Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
219 results · page 2 of 5
Jan 23, 2026Monetag Official: Missing AuthorizationCVE-2026-24551 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
- Product
- Monetag Official
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Monetag Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Payment Gateway Authorize.Net CIM for WooCommerce: Missing AuthorizationCVE-2025-68013 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.
- Product
- Payment Gateway Authorize.Net CIM for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Payment Gateway Authorize.Net CIM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Netgsm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68010 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through <= 2.9.63.
- Product
- Netgsm
- Affected
- up to 2.9.63
- What to do
- Affects up to 2.9.63. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 19, 2026PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net): Unauthorized modification of dataCVE-2025-14978 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the ConvesioPay webhook REST endpoint in all versions up to, and including, 1.119.8. This makes it possible for unauthenticated attackers to modify the status of arbitrary WooCommerce orders.
- Product
- PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net)
- Affected
- up to 1.119.8
- What to do
- Affects up to 1.119.8. Update PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 14, 2026Netcash WooCommerce Payment Gateway: Unauthorized modification of dataCVE-2025-14880 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_return_url function in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processing/completed.
- Product
- Netcash WooCommerce Payment Gateway
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Netcash WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 31, 2025Gerencianet Oficial: Insertion of Sensitive Information Into Sent DataCVE-2025-59136 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through <= 3.1.3.
- Product
- Gerencianet Oficial
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Gerencianet Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Gravitec.net – Web Push Notifications: Missing AuthorizationCVE-2025-62869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gravitec.net - Web Push Notifications Gravitec.net – Web Push Notifications gravitec-net-web-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gravitec.net – Web Push Notifications: from n/a through <= 2.9.17.
- Product
- Gravitec.net – Web Push Notifications
- Affected
- up to 2.9.17
- What to do
- Affects up to 2.9.17. Update Gravitec.net – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Ergonet Cache: Missing AuthorizationCVE-2025-62867 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ergonet Cache: from n/a through <= 1.0.13.
- Product
- Ergonet Cache
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Ergonet Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2025Coil Web Monetization: Cross-Site Request ForgeryCVE-2025-9625 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the maybe_restrict_content function. This makes it possible for unauthenticated attackers to trigger CSS selector detection functionality via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Coil Web Monetization
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Coil Web Monetization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 18, 2025Kognetiks Chatbot: Unauthorized modification of dataCVE-2025-11256 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversations.
- Product
- Kognetiks Chatbot
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Kognetiks Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2025planetcalc: Stored Cross-Site ScriptingCVE-2025-8777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The planetcalc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘language’ parameter in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- planetcalc
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update planetcalc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Sep 26, 2025Netgsm: Missing AuthorizationCVE-2025-60143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through <= 2.9.69.
- Product
- Netgsm
- Affected
- up to 2.9.69
- What to do
- Affects up to 2.9.69. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Piotnet Forms: Cross-Site Request Forgery (CSRF)CVE-2025-57933 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Cross Site Request Forgery.This issue affects Piotnet Forms: from n/a through <= 1.0.30.
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2025Robcore Netatmo: SQL InjectionCVE-2025-10652 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Robcore Netatmo
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Robcore Netatmo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net: Time-based SQL InjectionCVE-2025-9463 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 1.117.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net
- Affected
- up to 1.117.5
- What to do
- Affects up to 1.117.5. Update Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025NetInsight Analytics Implementation: Cross-Site Request Forgery (CSRF)CVE-2025-52767 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Cross Site Request Forgery.This issue affects NetInsight Analytics Implementation Plugin: from n/a through <= 1.0.3.
- Product
- NetInsight Analytics Implementation
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update NetInsight Analytics Implementation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025NetInsight Analytics Implementation: Cross-Site Request Forgery (CSRF)CVE-2025-52765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Stored XSS.This issue affects NetInsight Analytics Implementation Plugin: from n/a through <= 1.0.3.
- Product
- NetInsight Analytics Implementation
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update NetInsight Analytics Implementation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Netease Music: Missing AuthorizationCVE-2025-49052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dariolee Netease Music netease-music allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netease Music: from n/a through <= 3.2.1.
- Product
- Netease Music
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Netease Music to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Accept Authorize.NET Payments Using Contact Form 7: Insertion of Sensitive Information Into Sent DataCVE-2025-53322 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 accept-authorize-net-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Authorize.NET Payments Using Contact Form 7: from n/a through <= 2.5.
- Product
- Accept Authorize.NET Payments Using Contact Form 7
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Accept Authorize.NET Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025ONet Regenerate Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-53264 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Konrád Koller ONet Regenerate Thumbnails onet-regenerate-thumbnails allows Cross Site Request Forgery.This issue affects ONet Regenerate Thumbnails: from n/a through <= 1.5.
- Product
- ONet Regenerate Thumbnails
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update ONet Regenerate Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Networker: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52723 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codesupplyco Networker networker allows PHP Local File Inclusion.This issue affects Networker: from n/a through <= 1.2.0.
- Product
- Networker
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Networker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025SERPed.net: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28998 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in serpednet SERPed.net serped-net allows PHP Local File Inclusion.This issue affects SERPed.net: from n/a through <= 4.6.
- Product
- SERPed.net
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update SERPed.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Kids Planet: Deserialization of Untrusted DataCVE-2025-48289 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through <= 2.2.14.
- Product
- Kids Planet
- Affected
- up to 2.2.14
- What to do
- Affects up to 2.2.14. Update Kids Planet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025CoinPayments.net Payment Gateway for WooCommerce: Deserialization of Untrusted DataCVE-2025-47532 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through <= 1.0.17.
