Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

2,844 results · page 19 of 57

Aug 28, 2025Better Post & Filter Widgets for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through <= 1.6.1.
Product
Better Post & Filter Widgets for Elementor
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Better Post & Filter Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025tli.tl auto Twitter poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48324 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-poster allows Stored XSS.This issue affects tli.tl auto Twitter poster: from n/a through <= 3.4.
Product
tli.tl auto Twitter poster
Affected
up to 3.4
What to do
Affects up to 3.4. Update tli.tl auto Twitter poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Ajax Search Lite: Basic Information ExposureCVE-2025-7956 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.
Product
Ajax Search Lite
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2025Xagio SEO: Sensitive Information ExposureCVE-2024-13807 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Xagio SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.1.0.5 via the backup functionality due to weak filename structure and lack of protection in the directory. This makes it possible for unauthenticated attackers to extract sensitive data from backups which can include the entire database and site's files.
Product
Xagio SEO
Affected
up to 7.1.0.5
What to do
Affects up to 7.1.0.5. Update Xagio SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2025Post Type Converter: Cross-Site Request Forgery (CSRF)CVE-2025-48303 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kevin Langley Jr. Post Type Converter post-type-converter allows Cross Site Request Forgery.This issue affects Post Type Converter: from n/a through <= 0.6.
Product
Post Type Converter
Affected
up to 0.6
What to do
Affects up to 0.6. Update Post Type Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2025Restore Permanently delete Post or Page Data: Cross-Site Request ForgeryCVE-2025-7839 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the rp_dpo_dpa_ajax_dp_delete_data() function. This makes it possible for unauthenticated attackers to delete data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Restore Permanently delete Post or Page Data
Affected
up to 1.0
What to do
Affects up to 1.0. Update Restore Permanently delete Post or Page Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 22, 2025Jobmonster: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-57888 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensitive Data.This issue affects Jobmonster: from n/a through <= 4.8.0.
Product
Jobmonster
Affected
up to 4.8.0
What to do
Affects up to 4.8.0. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 21, 2025ProveSource Social Proof: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-48355 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ProveSource LTD ProveSource Social Proof provesource allows Retrieve Embedded Sensitive Data.This issue affects ProveSource Social Proof: from n/a through <= 3.1.2.
Product
ProveSource Social Proof
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update ProveSource Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025Post Grid and Gutenberg Blocks: Deserialization of Untrusted DataCVE-2025-54007 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.11.
Product
Post Grid and Gutenberg Blocks
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025ThemeMakers Visual Content Composer: Deserialization of Untrusted DataCVE-2025-53299 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmm_content_composer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through <= 1.5.8.
Product
ThemeMakers Visual Content Composer
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update ThemeMakers Visual Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025WP Discord Post Plus – Supports Unlimited Channels: Cross-Site Request Forgery (CSRF)CVE-2025-49896 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus – Supports Unlimited Channels: from n/a through 1.0.2.
Product
WP Discord Post Plus – Supports Unlimited Channels
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Discord Post Plus – Supports Unlimited Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2025Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode.CVE-2025-7654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple FunnelKit plugins are vulnerable to Sensitive Information Exposure via the wf_get_cookie shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including authentication cookies of other site users, which may make privilege escalation possible. Please note both FunnelKit – Funnel Builder for WooCommerce Checkout AND FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce are affected by this.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2025Poll Maker – Versus Polls, Anonymous Polls, Image Polls: Basic Information ExposureCVE-2024-12575 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 5.8.9 via the 'ays_finish_poll' AJAX action. This makes it possible for unauthenticated attackers to retrieve admin email information which is exposed in the poll response.
Product
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Affected
up to 5.8.9
What to do
Affects up to 5.8.9. Update Poll Maker – Versus Polls, Anonymous Polls, Image Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 15, 2025EventON Lite: Information ExposureCVE-2025-8091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_eventon shortcodes due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Product
EventON Lite
What to do
Update EventON Lite to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2025B Slider- Gutenberg Slider Block for WP: Sensitive Information ExposureCVE-2025-8676 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via the get_active_plugins function. This makes it possible for authenticated attackers, with subscriber-level access and above to extract sensitive data including installed plugin information.
