Updated 50 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

175 results · page 2 of 4

Jan 22, 2026Shown Connector: Missing AuthorizationCVE-2025-68003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.
Product
Shown Connector
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Shown Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 29, 2025Invelity SPS connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68876 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows Reflected XSS.This issue affects Invelity SPS connect: from n/a through <= 1.0.8.
Product
Invelity SPS connect
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Invelity SPS connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025OpenID Connect Generic Client: Stored Cross-Site ScriptingCVE-2025-13730 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The OpenID Connect Generic Client plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'openid_connect_generic_auth_url' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
OpenID Connect Generic Client
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update OpenID Connect Generic Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025InstaWP Connect: Missing AuthorizationCVE-2025-66068 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.1.9.
Product
InstaWP Connect
Affected
up to 0.1.1.9
What to do
Affects up to 0.1.1.9. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WPForms Google Sheet Connector: Missing AuthorizationCVE-2025-67570 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.
Product
WPForms Google Sheet Connector
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 22, 2025GSheetConnector For Ninja Forms: Unauthorized access of dataCVE-2025-13136 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-sheet-config ' page in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve information about the system.
Product
GSheetConnector For Ninja Forms
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update GSheetConnector For Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2025BigBuy Dropshipping Connector for WooCommerce: IP Address SpoofingCVE-2025-12039 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to retrieve the output of phpinfo().
Product
BigBuy Dropshipping Connector for WooCommerce
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update BigBuy Dropshipping Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2025Doliconnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ptibogxiv Doliconnect doliconnect allows Reflected XSS.This issue affects Doliconnect: from n/a through <= 9.3.2.
Product
Doliconnect
Affected
up to 9.3.2
What to do
Affects up to 9.3.2. Update Doliconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Connector for Gravity Forms and Google Sheets: Deserialization of Untrusted DataCVE-2025-60209 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.6.
Product
Connector for Gravity Forms and Google Sheets
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Connector for Gravity Forms and Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Sello ChannelConnector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52754 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in selloio Sello ChannelConnector sello-channelconnector allows Reflected XSS.This issue affects Sello ChannelConnector: from n/a through <= 1.6.3.
Product
Sello ChannelConnector
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Sello ChannelConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Post Connector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52741 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barry Kooij Post Connector post-connector allows Reflected XSS.This issue affects Post Connector: from n/a through <= 1.0.11.
Product
Post Connector
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Post Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2025GSheetConnector For Gravity Forms: Cross-Site Request ForgeryCVE-2025-8606 · WordPress plugins & themes · reported by WordfenceLow 2.4
The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 1.3.23. This is due to missing or incorrect nonce validation on the activate_plugin and deactivate_plugin functions. This makes it possible for attackers to trick authenticated administrators into activating or deactivating specified plugins via a forged request, such as clicking on a malicious link or visiting a compromised page.
Product
GSheetConnector For Gravity Forms
What to do
Update GSheetConnector For Gravity Forms to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025GSheetConnector For Gravity Forms: Authorization bypassCVE-2025-8593 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a missing capability check on the 'install_plugin' function. This makes it possible for authenticated attackers, with subscriber-level access and above to install plugins on the target site and potentially achieve arbitrary code execution on the server under certain conditions.
Product
GSheetConnector For Gravity Forms
What to do
Update GSheetConnector For Gravity Forms to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Appy Pie Connect for WooCommerce: Privilege EscalationCVE-2025-9286 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.
Product
Appy Pie Connect for WooCommerce
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Appy Pie Connect for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025Doliconnect: Cross-Site Request Forgery (CSRF)CVE-2025-58690 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ptibogxiv Doliconnect doliconnect allows Stored XSS.This issue affects Doliconnect: from n/a through <= 9.5.7.
Product
Doliconnect
Affected
up to 9.5.7
What to do
Affects up to 9.5.7. Update Doliconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Verowa Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Stored XSS.This issue affects Verowa Connect: from n/a through <= 3.2.3.
Product
Verowa Connect
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Nextend Facebook Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-connect allows Stored XSS.This issue affects Nextend Facebook Connect : from n/a through <= 3.1.19.
