Vulnerability database

3,631 results · page 23 of 73

• Feb 24, 2025Önceki Yazı Link: Cross-Site Request Forgery (CSRF)CVE-2025-27357 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Musa AVCI Önceki Yazı Link onceki-yazi-linki allows Cross Site Request Forgery.This issue affects Önceki Yazı Link: from n/a through <= 1.3.

  Product

  Önceki Yazı Link

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Önceki Yazı Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Woocommerce – Loi Hamon: Cross-Site Request Forgery (CSRF)CVE-2025-27355 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Nicolas GRILLET Woocommerce – Loi Hamon loi-hamon allows Stored XSS.This issue affects Woocommerce – Loi Hamon: from n/a through <= 1.1.0.

  Product

  Woocommerce – Loi Hamon

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Woocommerce – Loi Hamon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Namaste! LMS: Cross-Site Request Forgery (CSRF)CVE-2025-27353 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Bob Namaste! LMS namaste-lms allows Cross Site Request Forgery.This issue affects Namaste! LMS: from n/a through <= 2.6.5.

  Product

  Namaste! LMS

  Affected

  up to 2.6.5

  What to do

  Affects up to 2.6.5. Update Namaste! LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Phee's LinkPreview: Cross-Site Request Forgery (CSRF)CVE-2025-27344 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in filipstepanov Phee's LinkPreview linkpreview allows Cross Site Request Forgery.This issue affects Phee's LinkPreview: from n/a through <= 1.6.7.

  Product

  Phee's LinkPreview

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Phee's LinkPreview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025WooCommerce Recargo de Equivalencia: Cross-Site Request Forgery (CSRF)CVE-2025-27342 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in josesan WooCommerce Recargo de Equivalencia woo-recargo-de-equivalencia allows Cross Site Request Forgery.This issue affects WooCommerce Recargo de Equivalencia: from n/a through <= 1.6.24.

  Product

  WooCommerce Recargo de Equivalencia

  Affected

  up to 1.6.24

  What to do

  Affects up to 1.6.24. Update WooCommerce Recargo de Equivalencia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025F12-Profiler: Cross-Site Request Forgery (CSRF)CVE-2025-27340 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Forge12 Interactive GmbH F12-Profiler f12-profiler allows Cross Site Request Forgery.This issue affects F12-Profiler: from n/a through <= 1.3.9.

  Product

  F12-Profiler

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update F12-Profiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Minimum Password Strength: Cross-Site Request Forgery (CSRF)CVE-2025-27339 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Will Anderson Minimum Password Strength minimum-password-strength allows Cross Site Request Forgery.This issue affects Minimum Password Strength: from n/a through <= 1.2.0.

  Product

  Minimum Password Strength

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Minimum Password Strength to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Just Variables: Cross-Site Request Forgery (CSRF)CVE-2025-27336 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Alex Prokopenko / JustCoded Just Variables just-wp-variables allows Cross Site Request Forgery.This issue affects Just Variables: from n/a through <= 1.2.3.

  Product

  Just Variables

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Just Variables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Auto Tag Links: Cross-Site Request Forgery (CSRF)CVE-2025-27335 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Free plug in by SEO Roma Auto Tag Links auto-tag-links allows Cross Site Request Forgery.This issue affects Auto Tag Links: from n/a through <= 1.0.13.

  Product

  Auto Tag Links

  Affected

  up to 1.0.13

  What to do

  Affects up to 1.0.13. Update Auto Tag Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Smart Maintenance & Countdown: Cross-Site Request Forgery (CSRF)CVE-2025-27332 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gmnazmul Smart Maintenance & Countdown smart-maintenance-countdown allows Stored XSS.This issue affects Smart Maintenance & Countdown: from n/a through <= 1.2.

  Product

  Smart Maintenance & Countdown

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Smart Maintenance & Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025WP-PostRatings Cheater: Cross-Site Request Forgery (CSRF)CVE-2025-27328 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in queeez WP-PostRatings Cheater wp-postratings-cheater allows Cross Site Request Forgery.This issue affects WP-PostRatings Cheater: from n/a through <= 1.5.

