reported by VulnCheckHigh 8.8
GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup.
- Product
- MailEssentials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfrycos.github.iogfi.ai
Apr 28, 2025DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.CVE-2023-35815 · Other software · DevExpress · reported by MITRELow 3.5
DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
- Product
- DevExpress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode-white.comsupportcenter.devexpress.com
Apr 24, 2025Flickr Shortcode Importer: Deserialization of Untrusted DataCVE-2025-46481 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through <= 2.2.3.
- Product
- Flickr Shortcode Importer
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Flickr Shortcode Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Social Counter: Deserialization of Untrusted DataCVE-2025-46473 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a through <= 2.0.5.
- Product
- Social Counter
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution.CVE-2025-23249 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.6
NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
- Product
- NeMo Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client.CVE-2025-29953 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may eventually cause arbitrary code execution on the client. Version 2.1.0 introduced a allow/denylist feature to restrict deserialization, but this feature could be bypassed. The .NET team has deprecated the built-in .NET binary serialization feature starting with .NET 9 and suggests migrating away from binary serialization. The project is considering to follow suit and drop this part of the NMS API altogether. Users are recommended to upgrade to version 2.1.1, which fixes the issue. We also recommend to migrate away from relying on .NET binary serialization as a hardening method for the future.
- Product
- Apache ActiveMQ NMS OpenWire Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Apr 17, 2025Ultimate Store Kit Elementor Addons: Deserialization of Untrusted DataCVE-2025-39588 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.4.0.
- Product
- Ultimate Store Kit Elementor Addons
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FluentBoards: Deserialization of Untrusted DataCVE-2025-39551 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from n/a through <= 1.47.
- Product
- FluentBoards
- Affected
- up to 1.47
- What to do
- Affects up to 1.47. Update FluentBoards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FluentCommunity: Deserialization of Untrusted DataCVE-2025-39550 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Object Injection.This issue affects FluentCommunity: from n/a through <= 1.2.15.
- Product
- FluentCommunity
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update FluentCommunity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Rating by BestWebSoft: Deserialization of Untrusted DataCVE-2025-39527 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.
- Product
- Rating by BestWebSoft
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Rating by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Team Members: Deserialization of Untrusted DataCVE-2025-32686 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in WPSpeedo Team Members wps-team allows Object Injection.This issue affects Team Members: from n/a through <= 3.4.4.
- Product
- Team Members
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Team Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025uListing: Deserialization of Untrusted DataCVE-2025-32662 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0.
- Product
- uListing
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025HelpGent: Deserialization of Untrusted DataCVE-2025-32658 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5.
- Product
- HelpGent
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update HelpGent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Question Answer: Deserialization of Untrusted DataCVE-2025-32647 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Question Answer question-answer allows Object Injection.This issue affects Question Answer: from n/a through <= 1.2.73.
- Product
- Question Answer
- Affected
- up to 1.2.73
- What to do
- Affects up to 1.2.73. Update Question Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Kata Plus: Deserialization of Untrusted DataCVE-2025-32572 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through <= 1.5.3.
- Product
- Kata Plus
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Kata Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025TuriTop Booking System: Deserialization of Untrusted DataCVE-2025-32571 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Object Injection.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.
- Product
- TuriTop Booking System
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025SS Quiz: Deserialization of Untrusted DataCVE-2025-27287 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ssvadim SS Quiz ssquiz allows Object Injection.This issue affects SS Quiz: from n/a through <= 2.0.5.
- Product
- SS Quiz
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update SS Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Saoshyant Slider: Deserialization of Untrusted DataCVE-2025-27286 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in saoshyant1994 Saoshyant Slider saoshyant-slider allows Object Injection.This issue affects Saoshyant Slider: from n/a through <= 3.0.
- Product
- Saoshyant Slider
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Saoshyant Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025MelaPress Login Security: Deserialization of Untrusted DataCVE-2025-39565 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaPress Login Security: from n/a through <= 2.1.0.
- Product
- MelaPress Login Security
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update MelaPress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025GNUCommerce: Deserialization of Untrusted DataCVE-2025-30985 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in kagla GNUCommerce gnucommerce allows Object Injection.This issue affects GNUCommerce: from n/a through <= 1.5.4.