Product
B Slider- Gutenberg Slider Block for WP
What to do
Update B Slider- Gutenberg Slider Block for WP to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2025Visual Composer Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-55709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through < 45.15.0.
Product
Visual Composer Website Builder
What to do
Update Visual Composer Website Builder to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Savoy: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-54736 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This issue affects Savoy: from n/a through <= 3.0.8.
Product
Savoy
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Savoy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Magical Posts Display: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54706 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Posts Display magical-posts-display allows DOM-Based XSS.This issue affects Magical Posts Display: from n/a through <= 1.2.52.
Product
Magical Posts Display
Affected
up to 1.2.52
What to do
Affects up to 1.2.52. Update Magical Posts Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WooCommerce Point Of Sale (POS): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52820 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through <= 1.4.
Product
WooCommerce Point Of Sale (POS)
Affected
up to 1.4
What to do
Affects up to 1.4. Update WooCommerce Point Of Sale (POS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Responsive Posts Carousel Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52728 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.0.
Product
Responsive Posts Carousel Pro
Affected
up to 15.0
What to do
Affects up to 15.0. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Post and Page Builder by BoldGrid: Path Traversal: '.../...//'CVE-2025-52712 · WordPress plugins & themes · reported by PatchstackMedium 4.2
Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
Product
Post and Page Builder by BoldGrid
Affected
up to 1.27.8
What to do
Affects up to 1.27.8. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Premium Addons for KingComposer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49036 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in octagonwebstudio Premium Addons for KingComposer premium-addons-for-kingcomposer allows PHP Local File Inclusion.This issue affects Premium Addons for KingComposer: from n/a through <= 1.1.1.
Product
Premium Addons for KingComposer
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Premium Addons for KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Alike - WordPress Custom Post Comparison: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28975 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through <= 3.0.1.
Product
Alike - WordPress Custom Post Comparison
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Alike - WordPress Custom Post Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Structured Content (JSON-LD) #wpsc: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-3414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Structured Content (JSON-LD) #wpsc
Fixed in
1.7.0
What to do
Update Structured Content (JSON-LD) #wpsc to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 11, 2025WP Private Content Plus: Sensitive Information ExposureCVE-2025-4390 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.
Product
WP Private Content Plus
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update WP Private Content Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2025OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-6572 · WordPress plugins & themes · reported by WPScanMedium 5.9
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 7, 2025Post SMTP: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-24000 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
Product
Post SMTP
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-8620 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 2, 2025BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security: Sensitive Information ExposureCVE-2025-6722 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_* directory that automatically gets created and stores potentially sensitive files without any access restrictions. This makes it possible for unauthenticated attackers to extract sensitive data from various files like config.ini, debug.log, and more when directory listing is enabled on the server and the ~/wp-content/plugins/index.php file is missing or ignored.
Product
BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security
Affected
up to 4.5
What to do
Affects up to 4.5. Update BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2025The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site ImportsCVE-2025-4684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.2.13.1
What to do
Affects up to 3.2.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 31, 2025HT Mega – Absolute Addons For Elementor: Sensitive Information ExposureCVE-2025-8401 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 via the 'get_post_data' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including the content of private, password-protected, and draft posts and pages.
Product
HT Mega – Absolute Addons For Elementor
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update HT Mega – Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2025AI Engine: Sensitive Information ExposureCVE-2025-7780 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4. The simpleTranscribeAudio endpoint fails to restrict URL schemes before calling get_audio(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to read any file on the web server and exfiltrate it via the plugin’s OpenAI API integration.