  Product

  WP-PostRatings Cheater

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update WP-PostRatings Cheater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Blightly Explorer: Cross-Site Request Forgery (CSRF)CVE-2025-27321 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Blighty Blightly Explorer blighty-explorer allows Stored XSS.This issue affects Blightly Explorer: from n/a through <= 2.3.0.

  Product

  Blightly Explorer

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Blightly Explorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Simple Google Sitemap: Cross-Site Request Forgery (CSRF)CVE-2025-27318 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ixiter Simple Google Sitemap simple-google-sitemap allows Cross Site Request Forgery.This issue affects Simple Google Sitemap: from n/a through <= 1.6.

  Product

  Simple Google Sitemap

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Simple Google Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025RAYS Grid: Cross-Site Request Forgery (CSRF)CVE-2025-27317 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in IT-RAYS RAYS Grid rays-grid allows Cross Site Request Forgery.This issue affects RAYS Grid: from n/a through <= 1.3.1.

  Product

  RAYS Grid

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update RAYS Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025JPG, PNG Compression and Optimization: Cross-Site Request Forgery (CSRF)CVE-2025-27316 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in hosting.io JPG, PNG Compression and Optimization wp-image-compression allows Cross Site Request Forgery.This issue affects JPG, PNG Compression and Optimization: from n/a through <= 1.7.35.

  Product

  JPG, PNG Compression and Optimization

  Affected

  up to 1.7.35

  What to do

  Affects up to 1.7.35. Update JPG, PNG Compression and Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025All-In-One Cufon: Cross-Site Request Forgery (CSRF)CVE-2025-27315 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wptom All-In-One Cufon all-in-one-cufon allows Cross Site Request Forgery.This issue affects All-In-One Cufon: from n/a through <= 1.3.0.

  Product

  All-In-One Cufon

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update All-In-One Cufon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Bulk Content Creator: Cross-Site Request Forgery (CSRF)CVE-2025-27311 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in luk3thomas Bulk Content Creator bulk-content-creator allows Cross Site Request Forgery.This issue affects Bulk Content Creator: from n/a through <= 1.2.1.

  Product

  Bulk Content Creator

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Bulk Content Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025WP Video Posts: Cross-Site Request Forgery (CSRF)CVE-2025-27298 · WordPress plugins & themes · reported by PatchstackHigh 8.3

  Cross-Site Request Forgery (CSRF) vulnerability in cmstactics WP Video Posts wp-video-posts allows OS Command Injection.This issue affects WP Video Posts: from n/a through <= 3.5.1.

  Product

  WP Video Posts

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update WP Video Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Erima Zarinpal Donate: Cross-Site Request Forgery (CSRF)CVE-2025-27290 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in seyyed-amir Erima Zarinpal Donate erima-zarinpal-donate allows Cross Site Request Forgery.This issue affects Erima Zarinpal Donate: from n/a through <= 1.0.

  Product

  Erima Zarinpal Donate

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Erima Zarinpal Donate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Add Linked Images To Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-27277 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in tiefpunkt Add Linked Images To Gallery add-linked-images-to-gallery-v01 allows Cross Site Request Forgery.This issue affects Add Linked Images To Gallery: from n/a through <= 1.4.

  Product

  Add Linked Images To Gallery

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Add Linked Images To Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 24, 2025Photo Gallery ( Responsive ): Cross-Site Request Forgery (CSRF)CVE-2025-27276 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in lizeipe Photo Gallery ( Responsive ) photo-gallery-pearlbells allows Privilege Escalation.This issue affects Photo Gallery ( Responsive ): from n/a through <= 4.0.

  Product

  Photo Gallery ( Responsive )

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Photo Gallery ( Responsive ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 22, 2025A1POST.BG Shipping for Woo: Cross-Site Request Forgery (CSRF)CVE-2025-27012 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in a1post A1POST.BG Shipping for Woo a1post-bg-shipping-for-woocommerce allows Privilege Escalation.This issue affects A1POST.BG Shipping for Woo: from n/a through <= 1.5.

