Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,831 results · page 19 of 37
May 7, 2025WP Maintenance: Deserialization of Untrusted DataCVE-2025-47683 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Florent Maillefaud WP Maintenance wp-maintenance allows Object Injection.This issue affects WP Maintenance: from n/a through <= 6.1.9.7.
- Product
- WP Maintenance
- Affected
- up to 6.1.9.7
- What to do
- Affects up to 6.1.9.7. Update WP Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Integrations of Zoho CRM with Elementor form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47644 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form allows Phishing.This issue affects Integrations of Zoho CRM with Elementor form: from n/a through <= 1.0.8.
- Product
- Integrations of Zoho CRM with Elementor form
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Integrations of Zoho CRM with Elementor form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP-CRM System: Deserialization of Untrusted DataCVE-2025-47629 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through <= 3.4.5.
- Product
- WP-CRM System
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Custom Checkout Fields for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47504 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Custom Checkout Fields for WooCommerce custom-checkout-fields-for-woocommerce allows Stored XSS.This issue affects Custom Checkout Fields for WooCommerce: from n/a through <= 1.8.3.
- Product
- Custom Checkout Fields for WooCommerce
- Affected
- up to 1.8.3
- What to do
- Affects up to 1.8.3. Update Custom Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Gravity Forms Zendesk: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47456 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.
- Product
- WP Gravity Forms Zendesk
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Gravity Forms Zendesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Integration for WooCommerce and Salesforce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through <= 1.7.5.
- Product
- Integration for WooCommerce and Salesforce
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Integration for WooCommerce and Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Gravity Forms Dynamics CRM: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47454 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.
- Product
- WP Gravity Forms Dynamics CRM
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update WP Gravity Forms Dynamics CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3281 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.1 via the create_stripe_subscription() function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that have registered through the plugin.
- Product
- User Registration & Membership – Custom Registration Form, Login Form, and User Profile
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 5, 2025Custom Login and Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39363 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Stored XSS.This issue affects Custom Login and Registration: from n/a through 1.0.0.
- Product
- Custom Login and Registration
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Login and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2025Add custom page template: PHP Code Injection leading to Remote Code ExecutionCVE-2025-3491 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- Product
- Add custom page template
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Add custom page template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordfence.com
Apr 26, 2025The Create custom forms for WordPress with a smart form plugin for smart businesses: Arbitrary shortcode executionCVE-2025-2801 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Create custom forms for WordPress with a smart form plugin for smart businesses
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update The Create custom forms for WordPress with a smart form plugin for smart businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 25, 2025Custom Login and Registration: Missing AuthorizationCVE-2025-46535 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login and Registration: from n/a through 1.0.0.
- Product
- Custom Login and Registration
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Login and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2025Custom Admin-Bar Favorites: Reflected Cross-Site ScriptingCVE-2025-3868 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject' parameter in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Custom Admin-Bar Favorites
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Custom Admin-Bar Favorites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 24, 2025COVID-19 (Coronavirus) Update Your Customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46523 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devignstudiosltd COVID-19 (Coronavirus) Update Your Customers covid-19-alert allows Stored XSS.This issue affects COVID-19 (Coronavirus) Update Your Customers: from n/a through <= 1.5.1.
- Product
- COVID-19 (Coronavirus) Update Your Customers
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update COVID-19 (Coronavirus) Update Your Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Custom Functions: Cross-Site Request Forgery (CSRF)CVE-2025-46512 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shamim Hasan Custom Functions Plugin custom-functions allows Stored XSS.This issue affects Custom Functions Plugin: from n/a through <= 1.1.
- Product
- Custom Functions
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Custom Functions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025LSD Custom taxonomy and category meta: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46502 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Matthee LSD Custom taxonomy and category meta custom-taxonomy-category-and-term-fields allows Cross Site Request Forgery.This issue affects LSD Custom taxonomy and category meta: from n/a through <= 1.3.2.
- Product
- LSD Custom taxonomy and category meta
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update LSD Custom taxonomy and category meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WP Customize Login Page: Missing AuthorizationCVE-2025-46485 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.
- Product
- WP Customize Login Page
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Flickr Shortcode Importer: Deserialization of Untrusted DataCVE-2025-46481 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through <= 2.2.3.
- Product
- Flickr Shortcode Importer
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Flickr Shortcode Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WP Customize Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46477 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Stored XSS.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.
- Product
- WP Customize Login Page
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Social Counter: Deserialization of Untrusted DataCVE-2025-46473 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a through <= 2.0.5.
- Product
- Social Counter
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WP Custom Post Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46471 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gnanavelshenll WP Custom Post Popup custom-post-popup allows DOM-Based XSS.This issue affects WP Custom Post Popup: from n/a through <= 1.0.1.
- Product
- WP Custom Post Popup
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Custom Post Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Wp Custom CMS Block: Cross-Site Request Forgery (CSRF)CVE-2025-46457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ahsanullah Akanda Wp Custom CMS Block wp-custom-cms-block allows Stored XSS.This issue affects Wp Custom CMS Block: from n/a through <= 2.1.
- Product
- Wp Custom CMS Block
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Wp Custom CMS Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Sassy Social Share: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39404 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects Sassy Social Share: from n/a through <= 3.3.73.
- Product
- Sassy Social Share
- Affected
- up to 3.3.73
- What to do
- Affects up to 3.3.73. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025Custom Related Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46227 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts custom-related-posts allows Stored XSS.This issue affects Custom Related Posts: from n/a through <= 1.7.4.
