Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

151 results · page 2 of 4

Dec 20, 2025Web to SugarCRM Lead: Cross-Site Request ForgeryCVE-2025-13361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to delete custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Web to SugarCRM Lead
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Web to SugarCRM Lead to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025WP Gravity Forms Zoho CRM and Bigin: Deserialization of Untrusted DataCVE-2025-60091 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.
Product
WP Gravity Forms Zoho CRM and Bigin
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 14, 2025HelloLeads CRM Form Shortcode: Does not have authorisation and CSRF checkCVE-2025-12696 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them
Product
HelloLeads CRM Form Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update HelloLeads CRM Form Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 13, 2025Devs CRM – Manage tasks, attendance and teams all together: Unauthorized modification of dataCVE-2025-13093 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update leads tags.
Product
Devs CRM – Manage tasks, attendance and teams all together
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Devs CRM – Manage tasks, attendance and teams all together to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 13, 2025Devs CRM – Manage tasks, attendance and teams all together: Unauthorized access of dataCVE-2025-13092 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API Endpoint in all versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to retrieve private user data, including password hashes.
Product
Devs CRM – Manage tasks, attendance and teams all together
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Devs CRM – Manage tasks, attendance and teams all together to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 9, 2025WP-CRM System: Missing AuthorizationCVE-2025-62740 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.6.
Product
WP-CRM System
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 5, 2025CRM Memberships: Privilege escalationCVE-2025-13313 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and authentication checks on the `ntzcrm_changepassword` AJAX action. This makes it possible for unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts via the `ntzcrm_changepassword` endpoint, granted they can obtain or enumerate a target user's email address. The plugin also exposes the `ntzcrm_get_users` endpoint without authentication, allowing attackers to enumerate subscriber email addresses, facilitating the exploitation of the password reset vulnerability.
Product
CRM Memberships
Affected
up to 2.6
What to do
Affects up to 2.6. Update CRM Memberships to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025CRM Memberships: Unauthorized membership tag creationCVE-2025-13312 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CRM Memberships plugin for WordPress is vulnerable to unauthorized membership tag creation due to a missing capability check on the 'ntzcrm_add_new_tag' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to create arbitrary membership tags and modify CRM configuration that should be restricted to administrators.
Product
CRM Memberships
Affected
up to 2.5
What to do
Affects up to 2.5. Update CRM Memberships to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution: Stored Cross-Site ScriptingCVE-2025-12935 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fluentcrm_content' shortcode in all versions up to, and including, 2.9.84 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
Affected
up to 2.9.84
What to do
Affects up to 2.9.84. Update FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025Groundhogg — CRM, Newsletters, and Marketing Automation: SQL InjectionCVE-2025-12750 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in all versions up to, and including, 4.2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
Affected
up to 4.2.6.1
What to do
Affects up to 4.2.6.1. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 21, 2025Surbma | MiniCRM Shortcode: Stored Cross-Site ScriptingCVE-2025-11800 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Surbma | MiniCRM Shortcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Surbma | MiniCRM Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 5, 2025FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce: Missing AuthorizationCVE-2025-12469 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrative actions in the `bwfan_test_email` AJAX handler. The nonce used for verification is publicly exposed to all visitors (including unauthenticated users) via the frontend JavaScript localization, and the `check_nonce()` function accepts low-privilege authenticated users who possess this nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send arbitrary emails from the site with attacker-controlled subject and body content.
Product
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
Affected
up to 3.6.4.1
What to do
Affects up to 3.6.4.1. Update FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce: Sensitive Information ExposureCVE-2025-12468 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.4.1 via the '/wc-coupons/' REST API endpoint. This is due to the endpoint being marked as a public API (`public_api = true`), which results in the endpoint being registered with `permission_callback => '__return_true'`, bypassing all authentication and capability checks. This makes it possible for unauthenticated attackers to extract sensitive data including all WooCommerce coupon codes, coupon IDs, and expiration status.
Product
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
Affected
up to 3.6.4.1
What to do
Affects up to 3.6.4.1. Update FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 26, 2025WP Gravity Forms Zoho CRM and Bigin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-62981 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8.
