Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

5,856 results · page 22 of 118

Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2025-6437 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Time-based SQL InjectionCVE-2025-5339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Local File Inclusion which leads to Remote Code ExecutionCVE-2025-4689 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2025-4381 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Local File InclusionCVE-2025-4380 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.89
What to do
Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 1, 2025The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to CVE-2025-6934 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2025WPShapere - WordPress admin: Cross-Site Request Forgery (CSRF)CVE-2025-53317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in AcmeeDesign WPShapere - WordPress admin theme wpshapere-lite allows Stored XSS.This issue affects WPShapere - WordPress admin theme: from n/a through <= 1.4.1.
Product
WPShapere - WordPress admin
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update WPShapere - WordPress admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Omnipress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53276 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows DOM-Based XSS.This issue affects Omnipress: from n/a through <= 1.6.4.
Product
Omnipress
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WordPress CTA: Cross-Site Request Forgery (CSRF)CVE-2025-53270 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.
Product
WordPress CTA
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update WordPress CTA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Photo Express for Google: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27361 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thhake Photo Express for Google photo-express-for-google allows Reflected XSS.This issue affects Photo Express for Google: from n/a through <= 0.3.2.
Product
Photo Express for Google
Affected
up to 0.3.2
What to do
Affects up to 0.3.2. Update Photo Express for Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another userCVE-2025-5526 · WordPress plugins & themes · reported by WPScanMedium 4.3
The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user
Product
BuddyPress Docs
Fixed in
2.2.5
What to do
Update BuddyPress Docs to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 25, 2025Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: Stored Cross-Site ScriptingCVE-2025-5275 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
Product
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Affected
up to 1.8.6.1
Fixed in
1.8.6.1
What to do
Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to 1.8.6.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 21, 2025TableOn – WordPress Posts Table Filterable: Stored Cross-Site ScriptingCVE-2025-5143 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TableOn – WordPress Posts Table Filterable
Affected
up to 1.0.4.1
What to do
Affects up to 1.0.4.1. Update TableOn – WordPress Posts Table Filterable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2025Lewe ChordPress: Cross-Site Request Forgery (CSRF)CVE-2025-52789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a through <= 4.0.1.
Product
Lewe ChordPress
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Lewe ChordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Inventory Presser: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50012 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows Stored XSS.This issue affects Inventory Presser: from n/a through <= 15.2.6.
Product
Inventory Presser
Affected
up to 15.2.6
What to do
Affects up to 15.2.6. Update Inventory Presser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Giveaways and Contests by RafflePress: Missing AuthorizationCVE-2025-49997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.18.
Product
Giveaways and Contests by RafflePress
Affected
up to 1.12.18
What to do
Affects up to 1.12.18. Update Giveaways and Contests by RafflePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025PowerPress Podcasting: Server-Side Request Forgery (SSRF)CVE-2025-49984 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress Podcasting: from n/a through <= 11.13.11.
Product
PowerPress Podcasting
Affected
up to 11.13.11
What to do
Affects up to 11.13.11. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025Zara 4 Image Compression: Missing AuthorizationCVE-2025-49969 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through <= 1.2.17.2.
Product
Zara 4 Image Compression
Affected
up to 1.2.17.2
What to do
Affects up to 1.2.17.2. Update Zara 4 Image Compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025eForm - WordPress Form Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48333 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows Reflected XSS.This issue affects eForm - WordPress Form Builder: from n/a through < 4.19.1.
Product
eForm - WordPress Form Builder
What to do
Update eForm - WordPress Form Builder to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2025YITH PayPal Express Checkout for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-48111 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
Product
YITH PayPal Express Checkout for WooCommerce
Affected
up to 1.49.0
What to do
Affects up to 1.49.0. Update YITH PayPal Express Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 16, 2025WordPress Infinite Scroll – Ajax Load More: Stored Cross-Site ScriptingCVE-2025-4775 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Infinite Scroll – Ajax Load More
Affected
up to 7.4.0.1
What to do
Affects up to 7.4.0.1. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 12, 2025WordPress Single Sign-On (SSO): Unauthorized accessCVE-2025-6003 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.
Product
WordPress Single Sign-On (SSO)
Affected
up to the
What to do
Affects up to the. Update WordPress Single Sign-On (SSO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.miniorange.com wordfence.com
Jun 12, 2025The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file typCVE-2025-5012 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreap_temp_upload_to_media' function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 12, 2025The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, aCVE-2025-4973 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin.
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 11, 2025WordPress Automatic: Arbitrary file uploadsCVE-2025-5395 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, and including, 3.115.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WordPress Automatic
Affected
up to 3.115.0
What to do
Affects up to 3.115.0. Update WordPress Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jun 11, 2025Zotpress: Stored Cross-Site ScriptingCVE-2025-4666 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Zotpress
Affected
up to 7.3.15
What to do
Affects up to 7.3.15. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2025WordPress-WPJobBoard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49455 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge WordPress-WPJobBoard click-pledge-wpjobboard allows Blind SQL Injection.This issue affects WordPress-WPJobBoard: from n/a through <= 25.07010000-WP6.8.1-JB5.11.5.