- Product
- Custom Related Posts
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update Custom Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Cross-Site Request ForgeryCVE-2025-3284 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- User Registration & Membership – Custom Registration Form, Login Form, and User Profile
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpuserregistration.comwordfence.com
Apr 17, 2025Ultimate Store Kit Elementor Addons: Deserialization of Untrusted DataCVE-2025-39588 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.4.0.
- Product
- Ultimate Store Kit Elementor Addons
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FluentBoards: Deserialization of Untrusted DataCVE-2025-39551 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from n/a through <= 1.47.
- Product
- FluentBoards
- Affected
- up to 1.47
- What to do
- Affects up to 1.47. Update FluentBoards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025FluentCommunity: Deserialization of Untrusted DataCVE-2025-39550 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Object Injection.This issue affects FluentCommunity: from n/a through <= 1.2.15.
- Product
- FluentCommunity
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update FluentCommunity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Rating by BestWebSoft: Deserialization of Untrusted DataCVE-2025-39527 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.
- Product
- Rating by BestWebSoft
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Rating by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Team Members: Deserialization of Untrusted DataCVE-2025-32686 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in WPSpeedo Team Members wps-team allows Object Injection.This issue affects Team Members: from n/a through <= 3.4.4.
- Product
- Team Members
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Team Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025uListing: Deserialization of Untrusted DataCVE-2025-32662 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0.
- Product
- uListing
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025HelpGent: Deserialization of Untrusted DataCVE-2025-32658 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5.
- Product
- HelpGent
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update HelpGent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Question Answer: Deserialization of Untrusted DataCVE-2025-32647 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Question Answer question-answer allows Object Injection.This issue affects Question Answer: from n/a through <= 1.2.73.
- Product
- Question Answer
- Affected
- up to 1.2.73
- What to do
- Affects up to 1.2.73. Update Question Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Kata Plus: Deserialization of Untrusted DataCVE-2025-32572 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through <= 1.5.3.
- Product
- Kata Plus
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Kata Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025TuriTop Booking System: Deserialization of Untrusted DataCVE-2025-32571 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Object Injection.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.
- Product
- TuriTop Booking System
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WooCommerce Loyal Customers: Missing AuthorizationCVE-2025-32544 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in The Right Software WooCommerce Loyal Customers woocommerce-loyal-customer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WooCommerce Loyal Customers: from n/a through <= 2.6.
- Product
- WooCommerce Loyal Customers
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update WooCommerce Loyal Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Make Email Customizer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Excellent Dynamics Make Email Customizer for WooCommerce make-email-customizer-for-woocommerce allows Reflected XSS.This issue affects Make Email Customizer for WooCommerce: from n/a through <= 1.0.6.
- Product
- Make Email Customizer for WooCommerce
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Make Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Event Espresso – Custom Email Template Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Event Espresso – Custom Email Template Shortcode email-shortcode allows Reflected XSS.This issue affects Event Espresso – Custom Email Template Shortcode: from n/a through <= 1.0.0.
- Product
- Event Espresso – Custom Email Template Shortcode
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Event Espresso – Custom Email Template Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025SS Quiz: Deserialization of Untrusted DataCVE-2025-27287 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ssvadim SS Quiz ssquiz allows Object Injection.This issue affects SS Quiz: from n/a through <= 2.0.5.
- Product
- SS Quiz
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update SS Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Saoshyant Slider: Deserialization of Untrusted DataCVE-2025-27286 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in saoshyant1994 Saoshyant Slider saoshyant-slider allows Object Injection.This issue affects Saoshyant Slider: from n/a through <= 3.0.
- Product
- Saoshyant Slider
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Saoshyant Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Custom Users Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23858 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiren Patel Custom Users Order custom-users-order allows Reflected XSS.This issue affects Custom Users Order: from n/a through <= 4.2.
- Product
- Custom Users Order
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Custom Users Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-3487 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.42.0
- What to do
- Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Order ReplayCVE-2025-3479 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.42.0
- What to do
- Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 16, 2025Custom CSS, JS & PHP: Cross-Site Request Forgery (CSRF)CVE-2025-39601 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through <= 2.4.1.
- Product
- Custom CSS, JS & PHP
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Custom CSS, JS & PHP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Listdom: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39599 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Webilia Inc. Listdom listdom allows Phishing.This issue affects Listdom: from n/a through <= 4.0.0.
- Product
- Listdom
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Listdom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Fast eBay Listings: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-39597 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Arthur Yarwood Fast eBay Listings fast-ebay-listings allows Phishing.This issue affects Fast eBay Listings: from n/a through <= 2.12.15.
- Product
- Fast eBay Listings
- Affected
- up to 2.12.15
- What to do
- Affects up to 2.12.15. Update Fast eBay Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025MelaPress Login Security: Deserialization of Untrusted DataCVE-2025-39565 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaPress Login Security: from n/a through <= 2.1.0.
- Product
- MelaPress Login Security
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update MelaPress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Additional Custom Product Tabs for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through <= 1.7.0.
- Product
- Additional Custom Product Tabs for WooCommerce
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Additional Custom Product Tabs for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Advanced Custom Fields: Link Picker Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in caalami Advanced Custom Fields: Link Picker Field acf-link-picker-field allows Reflected XSS.This issue affects Advanced Custom Fields: Link Picker Field: from n/a through <= 1.2.8.
- Product
- Advanced Custom Fields: Link Picker Field
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Advanced Custom Fields: Link Picker Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025GNUCommerce: Deserialization of Untrusted DataCVE-2025-30985 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in kagla GNUCommerce gnucommerce allows Object Injection.This issue affects GNUCommerce: from n/a through <= 1.5.4.
- Product
- GNUCommerce
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update GNUCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.