Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,671 results · page 23 of 54
May 23, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46486 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.7.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.7
- What to do
- Affects up to 7.1.7. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Enhanced Paypal Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46543 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CharlyLeetham Enhanced Paypal Shortcodes enhanced-paypal-shortcodes allows Stored XSS.This issue affects Enhanced Paypal Shortcodes: from n/a through <= 0.5a.
- Product
- Enhanced Paypal Shortcodes
- Affected
- up to 0.5a
- What to do
- Affects up to 0.5a. Update Enhanced Paypal Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Payment Gateway for Telcell: Does not validate the api_url parameter before redirecting the user to its valueCVE-2023-6786 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue
- Product
- Payment Gateway for Telcell
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Payment Gateway for Telcell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not have CSRF check in placeCVE-2023-5934 · WordPress plugins & themes · reported by WPScanHigh 7.3
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.13
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.13 or newer.
May 15, 2025Travelpayouts: All Travel Brands in One Place: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5932 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Travelpayouts: All Travel Brands in One Place
- Fixed in
- 1.1.14
- What to do
- Update Travelpayouts: All Travel Brands in One Place to 1.1.14 or newer.
May 15, 2025A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload intCVE-2025-46053 · Other software · Weberp · reported by MITREMedium 5.1
A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.php
- Product
- Weberp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29691 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the userName parameter at /login/LoginsController.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29690 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the outtype parameter at /address/AddrController.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29689 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the password parameter at /mail/MailController.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29688 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /daymanager/daymanageabilitycontroller.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2025-29686 · Other software · Hailey888 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in OA System before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the title parameter at /inform/InformManageController.java.
- Product
- OA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2025WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Stored Cross-Site ScriptingCVE-2025-3794 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 7, 2025Pays – WooCommerce Payment Gateway: Cross-Site Request Forgery (CSRF)CVE-2025-47648 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in axima Pays – WooCommerce Payment Gateway axima-payment-gateway allows Stored XSS.This issue affects Pays – WooCommerce Payment Gateway: from n/a through <= 2.6.
- Product
- Pays – WooCommerce Payment Gateway
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Pays – WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Easy PayPal Buy Now Button: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47623 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button wp-ecommerce-paypal allows Stored XSS.This issue affects Easy PayPal Buy Now Button: from n/a through <= 2.0.
- Product
- Easy PayPal Buy Now Button
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Easy PayPal Buy Now Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Easy PayPal Events: Cross-Site Request Forgery (CSRF)CVE-2025-47519 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Easy PayPal Events easy-paypal-events-tickets allows Cross Site Request Forgery.This issue affects Easy PayPal Events: from n/a through <= 1.2.2.
- Product
- Easy PayPal Events
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Easy PayPal Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Contact Form 7 – PayPal & Stripe Add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47518 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on allows Stored XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through <= 2.3.4.
- Product
- Contact Form 7 – PayPal & Stripe Add-on
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update Contact Form 7 – PayPal & Stripe Add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Accept Donations with PayPal & Stripe: Cross-Site Request Forgery (CSRF)CVE-2025-47517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Stored XSS.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.4.5.
- Product
- Accept Donations with PayPal & Stripe
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Accept Donations with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025Download Manager and Payment Form WordPress Plugin – WP SmartPay: Insecure Direct Object ReferenceCVE-2025-3851 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's data like email address, name, and notes.
- Product
- Download Manager and Payment Form WordPress Plugin – WP SmartPay
- Affected
- 1.1.0 to 2.7.13
- What to do
- Affects 1.1.0 to 2.7.13. Update Download Manager and Payment Form WordPress Plugin – WP SmartPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 6, 2025An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage withCVE-2025-3020 · Other software · Wiesemann & Theis · reported by info@cert.vde.comMedium 5.4
An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage with limited impact.
- Product
- ERP-Gateway 12x Digital Input, 6x Digital Relais
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.CVE-2025-45617 · Other software · Megagao · reported by MITREHigh 7.5
Incorrect access control in the component /user/list of production_ssm v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
- Product
- Production SSM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload.CVE-2025-45614 · Other software · Lcw2004 · reported by MITREHigh 7.5
Incorrect access control in the component /api/user/manager of One v1.0 allows attackers to access sensitive information via a crafted payload.
- Product
- ONE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload.CVE-2025-45613 · Other software · Zhaojun1998 · reported by MITREHigh 7.5
Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload.
- Product
- Shiro-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payloadCVE-2025-45610 · Other software · Passjava · reported by MITREHigh 7.5
Incorrect access control in the component /scheduleLog/info/1 of PassJava-Platform v3.0.0 allows attackers to access sensitive information via a crafted payload.
- Product
- Passjava
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload.CVE-2025-45609 · Other software · KE · reported by MITREHigh 7.5
Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
- Product
- KOB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.CVE-2025-45608 · Other software · Zykzhangyukang · reported by MITREHigh 7.5
Incorrect access control in the /system/user/findUserList API of Xinguan v0.0.1-SNAPSHOT allows attackers to access sensitive information via a crafted payload.