  Product

  A1POST.BG Shipping for Woo

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update A1POST.BG Shipping for Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025what3words Address Field: Cross-Site Request Forgery (CSRF)CVE-2025-26768 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in what3words what3words Address Field 3-word-address-validation-field allows Stored XSS.This issue affects what3words Address Field: from n/a through <= 4.0.15.

  Product

  what3words Address Field

  Affected

  up to 4.0.15

  What to do

  Affects up to 4.0.15. Update what3words Address Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 16, 2025Content Snippet Manager: Cross-Site Request Forgery (CSRF)CVE-2025-26759 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager content-snippet-manager allows Stored XSS.This issue affects Content Snippet Manager: from n/a through <= 1.1.5.

  Product

  Content Snippet Manager

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Content Snippet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025WP Coder: Cross-Site Request Forgery (CSRF)CVE-2025-24699 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting (XSS).This issue affects WP Coder: from n/a through <= 3.6.

  Product

  WP Coder

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update WP Coder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 14, 2025Disqus Popular Posts: Cross-Site Request Forgery (CSRF)CVE-2025-22705 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts disqus-popular-posts allows Reflected XSS.This issue affects Disqus Popular Posts: from n/a through <= 2.1.1.

  Product

  Disqus Popular Posts

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Disqus Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025TinyMCE Advanced qTranslate fix editor problems: Cross-Site Request Forgery (CSRF)CVE-2025-26582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems allows Stored XSS.This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through <= 1.0.0.

  Product

  TinyMCE Advanced qTranslate fix editor problems

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update TinyMCE Advanced qTranslate fix editor problems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Page/Post Specific Social Share Buttons: Cross-Site Request Forgery (CSRF)CVE-2025-26580 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Complete SEO Page/Post Specific Social Share Buttons pagepost-specific-social-share-buttons allows Stored XSS.This issue affects Page/Post Specific Social Share Buttons: from n/a through <= 2.1.

  Product

  Page/Post Specific Social Share Buttons

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Page/Post Specific Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Simple Documentation: Cross-Site Request Forgery (CSRF)CVE-2025-26578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mathieuhays Simple Documentation client-documentation allows Stored XSS.This issue affects Simple Documentation: from n/a through <= 1.2.8.

  Product

  Simple Documentation

  Affected

  up to 1.2.8

  What to do

  Affects up to 1.2.8. Update Simple Documentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025DX-auto-publish: Cross-Site Request Forgery (CSRF)CVE-2025-26577 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in daxiawp DX-auto-publish dx-auto-publish allows Stored XSS.This issue affects DX-auto-publish: from n/a through <= 1.2.

  Product

  DX-auto-publish

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update DX-auto-publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025WP PHPList: Cross-Site Request Forgery (CSRF)CVE-2025-26572 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in jesseheap WP PHPList phplist-form-integration allows Cross Site Request Forgery.This issue affects WP PHPList: from n/a through <= 1.7.

  Product

  WP PHPList

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update WP PHPList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Wibiya Toolbar: Cross-Site Request Forgery (CSRF)CVE-2025-26571 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wibiya Wibiya Toolbar wibiya allows Cross Site Request Forgery.This issue affects Wibiya Toolbar: from n/a through <= 2.0.

  Product

  Wibiya Toolbar

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Wibiya Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Glance That: Cross-Site Request Forgery (CSRF)CVE-2025-26570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in uamv Glance That allows Cross Site Request Forgery. This issue affects Glance That: from n/a through 4.9.

  Product

  Glance That

  Affected

  up to 4.9

  What to do

  Affects up to 4.9. Update Glance That to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Post Thumbs: Cross-Site Request Forgery (CSRF)CVE-2025-26569 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5.

  Product

  Post Thumbs

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Post Thumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Easy Amazon Product Information: Cross-Site Request Forgery (CSRF)CVE-2025-26568 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in jensmueller Easy Amazon Product Information easy-amazon-product-information allows Stored XSS.This issue affects Easy Amazon Product Information: from n/a through <= 4.0.1.