Product
AI Engine
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2025hiWeb Export Posts: Cross-Site Request ForgeryCVE-2025-7640 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.0.0. This is due to missing or incorrect nonce validation on the tool-dashboard-history.php file. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php), via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
hiWeb Export Posts
Affected
up to 0.9.0.0
What to do
Affects up to 0.9.0.0. Update hiWeb Export Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 24, 2025Post Grid Master: Reflected Cross-Site ScriptingCVE-2025-5084 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray['read_more_text']’ parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Post Grid Master
Affected
up to 3.4.13
What to do
Affects up to 3.4.13. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jul 22, 2025Latest Post Accordian Slider: Cross-Site Request ForgeryCVE-2025-7687 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Latest Post Accordian Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the 'lpaccordian' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Latest Post Accordian Slider
Affected
up to 1.3
What to do
Affects up to 1.3. Update Latest Post Accordian Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 21, 2025WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.CVE-2025-54352 · WordPress plugins & themes · reported by MITRELow 3.7
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
Affected
up to 6.8.2
What to do
Affects up to 6.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record imperva.com
Jul 18, 2025Testimonial Post type: Stored Cross-Site ScriptingCVE-2025-5800 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Testimonial Post type plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Testimonial Post type
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Testimonial Post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 16, 2025WP Post Hide: Cross-Site Request Forgery (CSRF)CVE-2025-54042 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Xfinitysoft WP Post Hide wp-post-hide allows Cross Site Request Forgery.This issue affects WP Post Hide: from n/a through <= 1.0.9.
Product
WP Post Hide
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WP Post Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 15, 2025Alone – Charity Multipurpose Non-profit: Arbitrary file uploadsCVE-2025-5394 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution. CVE-2025-54019 is likely a duplicate of this.
Product
Alone – Charity Multipurpose Non-profit
Affected
up to 7.8.3
What to do
Affects up to 7.8.3. Update Alone – Charity Multipurpose Non-profit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 15, 2025Alone – Charity Multipurpose Non-profit: Arbitrary file deletionCVE-2025-5393 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This was partially patched in 7.8.5 and has been fully addresses in 7.8.7.
Product
Alone – Charity Multipurpose Non-profit
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update Alone – Charity Multipurpose Non-profit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 12, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Sensitive Information ExposureCVE-2020-36848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.14.9
What to do
Affects up to 1.14.9. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org raw.githubusercontent.com
Jul 11, 2025WoodMart: Information ExposureCVE-2025-6745 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Product
WoodMart
Affected
up to 8.2.5
What to do
Affects up to 8.2.5. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 11, 2025WP Register Profile With Shortcode: Sensitive Information ExposureCVE-2025-4593 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'rp_user_data' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from user meta like hashed passwords, usernames, and more.
Product
WP Register Profile With Shortcode
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update WP Register Profile With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 11, 2025GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-6200 · WordPress plugins & themes · reported by WPScanMedium 5.9
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
GeoDirectory
Fixed in
2.8.120
What to do
Update GeoDirectory to 2.8.120 or newer.
Full record and what to do →NVD record wpscan.com
Jul 11, 2025Order Delivery Date: Discloses arbitrary post title (suchCVE-2025-2942 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information
Product
Order Delivery Date
Fixed in
12.6.0
What to do
Update Order Delivery Date to 12.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2025CMSMasters Content Composer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-4414 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows PHP Local File Inclusion.This issue affects CMSMasters Content Composer: from n/a through < 2.5.7.
Product
CMSMasters Content Composer
What to do
Update CMSMasters Content Composer to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter.CVE-2025-5920 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API.
Fixed in
1.1.1
What to do
Update the plugin to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2025Posts Slider Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30943 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Posts Slider Shortcode posts-slider-shortcode allows DOM-Based XSS.This issue affects Posts Slider Shortcode: from n/a through <= 1.0.
Product
Posts Slider Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Posts Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 3, 2025DocCheck Login: Unauthorized post accessCVE-2025-6786 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirecting a user to login on a password protected post after the page has loaded. This makes it possible for unauthenticated attackers to read posts they should not have access to.
Product
DocCheck Login
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update DocCheck Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 2, 2025Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Sensitive Information ExposureCVE-2024-13451 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.17.4 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. The vulnerability was partially patched in version 2.17.5.
Product
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
Affected
up to 2.17.4
What to do
Affects up to 2.17.4. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.