Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

5,764 results · page 23 of 116

May 2, 2025BuddyBoss Platform plugin and BuddyBoss: Stored Cross-Site ScriptingCVE-2024-13858 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in the BuddyBoss Platform plugin in version 2.8.41.
Product
BuddyBoss Platform plugin and BuddyBoss
Affected
up to 2.8.50
What to do
Affects up to 2.8.50. Update BuddyBoss Platform plugin and BuddyBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record buddyboss.com buddyboss.com
May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_secCVE-2024-13420 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record themeforest.net wordfence.com
May 2, 2025Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOpCVE-2024-13419 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record themeforest.net wordfence.com
May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in varCVE-2024-13418 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record themeforest.net wordfence.com
May 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2024-13322 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.88
What to do
Affects up to 4.88. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
May 1, 2025Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder: Stored Cross-Site ScriptingCVE-2025-3521 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 1, 2025The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WCVE-2025-2168 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on the dismiss() function. This makes it possible for unauthenticated attackers to set arbitrary user meta values to `1` which can be leveraged to lock and administrator out of their site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 26, 2025The Create custom forms for WordPress with a smart form plugin for smart businesses: Arbitrary shortcode executionCVE-2025-2801 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Create custom forms for WordPress with a smart form plugin for smart businesses
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update The Create custom forms for WordPress with a smart form plugin for smart businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 25, 2025The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation inCVE-2025-2470 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability.
Affected
up to 5.1
What to do
Affects up to 5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Apr 25, 2025Custom Login and Registration: Missing AuthorizationCVE-2025-46535 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in AlphaEfficiencyTeam Custom Login and Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login and Registration: from n/a through 1.0.0.
Product
Custom Login and Registration
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Custom Login and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025WS Force Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46521 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silver Muru WS Force Login Page ws-force-login-page allows Stored XSS.This issue affects WS Force Login Page: from n/a through <= 3.0.3.
Product
WS Force Login Page
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update WS Force Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025WP Customize Login Page: Missing AuthorizationCVE-2025-46485 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.
Product
WP Customize Login Page
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025WP Customize Login Page: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46477 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Stored XSS.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.
Product
WP Customize Login Page
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update WP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Plugin Central: Cross-Site Request Forgery (CSRF)CVE-2025-46439 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Plugin Central plugin-central allows Path Traversal.This issue affects Plugin Central: from n/a through <= 2.5.1.
Product
Plugin Central
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Plugin Central to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025BruteGuard – Brute Force Login Protection: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39408 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through <= 0.1.4.
Product
BruteGuard – Brute Force Login Protection
Affected
up to 0.1.4
What to do
Affects up to 0.1.4. Update BruteGuard – Brute Force Login Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Frontend Login and Registration Blocks: Privilege escalationCVE-2025-3607 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.8. This is due to the plugin not properly validating a user's identity prior to updating a password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Product
Frontend Login and Registration Blocks
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Frontend Login and Registration Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 19, 2025Wordpress Plugin Smart Product Review: Arbitrary file uploadsCVE-2021-4455 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Wordpress Plugin Smart Product Review
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Wordpress Plugin Smart Product Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record exploit-db.com wordfence.com
Apr 18, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Cross-Site Request ForgeryCVE-2025-3284 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpuserregistration.com wordfence.com
Apr 18, 2025Coupon Affiliates – Affiliate Plugin for WooCommerce: Reflected Cross-Site ScriptingCVE-2025-3598 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commission_summary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Coupon Affiliates – Affiliate Plugin for WooCommerce
Affected
up to .6.3.0
What to do
Affects up to .6.3.0. Update Coupon Affiliates – Affiliate Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2025Login Manager – Design Login Page, View Login Activity, Limit Login Attempts: Stored Cross-Site ScriptingCVE-2025-2613 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom logo and background URLs in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Login Manager – Design Login Page, View Login Activity, Limit Login Attempts
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Login Manager – Design Login Page, View Login Activity, Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 17, 2025My Marginalia: Cross-Site Request Forgery (CSRF)CVE-2025-39435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in davidfcarr My Marginalia my-marginalia allows Stored XSS.This issue affects My Marginalia: from n/a through <= 1.0.6.
Product
My Marginalia
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update My Marginalia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Protected wp-login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27333 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alvego Protected wp-login protected-wp-login allows Reflected XSS.This issue affects Protected wp-login: from n/a through <= 2.1.
Product
Protected wp-login
Affected
up to 2.1
What to do
Affects up to 2.1. Update Protected wp-login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin foCVE-2025-3453 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2025WooCommerce Social Login: Cross-Site Request Forgery (CSRF)CVE-2025-39472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through < 2.8.3.
Product
WooCommerce Social Login
Fixed in
2.8.3
What to do
Update WooCommerce Social Login to 2.8.3 or newer.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025MelaPress Login Security: Deserialization of Untrusted DataCVE-2025-39565 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaPress Login Security: from n/a through <= 2.1.0.
Product
MelaPress Login Security
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update MelaPress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025WP STAGING Pro WordPress Backup: Information ExposureCVE-2025-3104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins.
Product
WP STAGING Pro WordPress Backup
Affected
up to 6.1.2
What to do
Affects up to 6.1.2. Update WP STAGING Pro WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wp-staging.com wordfence.com
Apr 15, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through <= 3.6.4.1.
Product
JetEngine
Affected
up to 3.6.4.1
What to do
Affects up to 3.6.4.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Stored Cross-Site ScriptingCVE-2025-2225 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rael_title_tag' parameter in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 1.6.9.
Product
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 14, 2025PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its settingsCVE-2024-9230 · WordPress plugins & themes · reported by WPScanMedium 5.9
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.9.18
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.9.18 or newer.
