Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

4,656 results · page 22 of 94

Sep 26, 2025Sendle Shipping: Cross-Site Request Forgery (CSRF)CVE-2025-60139 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Cross Site Request Forgery.This issue affects Sendle Shipping: from n/a through <= 6.02.
Product
Sendle Shipping
Affected
up to 6.02
What to do
Affects up to 6.02. Update Sendle Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Post Featured Video: Cross-Site Request Forgery (CSRF)CVE-2025-60137 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Post Featured Video post-featured-video allows Cross Site Request Forgery.This issue affects Post Featured Video: from n/a through <= 1.7.
Product
Post Featured Video
Affected
up to 1.7
What to do
Affects up to 1.7. Update Post Featured Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Vehica Core: Cross-Site Request Forgery (CSRF)CVE-2025-60117 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.
Product
Vehica Core
Affected
up to 1.0.100
What to do
Affects up to 1.0.100. Update Vehica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Instapage: Cross-Site Request Forgery (CSRF)CVE-2025-60115 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin instapage allows Cross Site Request Forgery.This issue affects Instapage Plugin: from n/a through <= 3.7.0.
Product
Instapage
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Instapage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Groovy Menu: Cross-Site Request Forgery (CSRF)CVE-2025-60113 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through <= 1.4.3.
Product
Groovy Menu
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Groovy Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Javo Core: Cross-Site Request Forgery (CSRF)CVE-2025-60111 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through <= 3.0.0.266.
Product
Javo Core
Affected
up to 3.0.0.266
What to do
Affects up to 3.0.0.266. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Download Manager: Cross-Site Request Forgery (CSRF)CVE-2025-60093 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager download-manager allows Cross Site Request Forgery.This issue affects Download Manager: from n/a through <= 3.3.24.
Product
Download Manager
Affected
up to 3.3.24
What to do
Affects up to 3.3.24. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Di Themes Demo Site Importer: Cross-Site Request Forgery (CSRF)CVE-2025-58914 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Di Themes Di Themes Demo Site Importer di-themes-demo-site-importer allows Cross Site Request Forgery.This issue affects Di Themes Demo Site Importer: from n/a through <= 1.2.
Product
Di Themes Demo Site Importer
Affected
up to 1.2
What to do
Affects up to 1.2. Update Di Themes Demo Site Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Snow Monkey: Server-Side Request ForgeryCVE-2025-10137 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Snow Monkey
Affected
up to 29.1.5
What to do
Affects up to 29.1.5. Update Snow Monkey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Sep 26, 2025System Dashboard: Cross-Site Request ForgeryCVE-2025-10377 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sd_toggle_logs() function. This makes it possible for unauthenticated attackers to toggle critical logging settings including Page Access Logs, Error Logs, and Email Delivery Logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
System Dashboard
Affected
up to 2.8.20
What to do
Affects up to 2.8.20. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2025OAuth Single Sign On – SSO (OAuth Client): Cross-Site Request ForgeryCVE-2025-10752 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.12
What to do
Affects up to 6.26.12. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025Request a Quote: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58915 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.
Product
Request a Quote
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WorkScout-Core: Cross-Site Request Forgery (CSRF)CVE-2025-59572 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Cross Site Request Forgery.This issue affects WorkScout-Core: from n/a through < 1.7.06.
Product
WorkScout-Core
What to do
Update WorkScout-Core to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Zoho Flow: Cross-Site Request Forgery (CSRF)CVE-2025-59568 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow zoho-flow allows Cross Site Request Forgery.This issue affects Zoho Flow: from n/a through <= 2.14.1.
Product
Zoho Flow
Affected
up to 2.14.1
What to do
Affects up to 2.14.1. Update Zoho Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Publitio: Server-Side Request Forgery (SSRF)CVE-2025-58962 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through <= 2.2.1.
Product
Publitio
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Attractive Donations System: Cross-Site Request Forgery (CSRF)CVE-2025-58956 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System wp-attractive-donations-system-easy-stripe-paypal-donations allows Stored XSS.This issue affects WP Attractive Donations System: from n/a through < 1.29.
Product
WP Attractive Donations System
What to do
Update WP Attractive Donations System to the newest version.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Doliconnect: Cross-Site Request Forgery (CSRF)CVE-2025-58690 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ptibogxiv Doliconnect doliconnect allows Stored XSS.This issue affects Doliconnect: from n/a through <= 9.5.7.
Product
Doliconnect
Affected
up to 9.5.7
What to do
Affects up to 9.5.7. Update Doliconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Casengo Live Chat Support: Cross-Site Request Forgery (CSRF)CVE-2025-58688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Casengo Casengo Live Chat Support the-casengo-chat-widget allows Stored XSS.This issue affects Casengo Live Chat Support: from n/a through <= 2.1.4.
Product
Casengo Live Chat Support
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Casengo Live Chat Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Current Age: Cross-Site Request Forgery (CSRF)CVE-2025-58687 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Current Age Plugin current-age allows Stored XSS.This issue affects Current Age Plugin: from n/a through <= 1.6.