  Product

  Easy Amazon Product Information

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Easy Amazon Product Information to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025RSS Filter: Cross-Site Request Forgery (CSRF)CVE-2025-26562 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik RSS Filter rss-filter allows Stored XSS.This issue affects RSS Filter: from n/a through <= 1.2.

  Product

  RSS Filter

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update RSS Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Global Meta Keyword & Description: Cross-Site Request Forgery (CSRF)CVE-2025-26550 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Kunal Shivale Global Meta Keyword & Description global-meta-keyword-and-description allows Stored XSS.This issue affects Global Meta Keyword & Description: from n/a through <= 2.3.

  Product

  Global Meta Keyword & Description

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Global Meta Keyword & Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025WP Html Page Sitemap: Cross-Site Request Forgery (CSRF)CVE-2025-26549 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in pa1 WP Html Page Sitemap wp-html-page-sitemap allows Stored XSS.This issue affects WP Html Page Sitemap: from n/a through <= 2.2.

  Product

  WP Html Page Sitemap

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update WP Html Page Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025My Login Logout: Cross-Site Request Forgery (CSRF)CVE-2025-26547 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plugin: from n/a through <= 2.4.

  Product

  My Login Logout

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update My Login Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Related Posts Line-up-Exactly by Milliard: Cross-Site Request Forgery (CSRF)CVE-2025-26545 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in shisuh Related Posts Line-up-Exactly by Milliard related-posts-line-up-exactry-by-milliard allows Stored XSS.This issue affects Related Posts Line-up-Exactly by Milliard: from n/a through <= 0.0.22.

  Product

  Related Posts Line-up-Exactly by Milliard

  Affected

  up to 0.0.22

  What to do

  Affects up to 0.0.22. Update Related Posts Line-up-Exactly by Milliard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 13, 2025Simple Responsive Menu: Cross-Site Request Forgery (CSRF)CVE-2025-26543 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Pukhraj Suthar Simple Responsive Menu simple-responsive-menu allows Stored XSS.This issue affects Simple Responsive Menu: from n/a through <= 2.1.

  Product

  Simple Responsive Menu

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Simple Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025BookPress – For Book Authors: Cross-Site Request Forgery (CSRF)CVE-2025-25168 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Black and White BookPress – For Book Authors book-press allows Cross-Site Scripting (XSS).This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.

  Product

  BookPress – For Book Authors

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update BookPress – For Book Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025InLocation: Cross-Site Request Forgery (CSRF)CVE-2025-25166 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation inlocation allows Stored XSS.This issue affects InLocation: from n/a through <= 1.8.

  Product

  InLocation

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update InLocation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Style Tweaker: Cross-Site Request Forgery (CSRF)CVE-2025-25160 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through <= 0.11.

  Product

  Style Tweaker

  Affected

  up to 0.11

  What to do

  Affects up to 0.11. Update Style Tweaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Quote Comments: Cross-Site Request Forgery (CSRF)CVE-2025-25156 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments quote-comments allows Stored XSS.This issue affects Quote Comments: from n/a through <= 3.0.0.

  Product

  Quote Comments

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Quote Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Custom Comment Notifications: Cross-Site Request Forgery (CSRF)CVE-2025-25154 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications custom-comment-notifications allows Stored XSS.This issue affects Custom Comment Notifications: from n/a through <= 1.0.8.

  Product

  Custom Comment Notifications

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Custom Comment Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Simple Auto Tag: Cross-Site Request Forgery (CSRF)CVE-2025-25153 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.

  Product

  Simple Auto Tag

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Simple Auto Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Smart DoFollow: Cross-Site Request Forgery (CSRF)CVE-2025-25152 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a through <= 1.0.2.

  Product

  Smart DoFollow

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Smart DoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Login-box: Cross-Site Request Forgery (CSRF)CVE-2025-25149 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4.

  Product

  Login-box

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Login-box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 7, 2025Read More Copy Link: Cross-Site Request Forgery (CSRF)CVE-2025-25148 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link read-more-copy-link allows Stored XSS.This issue affects Read More Copy Link: from n/a through <= 1.0.2.

  Product

  Read More Copy Link

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Read More Copy Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.