Full record and what to do →NVD record wpscan.com
Apr 12, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3292 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to update other user's passwords, if they have access to the user ID and email.
Product
User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 12, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2025-3282 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.
Product
User Registration & Membership – Custom Registration Form, Login Form, and User Profile
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13338 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcr_clearfy' page. This makes it possible for unauthenticated attackers to update the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.dev plugins.trac.wordpress.org
Apr 11, 2025Eazy Plugin Manager: Missing AuthorizationCVE-2025-32542 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in EazyPlugins Eazy Plugin Manager plugins-on-steroids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eazy Plugin Manager: from n/a through <= 4.3.0.
Product
Eazy Plugin Manager
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update Eazy Plugin Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025InstaWP Connect – 1-click WP Staging & Migration: Local File InclusionCVE-2025-2636 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file types can be uploaded and included, or are already present on the filesystem locally. There are currently no known vulnerabilities in this plugin that make file upload possible, meaning this won't be exploitable to achieve remote code execution on most instances with just this plugin alone. Another vulnerability would need to be present on the site allowing arbitrary file upload in order to leverage this to achieve remote code execution.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.85
What to do
Affects up to 0.1.0.85. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 10, 2025The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerableCVE-2025-2719 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in versions 1.2.8 to 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.
Affected
1.2.8 to 1.4.0
What to do
Affects 1.2.8 to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2025WordPress Events Calendar Plugin – connectDaily: Cross-Site Request Forgery (CSRF)CVE-2025-32597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Cross-Site Scripting (XSS).This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through <= 1.5.4.
Product
WordPress Events Calendar Plugin – connectDaily
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update WordPress Events Calendar Plugin – connectDaily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025ALD Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-32518 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hossainawlad ALD Login Page ald-login-page allows Stored XSS.This issue affects ALD Login Page: from n/a through <= 1.1.
Product
ALD Login Page
Affected
up to 1.1
What to do
Affects up to 1.1. Update ALD Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Customize Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-31034 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AboZain Albanna Customize Login Page customize-login-page allows Cross Site Request Forgery.This issue affects Customize Login Page: from n/a through <= 1.1.
Product
Customize Login Page
Affected
up to 1.1
What to do
Affects up to 1.1. Update Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WordPress/Plugin Upgrade Time Out: Does not have CSRF check in some placesCVE-2024-8243 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
WordPress/Plugin Upgrade Time Out
Affected
up to 1.0
What to do
Affects up to 1.0. Update WordPress/Plugin Upgrade Time Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Apr 9, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Stored Cross-Site ScriptingCVE-2025-3100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Affected
up to 2.6.22
What to do
Affects up to 2.6.22. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2025MelaPress Login Security and MelaPress Login Security Premium: Unauthorized loss of dataCVE-2025-2876 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor_admin_actions' function in version 2.1.0. This makes it possible for unauthenticated attackers to delete any user.
Product
MelaPress Login Security and MelaPress Login Security Premium
What to do
Update MelaPress Login Security and MelaPress Login Security Premium to the newest version.
Full record and what to do →NVD record melapress.com plugins.trac.wordpress.org
Apr 8, 2025Motors – Car Dealership & Classified Listings: Arbitrary plugin installationsCVE-2025-2807 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check in the mvl_setup_wizard_install_plugin() function in all versions up to, and including, 1.4.64. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins on the affected site's server which may make remote code execution possible.
Product
Motors – Car Dealership & Classified Listings
Affected
up to 1.4.64
What to do
Affects up to 1.4.64. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 8, 2025coreActivity: Activity Logging for: SQL InjectionCVE-2025-3436 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and 'orderby' parameters in all versions up to, and including, 2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
coreActivity: Activity Logging for
Affected
up to 2.7
What to do
Affects up to 2.7. Update coreActivity: Activity Logging for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2025KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base: Sensitive Information ExposureCVE-2024-13604 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
Product
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 2025Official CleverReach Plugin for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-32241 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in CleverReach® Official CleverReach Plugin for WooCommerce cleverreach-wc allows Cross Site Request Forgery.This issue affects Official CleverReach Plugin for WooCommerce: from n/a through <= 3.4.6.
Product
Official CleverReach Plugin for WooCommerce
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Official CleverReach Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Social Share Buttons & Analytics Plugin – GetSocial.io: Missing AuthorizationCVE-2025-32239 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joao Romao Social Share Buttons & Analytics Plugin – GetSocial.io wp-share-buttons-analytics-by-getsocial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Buttons & Analytics Plugin – GetSocial.io: from n/a through <= 4.5.
Product
Social Share Buttons & Analytics Plugin – GetSocial.io
Affected
up to 4.5
What to do
Affects up to 4.5. Update Social Share Buttons & Analytics Plugin – GetSocial.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Showeblogin Social: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32169 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh Prasad Showeblogin Social showeblogin-facebook-page-like-box allows DOM-Based XSS.This issue affects Showeblogin Social: from n/a through <= 7.0.
Product
Showeblogin Social
Affected
up to 7.0
What to do
Affects up to 7.0. Update Showeblogin Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Pallet Packaging for WooCommerce: Missing AuthorizationCVE-2025-22285 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Pallet Packaging for WooCommerce pallet-packaging-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pallet Packaging for WooCommerce: from n/a through <= 1.1.15.
Product
Pallet Packaging for WooCommerce
Affected
up to 1.1.15
What to do
Affects up to 1.1.15. Update Pallet Packaging for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, anCVE-2025-3105 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator.
Affected
up to 1.0.97
What to do
Affects up to 1.0.97. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.vehica.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.