Product
Current Age
Affected
up to 1.6
What to do
Affects up to 1.6. Update Current Age to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025ShrinkTheWeb (STW) Website Previews: Cross-Site Request Forgery (CSRF)CVE-2025-58677 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in puravida1976 ShrinkTheWeb (STW) Website Previews shrinktheweb-website-preview-plugin allows Stored XSS.This issue affects ShrinkTheWeb (STW) Website Previews: from n/a through <= 2.8.5.
Product
ShrinkTheWeb (STW) Website Previews
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update ShrinkTheWeb (STW) Website Previews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025HORIZONTAL SLIDER: Cross-Site Request Forgery (CSRF)CVE-2025-58676 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in extendyourweb HORIZONTAL SLIDER horizontal-slider allows Stored XSS.This issue affects HORIZONTAL SLIDER: from n/a through <= 2.4.
Product
HORIZONTAL SLIDER
Affected
up to 2.4
What to do
Affects up to 2.4. Update HORIZONTAL SLIDER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Interact: Embed A Quiz On Your Site: Cross-Site Request Forgery (CSRF)CVE-2025-58675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in tryinteract Interact: Embed A Quiz On Your Site interact-quiz-embed allows Cross Site Request Forgery.This issue affects Interact: Embed A Quiz On Your Site: from n/a through <= 3.1.
Product
Interact: Embed A Quiz On Your Site
Affected
up to 3.1
What to do
Affects up to 3.1. Update Interact: Embed A Quiz On Your Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Content Protection: Cross-Site Request Forgery (CSRF)CVE-2025-58670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shankaranand Maurya WP Content Protection wp-content-protection allows Stored XSS.This issue affects WP Content Protection: from n/a through <= 1.3.
Product
WP Content Protection
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Content Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Grid: Cross-Site Request Forgery (CSRF)CVE-2025-58657 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in EdwardBock Grid grid allows Stored XSS.This issue affects Grid: from n/a through <= 2.3.1.
Product
Grid
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025NIX Anti-Spam Light: Cross-Site Request Forgery (CSRF)CVE-2025-58270 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Cross Site Request Forgery.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.
Product
NIX Anti-Spam Light
Affected
up to 0.0.4
What to do
Affects up to 0.0.4. Update NIX Anti-Spam Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WPMK PDF Generator: Cross-Site Request Forgery (CSRF)CVE-2025-58268 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WPMK WPMK PDF Generator wpmk-pdf-generator allows Stored XSS.This issue affects WPMK PDF Generator: from n/a through <= 1.0.1.
Product
WPMK PDF Generator
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WPMK PDF Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Stock Message: Cross-Site Request Forgery (CSRF)CVE-2025-58267 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Aftabul Islam Stock Message stock-message allows Stored XSS.This issue affects Stock Message: from n/a through <= 1.1.0.
Product
Stock Message
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Stock Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Sweet Energy Efficiency: Cross-Site Request Forgery (CSRF)CVE-2025-58262 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WPDirectoryKit Sweet Energy Efficiency sweet-energy-efficiency allows Stored XSS.This issue affects Sweet Energy Efficiency: from n/a through <= 1.0.8.
Product
Sweet Energy Efficiency
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Sweet Energy Efficiency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Mavis HTTPS to HTTP Redirection: Cross-Site Request Forgery (CSRF)CVE-2025-58261 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc Mavis HTTPS to HTTP Redirection mavis-https-to-http-redirect allows Stored XSS.This issue affects Mavis HTTPS to HTTP Redirection: from n/a through <= 1.4.3.
Product
Mavis HTTPS to HTTP Redirection
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Mavis HTTPS to HTTP Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Nokri: Cross-Site Request Forgery (CSRF)CVE-2025-58259 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in scriptsbundle Nokri nokri allows Cross Site Request Forgery.This issue affects Nokri: from n/a through <= 1.6.4.
Product
Nokri
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Nokri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Custom Post Type Images: Cross-Site Request Forgery (CSRF)CVE-2025-58255 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through <= 0.5.
Product
Custom Post Type Images
Affected
up to 0.5
What to do
Affects up to 0.5. Update Custom Post Type Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Findgo: Cross-Site Request Forgery (CSRF)CVE-2025-58250 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo fingo allows Authentication Bypass.This issue affects Findgo: from n/a through <= 1.3.55.
Product
Findgo
Affected
up to 1.3.55
What to do
Affects up to 1.3.55. Update Findgo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Constructo: Cross-Site Request Forgery (CSRF)CVE-2025-58244 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Anps Constructo constructo allows Object Injection.This issue affects Constructo: from n/a through <= 4.3.9.
Product
Constructo
Affected
up to 4.3.9
What to do
Affects up to 4.3.9. Update Constructo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Force Update Translations: Cross-Site Request Forgery (CSRF)CVE-2025-58236 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mayo Moriyama Force Update Translations force-update-translations allows Cross Site Request Forgery.This issue affects Force Update Translations: from n/a through <= 0.5.
