Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,041 results · page 21 of 21
Nov 3, 2025CE21 Suite: Sensitive Information ExposureCVE-2025-11008 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers to extract sensitive data including authentication credentials, which can be used to log in as other users as long as they have used the plugin's custom authentication feature before. This may include administrators, which makes a complete site takeover possible.
- Product
- CE21 Suite
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update CE21 Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2025CE21 Suite: Unauthorized plugin settings updateCVE-2025-11007 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in versions 2.2.1 to 2.3.1. This makes it possible for unauthenticated attackers to update the plugin's API settings including a secret key used for authentication. This allows unauthenticated attackers to create new admin accounts on an affected site.
- Product
- CE21 Suite
- Affected
- 2.2.1 to 2.3.1
- What to do
- Affects 2.2.1 to 2.3.1. Update CE21 Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2025Doccure Core: Privilege escalationCVE-2025-8900 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
- Product
- Doccure Core
- What to do
- Update Doccure Core to the newest version.
Nov 1, 2025Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: Arbitrary file uploadsCVE-2025-11499 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created.
- Product
- Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
- Affected
- up to 1.1.32
- What to do
- Affects up to 1.1.32. Update Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2025Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App: Unauthorized access of dataCVE-2025-11833 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
- Product
- Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2025King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor: Privilege escalationCVE-2025-8489 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.
- Product
- King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor
- Affected
- 24.12.92 to 51.1.14
- What to do
- Affects 24.12.92 to 51.1.14. Update King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2025Noo JobMonster: Authentication BypassCVE-2025-5397 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability.
- Product
- Noo JobMonster
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update Noo JobMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2025WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecCVE-2025-4665 · WordPress plugins & themes · reported by mandiant-cve@google.comCritical 9.6
WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2025The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploCVE-2025-6440 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Affected
- up to 1.9.26
- What to do
- Affects up to 1.9.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Crocoblock JetSearch jet-search: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49931 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through 3.5.10.
- Product
- Crocoblock JetSearch jet-search
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update Crocoblock JetSearch jet-search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2025FormGent: Is vulnerable to arbitrary file deletion due to insufficient file path validationCVE-2025-10916 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
- Product
- FormGent
- Fixed in
- 1.0.4
- What to do
- Update FormGent to 1.0.4 or newer.
Oct 18, 2025PPOM – Product Addons & Custom Fields for WooCommerce: Arbitrary file uploadsCVE-2025-11391 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated.
- Product
- PPOM – Product Addons & Custom Fields for WooCommerce
- Affected
- up to 33.0.15
- What to do
- Affects up to 33.0.15. Update PPOM – Product Addons & Custom Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2025Felan Framework: Improper authenticationCVE-2025-10850 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue.
- Product
- Felan Framework
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2025Truelysell Core: Arbitrary User Password ChangeCVE-2025-10742 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.
- Product
- Truelysell Core
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Truelysell Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025Orion SMS OTP Verification: Privilege escalationCVE-2025-9967 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number
- Product
- Orion SMS OTP Verification
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Orion SMS OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2025OwnID Passwordless Login: Authentication BypassCVE-2025-10294 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownid_shared_secret value is empty prior to authenticating a user via JWT. This makes it possible for unauthenticated attackers to log in as other users, including administrators, on instances where the plugin has not been fully configured yet.
- Product
- OwnID Passwordless Login
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update OwnID Passwordless Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025Flex QR Code Generator: Arbitrary file uploadsCVE-2025-10041 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Flex QR Code Generator
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2025The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deleCVE-2025-6439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to delete all files in an arbitrary directory on the server, which can lead to remote code execution, data loss, or site unavailability.
- Affected
- up to 1.9.26
- What to do
- Affects up to 1.9.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2025Ovatheme Events Manager: Arbitrary file uploadsCVE-2025-6553 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Ovatheme Events Manager
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update Ovatheme Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2025WP Freeio: Privilege EscalationCVE-2025-11533 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- WP Freeio
- Affected
- up to 1.2.21
- What to do
- Affects up to 1.2.21. Update WP Freeio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2025Search & Go - Directory: Authentication BypassCVE-2025-11522 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. CVE-2025-62064 is likely a duplicate of this CVE.