Product
WordPress-WPJobBoard
Affected
up to 25.07010000-WP6.8.1-JB5.11.5
What to do
Affects up to 25.07010000-WP6.8.1-JB5.11.5. Update WordPress-WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 10, 2025Ultimate Blocks – WordPress Blocks: Stored Cross-Site ScriptingCVE-2025-2918 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Blocks – WordPress Blocks
Affected
up to 3.3.3
What to do
Affects up to 3.3.3. Update Ultimate Blocks – WordPress Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2025WordPress FlatNews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32305 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit WordPress FlatNews Theme flatnews allows Reflected XSS.This issue affects WordPress FlatNews Theme: from n/a through <= 5.8.
Product
WordPress FlatNews
Affected
up to 5.8
What to do
Affects up to 5.8. Update WordPress FlatNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025PressGrid - Frontend Publish Reaction & Multimedia: Deserialization of Untrusted DataCVE-2025-31429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.
Product
PressGrid - Frontend Publish Reaction & Multimedia
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update PressGrid - Frontend Publish Reaction & Multimedia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 7, 2025The LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Daylight Edition and LTL Freight Quotes – Day & Ross Edition plugins for WordPress are vulnerCVE-2025-5303 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Daylight Edition and LTL Freight Quotes – Day & Ross Edition plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the expiry_date parameter in all versions up to, and including, 1.0.11, 2.2.6 and 2.1.10 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2025GamiPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49326 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through <= 7.4.5.
Product
GamiPress
Affected
up to 7.4.5
What to do
Affects up to 7.4.5. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025DocsPress: Missing AuthorizationCVE-2025-49240 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPress: from n/a through <= 2.5.2.
Product
DocsPress
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update DocsPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Activity Plus Reloaded for BuddyPress: Missing AuthorizationCVE-2025-30957 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
Product
Activity Plus Reloaded for BuddyPress
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Activity Plus Reloaded for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WP Compress for MainWP: Missing AuthorizationCVE-2025-30932 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.30.32.
Product
WP Compress for MainWP
Affected
up to 6.30.32
What to do
Affects up to 6.30.32. Update WP Compress for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Mediabay - WordPress Media Library Folders: Cross-Site Request Forgery (CSRF)CVE-2025-28948 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.
Product
Mediabay - WordPress Media Library Folders
Affected
up to 1.4
What to do
Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025bbPress API: Missing AuthorizationCVE-2025-24763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pascal Casier bbPress API bbp-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects bbPress API: from n/a through <= 1.0.14.
Product
bbPress API
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update bbPress API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025WordPress Ajax Load More and Infinite Scroll: Stored Cross-Site ScriptingCVE-2025-5586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Ajax Load More and Infinite Scroll
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update WordPress Ajax Load More and Infinite Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 4, 2025Simple Contact Form Plugin for WordPress – WP Easy Contact: Stored Cross-Site ScriptingCVE-2025-5539 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Contact Form Plugin for WordPress – WP Easy Contact
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Simple Contact Form Plugin for WordPress – WP Easy Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 3, 2025Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Stored Cross-Site ScriptingCVE-2025-4420 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayu_blocks_option_panel_callback() function and insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2025WordPress Comments Import & Export: Unauthorized modification of dataCVE-2025-3919 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page. The vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4
Product
WordPress Comments Import & Export
Affected
up to 2.4.3
Fixed in
2.4.3
What to do
Update WordPress Comments Import & Export to 2.4.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2025Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro: Does not sanitise and escape some of its settingsCVE-2025-1485 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro
Fixed in
5.1.6
What to do
Update Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro to 5.1.6 or newer.
Full record and what to do →NVD record wpscan.com
May 23, 2025WordPress Social Login and Register: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47670 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.6.10.
Product
WordPress Social Login and Register
Affected
up to 7.6.10
What to do
Affects up to 7.6.10. Update WordPress Social Login and Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025ELEX WordPress HelpDesk & Customer Ticketing System: Unrestricted Upload of File with Dangerous TypeCVE-2025-47658 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through <= 3.2.9.
Product
ELEX WordPress HelpDesk & Customer Ticketing System
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Web3Press: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LikeCoin Web3Press likecoin allows Path Traversal.This issue affects Web3Press: from n/a through <= 3.2.0.
Product
Web3Press
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Web3Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Pixel WordPress Form BuilderPlugin & Autoresponder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31914 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind SQL Injection.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1.0.2.
Product
Pixel WordPress Form BuilderPlugin & Autoresponder
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Pixel WordPress Form BuilderPlugin & Autoresponder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025TablePress: DOM-Based Stored Cross-Site ScriptingCVE-2025-5096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', 'data-s-title', and 'data-footer' data-attributes in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TablePress
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update TablePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record datatables.net github.com
May 21, 2025Slim SEO – Fast & Automated WordPress SEO: Stored Cross-Site ScriptingCVE-2025-4611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slim SEO – Fast & Automated WordPress SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Slim SEO – Fast & Automated WordPress SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 21, 2025DPEPress: Stored Cross-Site ScriptingCVE-2025-4219 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DPEPress
Affected
up to 0.3
What to do
Affects up to 0.3. Update DPEPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025Madara – Responsive and modern WordPress theme for manga sites: Local File InclusionCVE-2025-4524 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Madara – Responsive and modern WordPress theme for manga sites
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Madara – Responsive and modern WordPress theme for manga sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mangabooth.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.