Product
Nextend Facebook Connect
Affected
up to 3.1.19
What to do
Affects up to 3.1.19. Update Nextend Facebook Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025GSheets Connector: Deserialization of Untrusted DataCVE-2025-53465 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in raoinfotech GSheets Connector sheetlink allows Object Injection.This issue affects GSheets Connector: from n/a through <= 1.1.1.
Product
GSheets Connector
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update GSheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2025BeyondCart Connector: Privilege EscalationCVE-2025-8570 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 3.0.1. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.
Product
BeyondCart Connector
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update BeyondCart Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 10, 2025PagBank / PagSeguro Connect para WooCommerce: SQL InjectionCVE-2025-10142 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 4.44.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
PagBank / PagSeguro Connect para WooCommerce
Affected
up to 4.44.3
What to do
Affects up to 4.44.3. Update PagBank / PagSeguro Connect para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 9, 2025Spreadconnect: Missing AuthorizationCVE-2025-53291 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5.
Product
Spreadconnect
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Spreadconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025WordPress Events Calendar Plugin – connectDaily: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58862 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Stored XSS.This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through <= 1.5.5.
Product
WordPress Events Calendar Plugin – connectDaily
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update WordPress Events Calendar Plugin – connectDaily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Invelity MyGLS connect: Cross-Site Request Forgery (CSRF)CVE-2025-58833 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in INVELITY Invelity MyGLS connect invelity-mygls-connect allows Object Injection.This issue affects Invelity MyGLS connect: from n/a through <= 1.1.1.
Product
Invelity MyGLS connect
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Invelity MyGLS connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 4, 2025Make Connector: Arbitrary file uploadsCVE-2025-6085 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_media' function in all versions up to, and including, 1.5.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Make Connector
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update Make Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 20, 2025ads.txt Guru Connect: Cross-Site Request Forgery (CSRF)CVE-2025-49381 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in ads.txt Guru ads.txt Guru Connect adstxt-guru-connect allows Cross Site Request Forgery.This issue affects ads.txt Guru Connect: from n/a through <= 1.1.1.
Product
ads.txt Guru Connect
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update ads.txt Guru Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2025Earnware Connect: Stored Cross-Site ScriptingCVE-2025-7651 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Earnware Connect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ew_hasrole' shortcode in all versions up to, and including, 1.0.74 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Earnware Connect
Affected
up to 1.0.74
What to do
Affects up to 1.0.74. Update Earnware Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 14, 2025Connector for Gravity Forms and Google Sheets: Cross-Site Request Forgery (CSRF)CVE-2025-54682 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Cross Site Request Forgery.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.4.
Product
Connector for Gravity Forms and Google Sheets
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Connector for Gravity Forms and Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Connector for Gravity Forms and Google Sheets: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-54681 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Phishing.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.4.
Product
Connector for Gravity Forms and Google Sheets
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Connector for Gravity Forms and Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025WooCommerce Google Sheet Connector: Cross-Site Request Forgery (CSRF)CVE-2025-54030 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector wc-gsheetconnector allows Cross Site Request Forgery.This issue affects WooCommerce Google Sheet Connector: from n/a through <= 1.3.20.
Product
WooCommerce Google Sheet Connector
Affected
up to 1.3.20
What to do
Affects up to 1.3.20. Update WooCommerce Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Click & Pledge Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28983 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.
Product
Click & Pledge Connect
What to do
Update Click & Pledge Connect to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025LMSACE Connect: Missing AuthorizationCVE-2025-29007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LMSACE Connect: from n/a through <= 3.4.
Product
LMSACE Connect
Affected
up to 3.4
What to do
Affects up to 3.4. Update LMSACE Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025WP-FB-AutoConnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50022 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JK WP-FB-AutoConnect wp-fb-autoconnect allows Stored XSS.This issue affects WP-FB-AutoConnect: from n/a through <= 4.6.4.
Product
WP-FB-AutoConnect
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update WP-FB-AutoConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Sharespine Woocommerce Connector: Missing AuthorizationCVE-2025-48128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharespine Woocommerce Connector: from n/a through <= 4.7.55.