- Product
- CoinPayments.net Payment Gateway for WooCommerce
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update CoinPayments.net Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025EC Authorize.net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46487 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sftranna EC Authorize.net ec-authorizenet allows Reflected XSS.This issue affects EC Authorize.net: from n/a through <= 0.3.3.
- Product
- EC Authorize.net
- Affected
- up to 0.3.3
- What to do
- Affects up to 0.3.3. Update EC Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2025Network Posts Extended: Stored Cross-Site ScriptingCVE-2025-3750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Network Posts Extended
- Affected
- up to 7.7.1
- What to do
- Affects up to 7.7.1. Update Network Posts Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 19, 2025bunny.net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48236 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.net bunny.net bunnycdn allows Stored XSS.This issue affects bunny.net: from n/a through <= 2.3.0.
- Product
- bunny.net
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update bunny.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WolfNet IDX for: Does not sanitise and escape some of its settingsCVE-2023-6783 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WolfNet IDX for WordPress plugin through 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WolfNet IDX for
- Affected
- up to 1.19.1
- What to do
- Affects up to 1.19.1. Update WolfNet IDX for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Martins Free Monetized Ad Exchange Network: Cross-Site Request Forgery (CSRF)CVE-2025-47620 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bundgaard Martins Free Monetized Ad Exchange Network martins-free-and-easy-ad-network-get-more-visitors allows Reflected XSS.This issue affects Martins Free Monetized Ad Exchange Network: from n/a through <= 1.0.6.
- Product
- Martins Free Monetized Ad Exchange Network
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Martins Free Monetized Ad Exchange Network to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Beacon Lead Magnets and Lead Capture: Cross-Site Request Forgery (CSRF)CVE-2025-47596 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Cross Site Request Forgery.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.8.
- Product
- Beacon Lead Magnets and Lead Capture
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Beacon Lead Magnets and Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Piotnet Addons For Elementor: Stored Cross-Site ScriptingCVE-2024-13650 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget in all versions up to, and including, 2.4.36 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Piotnet Addons For Elementor
- Affected
- up to 2.4.36
- What to do
- Affects up to 2.4.36. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Apr 17, 2025SERPed.net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32651 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in serpednet SERPed.net serped-net allows Reflected XSS.This issue affects SERPed.net: from n/a through <= 4.6.
- Product
- SERPed.net
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update SERPed.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025AT Internet SmartTag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32506 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BenDlz AT Internet SmartTag at-internet allows Reflected XSS.This issue affects AT Internet SmartTag: from n/a through <= 0.2.
- Product
- AT Internet SmartTag
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update AT Internet SmartTag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Beacon Lead Magnets and Lead Capture: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24637 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Reflected XSS.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.7.
- Product
- Beacon Lead Magnets and Lead Capture
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Beacon Lead Magnets and Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Linet ERP-Woocommerce Integration: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31411 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Path Traversal.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.12.
- Product
- Linet ERP-Woocommerce Integration
- Affected
- up to 3.5.12
- What to do
- Affects up to 3.5.12. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Piotnet Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32205 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Piotnet Forms: from n/a through <= 1.0.30.
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Piotnet Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32197 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through <= 2.4.36.
- Product
- Piotnet Addons For Elementor
- Affected
- up to 2.4.36
- What to do
- Affects up to 2.4.36. Update Piotnet Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Botnet Attack Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.
- Product
- Botnet Attack Blocker
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Botnet Attack Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Plugin Oficial – Getnet para WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30906 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lisandragetnet Plugin Oficial – Getnet para WooCommerce wc-checkout-getnet allows Reflected XSS.This issue affects Plugin Oficial – Getnet para WooCommerce: from n/a through <= 1.7.3.
- Product
- Plugin Oficial – Getnet para WooCommerce
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Plugin Oficial – Getnet para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Piotnet Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31793 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XSS.This issue affects Piotnet Forms: from n/a through <= 1.0.30.
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Piotnet Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31792 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XSS.This issue affects Piotnet Forms: from n/a through <= 1.0.30.
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025iNET Webkit: Missing AuthorizationCVE-2025-22629 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through <= 1.2.2.
- Product
- iNET Webkit
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update iNET Webkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Booknetic: Does not have CSRF checkCVE-2024-13146 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack
- Product
- Booknetic
- Fixed in
- 4.1.5
- What to do
- Update Booknetic to 4.1.5 or newer.
Feb 25, 2025Booknetic: Cross-Site Request Forgery (CSRF)CVE-2025-26926 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Booknetic Booknetic booknetic allows Cross Site Request Forgery.This issue affects Booknetic: from n/a before 5.10.4.
- Product
- Booknetic
- Fixed in
- 5.10.4
- What to do
- Update Booknetic to 5.10.4 or newer.
Feb 16, 2025Botnet Attack Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23975 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through <= 2.0.0.
- Product
- Botnet Attack Blocker
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Botnet Attack Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Monetag Official: Missing AuthorizationCVE-2024-52500 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
- Product
- Monetag Official
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Monetag Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Vignette Ads: Cross-Site Request Forgery (CSRF)CVE-2025-25071 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through <= 0.2.
- Product
- Vignette Ads
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Vignette Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025SocialV - Social Network and Community BuddyPress: Unauthorized access of dataCVE-2024-13529 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'socialv_send_download_file' function in all versions up to, and including, 2.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download arbitrary files from the target system.
- Product
- SocialV - Social Network and Community BuddyPress
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update SocialV - Social Network and Community BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordassets.iqonic.designthemeforest.net
Jan 25, 2025Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized accessCVE-2024-13370 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the save_addon_key_license() function in all versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options to a value of a valid license key.
- Product
- Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 25, 2025Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Unauthorized accessCVE-2024-13368 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the youzify_offer_banner() function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary site options to a value of one.
- Product
- Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.