- Product
- Search & Go - Directory
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Search & Go - Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2025WP Travel Engine – Tour Booking Plugin – Tour Operator Software: Local File InclusionCVE-2025-7634 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- WP Travel Engine – Tour Booking Plugin – Tour Operator Software
- Affected
- up to 6.6.7
- What to do
- Affects up to 6.6.7. Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2025WP Travel Engine – Tour Booking Plugin – Tour Operator Software: Arbitrary file deletion (via renaming)CVE-2025-7526 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the set_user_profile_image function in all versions up to, and including, 6.6.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- WP Travel Engine – Tour Booking Plugin – Tour Operator Software
- Affected
- up to 6.6.7
- What to do
- Affects up to 6.6.7. Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2025Community Events: SQL InjectionCVE-2025-10586 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘event_venue’ parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Community Events
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Community Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 8, 2025Community Events: SQL InjectionCVE-2025-10587 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Community Events
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Community Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025OAuth Single Sign On – SSO (OAuth Client): Improper Verification of Cryptographic SignatureCVE-2025-9485 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.
- Product
- OAuth Single Sign On – SSO (OAuth Client)
- Affected
- up to 6.26.12
- What to do
- Affects up to 6.26.12. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025Appy Pie Connect for WooCommerce: Privilege EscalationCVE-2025-9286 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.
- Product
- Appy Pie Connect for WooCommerce
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Appy Pie Connect for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025RestroPress – Online Food Ordering System: Authentication BypassCVE-2025-9209 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
- Product
- RestroPress – Online Food Ordering System
- Affected
- 3.0.0 to 3.1.9.2
- What to do
- Affects 3.0.0 to 3.1.9.2. Update RestroPress – Online Food Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2025JoomSport – for Sports: Team & League, Football, Hockey & more: Local File InclusionCVE-2025-7721 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- JoomSport – for Sports: Team & League, Football, Hockey & more
- Affected
- up to 5.7.3
- What to do
- Affects up to 5.7.3. Update JoomSport – for Sports: Team & League, Football, Hockey & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025WPRecovery: SQL InjectionCVE-2025-10726 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the result of this SQL injection is passed directly to PHP's unlink() function, allowing attackers to delete arbitrary files on the server by injecting file paths through the SQL query.
- Product
- WPRecovery
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WPRecovery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Oct 3, 2025Spirit Framework: Authentication bypassCVE-2025-6388 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username.
- Product
- Spirit Framework
- Affected
- up to 1.2.14
- What to do
- Affects up to 1.2.14. Update Spirit Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Ajax WooSearch
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025webandprint AR For WordPress ar-for-wordpress: Cross-Site Request Forgery (CSRF)CVE-2025-60156 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 8.34.
- Product
- webandprint AR For WordPress ar-for-wordpress
- What to do
- Update webandprint AR For WordPress ar-for-wordpress to the newest version.
Sep 23, 2025Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium): Arbitrary file uploadsCVE-2025-10412 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uni_cpo_upload_file' function in all versions up to, and including, 4.9.55. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium)
- Affected
- up to 4.9.55
- What to do
- Affects up to 4.9.55. Update Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2025Podlove Podcast Publisher: Arbitrary file uploadsCVE-2025-10147 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Podlove Podcast Publisher
- Affected
- up to 4.2.6
- What to do
- Affects up to 4.2.6. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2025WPCasa: Code InjectionCVE-2025-9321 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code.
- Product
- WPCasa
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WPCasa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2025BeyondCart Connector: Privilege EscalationCVE-2025-8570 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 3.0.1. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.
- Product
- BeyondCart Connector
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update BeyondCart Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Goza - Nonprofit Charity: Arbitrary file deletionCVE-2025-10134 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Goza - Nonprofit Charity
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Goza - Nonprofit Charity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025AdForest: Authentication BypassCVE-2025-8359 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, including administrators, without access to a password.
- Product
- AdForest
- Affected
- up to 6.0.9
- What to do
- Affects up to 6.0.9. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 19, 2025Work The Flow File Upload: Arbitrary file uploadsCVE-2015-10138 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Work The Flow File Upload plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jQuery-File-Upload-9.5.0 server and test files in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
- Product
- Work The Flow File Upload
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Work The Flow File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2025Simple User Registration: Privilege EscalationCVE-2025-4334 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.
- Product
- Simple User Registration
- Affected
- up to 6.3
- What to do
- Affects up to 6.3. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.