Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,856 results · page 23 of 58
Apr 15, 2025Macro Calculator with Admin Email Optin & Data: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26730 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue affects Macro Calculator with Admin Email Optin & Data: from n/a through 1.0.
- Product
- Macro Calculator with Admin Email Optin & Data
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Macro Calculator with Admin Email Optin & Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025FS Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30962 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fs-code FS Poster fs-poster allows Reflected XSS.This issue affects FS Poster: from n/a through <= 6.5.8.
- Product
- FS Poster
- Affected
- up to 6.5.8
- What to do
- Affects up to 6.5.8. Update FS Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Developer Toolbar: Sensitive Information ExposureCVE-2025-2881 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Developer Toolbar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
- Product
- Developer Toolbar
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Developer Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 11, 2025Cart66 Cloud: Sensitive Information ExposureCVE-2025-2841 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cart66 Cloud plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.7 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
- Product
- Cart66 Cloud
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update Cart66 Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 11, 2025Sync Posts: Unrestricted Upload of File with Dangerous TypeCVE-2025-32579 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts sync-posts allows Upload a Web Shell to a Web Server.This issue affects Sync Posts: from n/a through <= 1.0.
- Product
- Sync Posts
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Sync Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Easy Post Duplicator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32567 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows SQL Injection.This issue affects Easy Post Duplicator: from n/a through <= 1.0.1.
- Product
- Easy Post Duplicator
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Easy Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Easy Post Duplicator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32538 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows Reflected XSS.This issue affects Easy Post Duplicator: from n/a through <= 1.0.1.
- Product
- Easy Post Duplicator
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Easy Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Ai Image Alt Text Generator for WP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32228 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.9.
- Product
- Ai Image Alt Text Generator for WP
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025ORDER POST: Arbitrary shortcode executionCVE-2025-2805 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- ORDER POST
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update ORDER POST to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Apr 9, 2025Custom Posts Order: Cross-Site Request Forgery (CSRF)CVE-2025-32645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Hiren Patel Custom Posts Order custom-posts-order allows Stored XSS.This issue affects Custom Posts Order: from n/a through <= 4.4.
- Product
- Custom Posts Order
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update Custom Posts Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Simple Post Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through <= 1.0.9.
- Product
- Simple Post Meta Manager
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Simple Post Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025VKontakte Cross-Post: Cross-Site Request Forgery (CSRF)CVE-2025-32498 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in oleglark VKontakte Cross-Post vkontakte-cross-post allows Stored XSS.This issue affects VKontakte Cross-Post: from n/a through <= 0.3.2.
- Product
- VKontakte Cross-Post
- Affected
- up to 0.3.2
- What to do
- Affects up to 0.3.2. Update VKontakte Cross-Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Admin Menu Post List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32492 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eliot Akira Admin Menu Post List admin-menu-post-list allows Stored XSS.This issue affects Admin Menu Post List: from n/a through <= 2.0.7.
- Product
- Admin Menu Post List
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Admin Menu Post List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025NewsBoard Post and RSS Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-31402 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in NewsBoard Plugin NewsBoard Post and RSS Scroller newsboard allows Stored XSS.This issue affects NewsBoard Post and RSS Scroller: from n/a through <= 1.2.12.
- Product
- NewsBoard Post and RSS Scroller
- Affected
- up to 1.2.12
- What to do
- Affects up to 1.2.12. Update NewsBoard Post and RSS Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Squeeze: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31003 · WordPress plugins & themes · reported by PatchstackLow 2.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitive Data.This issue affects Squeeze: from n/a through <= 1.6.
- Product
- Squeeze
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025m1.DownloadList: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32164 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows Retrieve Embedded Sensitive Data.This issue affects m1.DownloadList: from n/a through <= 0.24.
- Product
- m1.DownloadList
- Affected
- up to 0.24
- What to do
- Affects up to 0.24. Update m1.DownloadList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025Accept SagePay Payments Using Contact Form 7: Sensitive Information ExposureCVE-2025-2883 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accept SagePay Payments Using Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
- Product
- Accept SagePay Payments Using Contact Form 7
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Accept SagePay Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2025GreenPay(tm) by Green.Money: Sensitive Information ExposureCVE-2025-2882 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GreenPay(tm) by Green.Money plugin for WordPress is vulnerable to Sensitive Information Exposure in versions between 3.0.0 and 3.0.9 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed file.
- Product
- GreenPay(tm) by Green.Money
- What to do
- Update GreenPay(tm) by Green.Money to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2025Melhor Envio: Sensitive Information ExposureCVE-2024-13820 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information, plugin tokens, shipping configurations, and limited vendor information.