Product
Sharespine Woocommerce Connector
Affected
up to 4.7.55
What to do
Affects up to 4.7.55. Update Sharespine Woocommerce Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector: Does not have CSRF checkCVE-2023-2334 · WordPress plugins & themes · reported by WPScanMedium 5.4
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
Product
edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector
Fixed in
1.4
What to do
Update edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector to 1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 7, 2025EasyMe Connect: Cross-Site Request Forgery (CSRF)CVE-2025-47609 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in easymebiz EasyMe Connect easyme-connect allows Cross Site Request Forgery.This issue affects EasyMe Connect: from n/a through <= 3.0.3.
Product
EasyMe Connect
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update EasyMe Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Verowa Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32609 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Reflected XSS.This issue affects Verowa Connect: from n/a through <= 3.0.4.
Product
Verowa Connect
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Connector to CiviCRM with CiviMcRestFace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32551 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Reflected XSS.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.8.
Product
Connector to CiviCRM with CiviMcRestFace
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Connector to CiviCRM with CiviMcRestFace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025InstaWP Connect – 1-click WP Staging & Migration: Local File InclusionCVE-2025-2636 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file types can be uploaded and included, or are already present on the filesystem locally. There are currently no known vulnerabilities in this plugin that make file upload possible, meaning this won't be exploitable to achieve remote code execution on most instances with just this plugin alone. Another vulnerability would need to be present on the site allowing arbitrary file upload in order to leverage this to achieve remote code execution.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.85
What to do
Affects up to 0.1.0.85. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2025Verowa Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32676 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Blind SQL Injection.This issue affects Verowa Connect: from n/a through <= 3.0.5.
Product
Verowa Connect
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WordPress Events Calendar Plugin – connectDaily: Cross-Site Request Forgery (CSRF)CVE-2025-32597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Cross-Site Scripting (XSS).This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through <= 1.5.4.
Product
WordPress Events Calendar Plugin – connectDaily
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update WordPress Events Calendar Plugin – connectDaily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Click & Pledge Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32550 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect Plugin allows SQL Injection. This issue affects Click & Pledge Connect Plugin: from 2.24080000 through WP6.6.1.
Product
Click & Pledge Connect
What to do
Update Click & Pledge Connect to the newest version.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025BP Social Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32493 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes BP Social Connect bp-social-connect allows Stored XSS.This issue affects BP Social Connect: from n/a through <= 1.6.2.
Product
BP Social Connect
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update BP Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Nino Social Connect: Cross-Site Request Forgery (CSRF)CVE-2025-32481 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect: from n/a through <= 2.0.
Product
Nino Social Connect
Affected
up to 2.0
What to do
Affects up to 2.0. Update Nino Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Connector to CiviCRM with CiviMcRestFace: Missing AuthorizationCVE-2025-31618 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.10.
Product
Connector to CiviCRM with CiviMcRestFace
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Connector to CiviCRM with CiviMcRestFace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Apimo Connector: Cross-Site Request Forgery (CSRF)CVE-2025-31602 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.
Product
Apimo Connector
Affected
up to 2.6.5.1
What to do
Affects up to 2.6.5.1. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025InstaWP Connect: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31387 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect instawp-connect allows PHP Local File Inclusion.This issue affects InstaWP Connect: from n/a through <= 0.1.0.82.
Product
InstaWP Connect
Affected
up to 0.1.0.82
What to do
Affects up to 0.1.0.82. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025LeadConnector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30893 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeadConnector LeadConnector leadconnector allows DOM-Based XSS.This issue affects LeadConnector: from n/a through <= 3.0.2.
Product
LeadConnector
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update LeadConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 14, 2025InstaWP Connect – 1-click WP Staging & Migration: Cross-Site Request ForgeryCVE-2024-13913 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.83
What to do
Affects up to 0.1.0.83. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025WPGet API – Connect to any external REST API: Server-Side Request ForgeryCVE-2024-13857 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WPGet API – Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Product
WPGet API – Connect to any external REST API
Affected
up to 2.2.10
What to do
Affects up to 2.2.10. Update WPGet API – Connect to any external REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 18, 2025BigBuy Dropshipping Connector for WooCommerce: Full Path DisclosureCVE-2024-13538 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.0. This is due the /vendor/cocur/slugify/bin/generate-default.php file being directly accessible and triggering an error. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
BigBuy Dropshipping Connector for WooCommerce
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update BigBuy Dropshipping Connector for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.