Product
WP Gravity Forms Zoho CRM and Bigin
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 3, 2025Integrate Dynamics 365 CRM: Unauthorized accessCVE-2025-10746 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters.
Product
Integrate Dynamics 365 CRM
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Integrate Dynamics 365 CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025W3SCloud Contact Form 7 to Zoho CRM: Cross-Site Request Forgery (CSRF)CVE-2025-60169 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through <= 3.2.
Product
W3SCloud Contact Form 7 to Zoho CRM
Affected
up to 3.2
What to do
Affects up to 3.2. Update W3SCloud Contact Form 7 to Zoho CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2025The integration of the AMO.CRM: Cross-Site Request ForgeryCVE-2025-9628 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The integration of the AMO.CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the settings_page function. This makes it possible for unauthenticated attackers to modify critical API connection settings including the AMO.CRM API URL, login credentials, and API hash key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
The integration of the AMO.CRM
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update The integration of the AMO.CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2025CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2025-5240 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2025Lead Form Data Collection to CRM: Unauthorized accessCVE-2025-5692 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
Product
Lead Form Data Collection to CRM
Affected
up to 3.1
What to do
Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2025WPCRM - CRM for Contact form CF7 & WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24774 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows Reflected XSS.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
Product
WPCRM - CRM for Contact form CF7 & WooCommerce
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update WPCRM - CRM for Contact form CF7 & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Buying Buddy IDX CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50037 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows DOM-Based XSS.This issue affects Buying Buddy IDX CRM: from n/a through <= 2.3.0.
Product
Buying Buddy IDX CRM
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Buying Buddy IDX CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025CRM ERP Business Solution: Missing AuthorizationCVE-2025-49987 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CRM ERP Business Solution: from n/a through <= 1.13.
Product
CRM ERP Business Solution
Affected
up to 1.13
What to do
Affects up to 1.13. Update CRM ERP Business Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025Integration for Contact Form 7 and Zoho CRM, Bigin: Deserialization of Untrusted DataCVE-2025-49330 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through <= 1.3.0.
Product
Integration for Contact Form 7 and Zoho CRM, Bigin
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Integration for Contact Form 7 and Zoho CRM, Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025WPCRM - CRM for Contact form CF7 & WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows SQL Injection.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
Product
WPCRM - CRM for Contact form CF7 & WooCommerce
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update WPCRM - CRM for Contact form CF7 & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WP-CRM System: Missing AuthorizationCVE-2025-49270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.
Product
WP-CRM System
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Lead Form Data Collection to CRM: Missing AuthorizationCVE-2025-47690 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.
Product
Lead Form Data Collection to CRM
Affected
up to 3.1
What to do
Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Infocob CRM Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47513 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in James Laforge Infocob CRM Forms infocob-crm-forms allows Path Traversal.This issue affects Infocob CRM Forms: from n/a through <= 2.4.0.
Product
Infocob CRM Forms
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Infocob CRM Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employeesCVE-2024-12812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Fixed in
1.13.4
What to do
Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Does not sanitise and escape some of its settingsCVE-2024-12808 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Fixed in
1.13.4
What to do
Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Arbitrary file deletionCVE-2025-4206 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
Affected
up to 4.1.1.2
What to do
Affects up to 4.1.1.2. Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 7, 2025Integrations of Zoho CRM with Elementor form: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47644 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-with-elementor-form allows Phishing.This issue affects Integrations of Zoho CRM with Elementor form: from n/a through <= 1.0.8.
Product
Integrations of Zoho CRM with Elementor form
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Integrations of Zoho CRM with Elementor form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WP-CRM System: Deserialization of Untrusted DataCVE-2025-47629 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through <= 3.4.5.
Product
WP-CRM System
Affected
up to 3.4.5
What to do
Affects up to 3.4.5. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WP Gravity Forms Dynamics CRM: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-47454 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.
Product
WP Gravity Forms Dynamics CRM
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update WP Gravity Forms Dynamics CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025CRM Perks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.7.