- Product
- GNUCommerce
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update GNUCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Deserialization of untrusted data issue exists in BizRobo! all versions.CVE-2025-31932 · Other software · OPEN, Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed on the Management Console. The vendor provides the workaround information and recommends to apply it to the deployment environment.
- Product
- BizRobo!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpknowledge.bizrobo.com
Apr 11, 2025WpBookingly: Deserialization of Untrusted DataCVE-2025-32607 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpBookingly service-booking-manager allows Object Injection.This issue affects WpBookingly: from n/a through <= 1.3.0.
- Product
- WpBookingly
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update WpBookingly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025TableOn: Deserialization of Untrusted DataCVE-2025-32569 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in RealMag777 TableOn posts-table-filterable allows Object Injection.This issue affects TableOn: from n/a through <= 1.0.4.3.
- Product
- TableOn
- Affected
- up to 1.0.4.3
- What to do
- Affects up to 1.0.4.3. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025EmpikPlace for Woocommerce: Deserialization of Untrusted DataCVE-2025-32568 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in empik EmpikPlace for Woocommerce empik-for-woocommerce allows Object Injection.This issue affects EmpikPlace for Woocommerce: from n/a through <= 1.4.3.
- Product
- EmpikPlace for Woocommerce
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update EmpikPlace for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Job Board Manager: Deserialization of Untrusted DataCVE-2025-32144 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Job Board Manager job-board-manager allows Object Injection.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- Product
- Job Board Manager
- Affected
- up to 2.1.61
- What to do
- Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Accordion: Deserialization of Untrusted DataCVE-2025-32143 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through <= 2.3.11.
- Product
- Accordion
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025WpEvently: Deserialization of Untrusted DataCVE-2025-32145 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 4.3.6.
- Product
- WpEvently
- Affected
- up to 4.3.6
- What to do
- Affects up to 4.3.6. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code eCVE-2025-30285 · Websites & servers · Adobe · reported by AdobeHigh 8.4
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code eCVE-2025-30284 · Websites & servers · Adobe · reported by AdobeHigh 8.4
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code eCVE-2025-24447 · Websites & servers · Adobe · reported by AdobeCritical 9.1
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does not require user interaction.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-29793 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.2
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Deserialization mismatch vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect service integrity.CVE-2025-31175 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
Deserialization mismatch vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect service integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Testimonial Slider: Deserialization of Untrusted DataCVE-2025-30889 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Testimonial Slider testimonial allows Object Injection.This issue affects Testimonial Slider: from n/a through <= 2.0.13.
- Product
- Testimonial Slider
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parametersCVE-2024-39780 · Other software · Open Source Robotics Foundation · reported by security@ubuntu.comHigh 7.8
A YAML deserialization vulnerability was found in the Robot Operating System (ROS) 'dynparam', a command-line tool for getting, setting, and deleting parameters of a dynamically configurable node, affecting ROS distributions Noetic and earlier. The issue is caused by the use of the yaml.load() function in the 'set' and 'get' verbs, and allows for the creation of arbitrary Python objects. Through this flaw, a local or remote user can craft and execute arbitrary Python code.
- Product
- Robot Operating System (ROS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025CBX Poll: Deserialization of Untrusted DataCVE-2025-31612 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Sabuj Kundu CBX Poll cbxpoll allows Object Injection.This issue affects CBX Poll: from n/a through <= 2.0.4.
- Product
- CBX Poll
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update CBX Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WpTravelly: Deserialization of Untrusted DataCVE-2025-30892 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Object Injection.This issue affects WpTravelly: from n/a through <= 1.8.7.
- Product
- WpTravelly
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability.CVE-2025-27130 · Websites & servers · Welcart Inc. · reported by vultures@jpcert.or.jpHigh 8.8
Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product.
- Product
- Welcart e-Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Multiple Shipping And Billing Address For Woocommerce: Deserialization of Untrusted DataCVE-2025-31087 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows Object Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.5.
- Product
- Multiple Shipping And Billing Address For Woocommerce
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Multiple Shipping And Billing Address For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Sunshine Photo Cart: Deserialization of Untrusted DataCVE-2025-31084 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through <= 3.4.10.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Mobile DJ Manager: Deserialization of Untrusted DataCVE-2025-31074 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Object Injection.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.2.
- Product
- Mobile DJ Manager
- Affected
- up to 1.7.5.2
- What to do
- Affects up to 1.7.5.2. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.