- Product
- Xinguan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025PayPal Express Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46499 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder PayPal Express Checkout paypal-express-checkout allows Stored XSS.This issue affects PayPal Express Checkout: from n/a through <= 2.1.2.
- Product
- PayPal Express Checkout
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update PayPal Express Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 23, 2025This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints.CVE-2025-42603 · Other software · Meon · reported by vdisclose@cert-in.org.inHigh 8.7
This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive information belonging to other users. Successful exploitation of this vulnerability could allow remote attacker to impersonate the target user and gain unauthorized access to the user account.
- Product
- KYC solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2025A stored cross-site scripting (XSS) vulnerability fin Student Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payCVE-2023-44753 · Other software · Mayurik · reported by MITREMedium 6.1
A stored cross-site scripting (XSS) vulnerability fin Student Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter on the profile.php page.
- Product
- Online Student Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflashy-lemonade-192.notion.siteflashy-lemonade-192.notion.site
Apr 22, 2025A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into thCVE-2023-43378 · Other software · Digitaldruid · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the commento1_1 parameter.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordflashy-lemonade-192.notion.siteflashy-lemonade-192.notion.site
Apr 21, 2025A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into theCVE-2025-28102 · Other software · Dogukanurker · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the postContent parameter at /createpost.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2025Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image titleCVE-2024-42699 · Other software · Alkacon · reported by MITREMedium 6.5
Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field
- Product
- Opencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2024-41446 · Other software · Alkacon · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.
- Product
- Opencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025An issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers to escalate privileges via a crafted JSON payload.CVE-2025-28237 · Other software · reported by MITREHigh 8.8
An issue in WorldCast Systems ECRESO FM/DAB/TV Transmitter v1.10.1 allows authenticated attackers to escalate privileges via a crafted JSON payload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injecCVE-2024-41447 · Other software · Alkacon · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function.
- Product
- Opencms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2025Payment Form for PayPal Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39562 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Payment Form for PayPal Pro payment-form-for-paypal-pro allows Stored XSS.This issue affects Payment Form for PayPal Pro: from n/a through <= 1.1.72.
- Product
- Payment Form for PayPal Pro
- Affected
- up to 1.1.72
- What to do
- Affects up to 1.1.72. Update Payment Form for PayPal Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025WooCommerce TBC Credit Card Payment Gateway (Free): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in We Are De WooCommerce TBC Credit Card Payment Gateway (Free) woo-tbc-payment-gateway allows Reflected XSS.This issue affects WooCommerce TBC Credit Card Payment Gateway (Free): from n/a through <= 2.0.0.
- Product
- WooCommerce TBC Credit Card Payment Gateway (Free)
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update WooCommerce TBC Credit Card Payment Gateway (Free) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Nomupay Payment Processing Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Reflected XSS.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.6.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.6
- What to do
- Affects up to 7.1.6. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-3487 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.42.0
- What to do
- Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Order ReplayCVE-2025-3479 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.42.0
- What to do
- Affects up to 1.42.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 16, 2025Checkout for PayPal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39572 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Stored XSS.This issue affects Checkout for PayPal: from n/a through <= 1.0.38.
- Product
- Checkout for PayPal
- Affected
- up to 1.0.38
- What to do
- Affects up to 1.0.38. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Conditional Payments for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-39563 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in WP Trio Conditional Payments for WooCommerce conditional-payments-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Payments for WooCommerce: from n/a through <= 3.3.0.
- Product
- Conditional Payments for WooCommerce
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Conditional Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.CVE-2025-29471 · Other software · Nagios · reported by MITREHigh 8.3
Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.
- Product
- LOG Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comnagios.com
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: PHP Object InjectionCVE-2025-3439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.1 via deserialization of untrusted input from the 'field_value' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 11, 2025The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Arbitrary shortcode executionCVE-2025-3422 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Reflected Cross-Site ScriptingCVE-2025-3421 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 11, 2025Twispay Credit Card Payments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32601 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in twispay Twispay Credit Card Payments twispay allows Reflected XSS.This issue affects Twispay Credit Card Payments: from n/a through <= 2.1.2.
- Product
- Twispay Credit Card Payments
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Twispay Credit Card Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025ABA PayWay Payment Gateway for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce aba-payway-woocommerce-payment-gateway allows Reflected XSS.This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through <= 2.1.4.
- Product
- ABA PayWay Payment Gateway for WooCommerce
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update ABA PayWay Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WooCommerce – Payphone Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32523 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in payphone WooCommerce – Payphone Gateway wc-payphone-gateway allows Reflected XSS.This issue affects WooCommerce – Payphone Gateway: from n/a through <= 3.2.0.
- Product
- WooCommerce – Payphone Gateway
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update WooCommerce – Payphone Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.CVE-2025-32816 · Other software · CodeLit · reported by MITRELow 3.1
CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.
- Product
- CourseLit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.5.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.5
- What to do
- Affects up to 7.1.5. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.