Product
CRM Perks
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update CRM Perks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Revamp CRM for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32512 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revampcrm Revamp CRM for WooCommerce revampcrm-woocommerce allows Reflected XSS.This issue affects Revamp CRM for WooCommerce: from n/a through <= 1.1.2.
Product
Revamp CRM for WooCommerce
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Revamp CRM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Connector to CiviCRM with CiviMcRestFace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32551 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Reflected XSS.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.8.
Product
Connector to CiviCRM with CiviMcRestFace
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Connector to CiviCRM with CiviMcRestFace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025DyaPress ERP/CRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30582 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclusion.This issue affects DyaPress ERP/CRM: from n/a through <= 18.0.2.0.
Product
DyaPress ERP/CRM
Affected
up to 18.0.2.0
What to do
Affects up to 18.0.2.0. Update DyaPress ERP/CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Privyr CRM Integration: Missing AuthorizationCVE-2025-32224 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shivam Mani Tripathi Privyr CRM Integration privy-crm-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Privyr CRM Integration: from n/a through <= 1.0.2.
Product
Privyr CRM Integration
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Privyr CRM Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Woffice CRM: Authentication BypassCVE-2025-2798 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being used. This can be combined with CVE-2025-2797 to bypass the user approval process if an Administrator can be tricked into taking an action such as clicking a link.
Product
Woffice CRM
Affected
up to 5.4.21
What to do
Affects up to 5.4.21. Update Woffice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hub.woffice.io wordfence.com
Apr 3, 2025Apptivo Business Site CRM: Missing AuthorizationCVE-2025-31909 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Apptivo Apptivo Business Site CRM apptivo-business-site allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apptivo Business Site CRM: from n/a through <= 5.3.
Product
Apptivo Business Site CRM
Affected
up to 5.3
What to do
Affects up to 5.3. Update Apptivo Business Site CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Integration of Zoho CRM and Contact Form 7: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-31821 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integration of Zoho CRM and Contact Form 7 allows Phishing. This issue affects Integration of Zoho CRM and Contact Form 7: from n/a through 1.0.6.
Product
Integration of Zoho CRM and Contact Form 7
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Integration of Zoho CRM and Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Connector to CiviCRM with CiviMcRestFace: Missing AuthorizationCVE-2025-31618 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.10.
Product
Connector to CiviCRM with CiviMcRestFace
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Connector to CiviCRM with CiviMcRestFace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Lead Form Data Collection to CRM: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30810 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Blind SQL Injection.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.0.1.
Product
Lead Form Data Collection to CRM
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2024-13702 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSchedulingCalendar' shortcodes in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2025CRM and Lead Management by vcita: Unauthorized modification of dataCVE-2024-13703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae() function in all versions up to, and including, 2.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable and disable plugin widgets.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025amoCRM WebForm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS.This issue affects amoCRM WebForm: from n/a through <= 1.1.
Product
amoCRM WebForm
Affected
up to 1.1
What to do
Affects up to 1.1. Update amoCRM WebForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025DX Sales CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23575 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevriX DX Sales CRM dx-sales-crm allows Reflected XSS.This issue affects DX Sales CRM: from n/a through <= 1.1.
Product
DX Sales CRM
Affected
up to 1.1
What to do
Affects up to 1.1. Update DX Sales CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2025Apptivo Business Site CRM: Cross-Site Request ForgeryCVE-2024-13405 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Apptivo Business Site CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation on the 'awp_ip_deny' page. This makes it possible for unauthenticated attackers to block IP addresses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Apptivo Business Site CRM
Affected
up to 5.3
What to do
Affects up to 5.3. Update Apptivo Business Site CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 14, 2025CRM Perks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.5.
Product
CRM Perks
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update CRM Perks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025WordPress-to-candidate for Salesforce CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23657 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RusAlex WordPress-to-candidate for Salesforce CRM salesforce-wordpress-to-candidate allows Reflected XSS.This issue affects WordPress-to-candidate for Salesforce CRM: from n/a through <= 1.0.1.
Product
WordPress-to-candidate for Salesforce CRM
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WordPress-to-candidate for Salesforce CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.