Product
Force Update Translations
Affected
up to 0.5
What to do
Affects up to 0.5. Update Force Update Translations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Printeers Print & Ship: Cross-Site Request Forgery (CSRF)CVE-2025-58224 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Printeers Printeers Print & Ship allows Cross Site Request Forgery. This issue affects Printeers Print & Ship: from n/a through 1.17.0.
Product
Printeers Print & Ship
Affected
up to 1.17.0
What to do
Affects up to 1.17.0. Update Printeers Print & Ship to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Show Pages List: Cross-Site Request Forgery (CSRF)CVE-2025-58219 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in LIJE Show Pages List show-pages-list allows Cross Site Request Forgery.This issue affects Show Pages List: from n/a through <= 1.2.0.
Product
Show Pages List
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Show Pages List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Flexible FAQ: Cross-Site Request Forgery (CSRF)CVE-2025-58200 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bage Flexible FAQ flexible-faq allows Cross Site Request Forgery.This issue affects Flexible FAQ: from n/a through <= 0.2.
Product
Flexible FAQ
Affected
up to 0.2
What to do
Affects up to 0.2. Update Flexible FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Fastly: Cross-Site Request Forgery (CSRF)CVE-2025-58199 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fastly Fastly fastly allows Cross Site Request Forgery.This issue affects Fastly: from n/a through <= 1.2.28.
Product
Fastly
Affected
up to 1.2.28
What to do
Affects up to 1.2.28. Update Fastly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025WP Compiler: Cross-Site Request Forgery (CSRF)CVE-2025-58032 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bytes.co WP Compiler wp-compiler allows Cross Site Request Forgery.This issue affects WP Compiler: from n/a through <= 1.0.0.
Product
WP Compiler
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Compiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Quiz Maker: Cross-Site Request Forgery (CSRF)CVE-2025-58014 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.0.64.
Product
Quiz Maker
Affected
up to 6.7.0.64
What to do
Affects up to 6.7.0.64. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025CouponXxL: Cross-Site Request Forgery (CSRF)CVE-2025-58013 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from n/a through <= 4.5.0.
Product
CouponXxL
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update CouponXxL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Content Mask: Server-Side Request Forgery (SSRF)CVE-2025-58011 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through <= 1.8.5.2.
Product
Content Mask
Affected
up to 1.8.5.2
What to do
Affects up to 1.8.5.2. Update Content Mask to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025SV Proven Expert: Cross-Site Request Forgery (CSRF)CVE-2025-58010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in straightvisions GmbH SV Proven Expert sv-provenexpert allows Cross Site Request Forgery.This issue affects SV Proven Expert: from n/a through <= 2.0.06.
Product
SV Proven Expert
Affected
up to 2.0.06
What to do
Affects up to 2.0.06. Update SV Proven Expert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025DriCub: Server-Side Request Forgery (SSRF)CVE-2025-58005 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft DriCub dricub-driving-school allows Server Side Request Forgery.This issue affects DriCub: from n/a through <= 2.9.
Product
DriCub
Affected
up to 2.9
What to do
Affects up to 2.9. Update DriCub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Mail Baby SMTP: Cross-Site Request Forgery (CSRF)CVE-2025-57992 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in InterServer Mail Baby SMTP mail-baby-smtp allows Cross Site Request Forgery.This issue affects Mail Baby SMTP: from n/a through <= 2.8.
Product
Mail Baby SMTP
Affected
up to 2.8
What to do
Affects up to 2.8. Update Mail Baby SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025MakeStories (for Google Web Stories): Server-Side Request Forgery (SSRF)CVE-2025-57984 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through <= 3.0.4.
Product
MakeStories (for Google Web Stories)
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update MakeStories (for Google Web Stories) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025BP Disable Activation Reloaded: Cross-Site Request Forgery (CSRF)CVE-2025-57983 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Damian BP Disable Activation Reloaded bp-disable-activation-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Disable Activation Reloaded: from n/a through <= 1.2.1.
Product
BP Disable Activation Reloaded
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update BP Disable Activation Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Advanced Appointment Booking & Scheduling: Cross-Site Request Forgery (CSRF)CVE-2025-57978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themespride Advanced Appointment Booking & Scheduling advanced-appointment-booking-scheduling allows Cross Site Request Forgery.This issue affects Advanced Appointment Booking & Scheduling: from n/a through <= 2.1.
Product
Advanced Appointment Booking & Scheduling
Affected
up to 2.1
What to do
Affects up to 2.1. Update Advanced Appointment Booking & Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Flexible PDF Invoices for WooCommerce &: Cross-Site Request Forgery (CSRF)CVE-2025-57977 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery.This issue affects Flexible PDF Invoices for WooCommerce & WordPress: from n/a through <= 6.0.13.
Product
Flexible PDF Invoices for WooCommerce &
Affected
up to 6.0.13
What to do
Affects up to 6.0.13. Update Flexible PDF Invoices for WooCommerce & to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025SALESmanago & Leadoo: Cross-Site Request Forgery (CSRF)CVE-2025-57970 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Cross Site Request Forgery.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.
Product
SALESmanago & Leadoo
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.