- Product
- Melhor Envio
- Affected
- up to 2.15.11
- What to do
- Affects up to 2.15.11. Update Melhor Envio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Apr 4, 2025KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base: Sensitive Information ExposureCVE-2024-13604 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
- Product
- KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 4, 2025Post to Social Media – WordPress to Hootsuite: Cross-Site Request Forgery (CSRF)CVE-2025-32267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpzinc Post to Social Media – WordPress to Hootsuite wp-to-hootsuite allows Cross Site Request Forgery.This issue affects Post to Social Media – WordPress to Hootsuite: from n/a through <= 1.5.8.
- Product
- Post to Social Media – WordPress to Hootsuite
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Post to Social Media – WordPress to Hootsuite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 20251 Click WordPress Migration: Exposure of Sensitive System Information Due to Uncleared Debug InformationCVE-2025-32257 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migration: from n/a through <= 2.5.7.
- Product
- 1 Click WordPress Migration
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update 1 Click WordPress Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025StaffList: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList stafflist allows Retrieve Embedded Sensitive Data.This issue affects StaffList: from n/a through <= 3.2.7.
- Product
- StaffList
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update StaffList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Jetpack Feedback Exporter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32251 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in J. Tyler Wiest Jetpack Feedback Exporter jetpack-feedback-exporter allows Retrieve Embedded Sensitive Data.This issue affects Jetpack Feedback Exporter: from n/a through <= 1.23.
- Product
- Jetpack Feedback Exporter
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update Jetpack Feedback Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Just Post Preview Widget: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32156 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget just-post-preview allows PHP Local File Inclusion.This issue affects Just Post Preview Widget: from n/a through <= 1.1.1.
- Product
- Just Post Preview Widget
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Just Post Preview Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Posts Footer Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32130 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intelly-posts-footer-manager allows Stored XSS.This issue affects Posts Footer Manager: from n/a through <= 2.2.0.
- Product
- Posts Footer Manager
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Posts Footer Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Maps: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-2279 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Maps
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025tagDiv Composer: PHP Object InstantiationCVE-2024-13645 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- tagDiv Composer
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtagdiv.comwordfence.com
Apr 3, 2025Latest Custom Post Type Updates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Wood Latest Custom Post Type Updates latest-custom-post-type-updates allows Reflected XSS.This issue affects Latest Custom Post Type Updates: from n/a through <= 1.3.0.
- Product
- Latest Custom Post Type Updates
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Latest Custom Post Type Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025User Submitted Posts – Enable Users to Submit Posts from the Front End: Stored Cross-Site ScriptingCVE-2025-2874 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 20240319 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- User Submitted Posts – Enable Users to Submit Posts from the Front End
- Affected
- up to 20240319
- What to do
- Affects up to 20240319. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025Delete Post Revision: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31454 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Delete Post Revision delete-post-revision allows Reflected XSS.This issue affects Delete Post Revision: from n/a through <= 1.1.
- Product
- Delete Post Revision
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Delete Post Revision to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Gosign – Posts Slider Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31891 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gosign Gosign – Posts Slider Block gosign-posts-slider-block allows Stored XSS.This issue affects Gosign – Posts Slider Block: from n/a through <= 1.1.0.
- Product
- Gosign – Posts Slider Block
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Gosign – Posts Slider Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025FancyPost: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31875 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluginic FancyPost post-block allows DOM-Based XSS.This issue affects FancyPost: from n/a through <= 6.0.1.
- Product
- FancyPost
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update FancyPost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Clone any post type: Missing AuthorizationCVE-2025-31872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Clone any post type: from n/a through <= 3.6.
- Product
- WP Clone any post type
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update WP Clone any post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Clone any post type: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-31871 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Phishing.This issue affects WP Clone any post type: from n/a through <= 3.6.
- Product
- WP Clone any post type
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update WP Clone any post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Export All Post Meta: Missing AuthorizationCVE-2025-31856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in brainvireinfo Export All Post Meta export-all-post-meta allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export All Post Meta: from n/a through <= 1.2.1.
- Product
- Export All Post Meta
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Export All Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Proposals: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31837 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3.
- Product
- WP Proposals
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update WP Proposals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025ACF City Selector: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31832 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beee ACF City Selector acf-city-selector allows Retrieve Embedded Sensitive Data.This issue affects ACF City Selector: from n/a through <= 1.17.0.
- Product
- ACF City Selector
- Affected
- up to 1.17.0
- What to do
- Affects up to 1.17.0. Update ACF City Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Posten: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31790 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binsaifullah Posten posten-post-blocks allows DOM-Based XSS.This issue affects Posten: from n/a through <= 0.0.1.
- Product
- Posten
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update Posten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Post Custom Templates Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31767 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through <= 1.14.
- Product
- Post Custom Templates Lite
- Affected
- up to 1.14
- What to do
- Affects up to 1.14. Update Post Custom Templates Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Simple Post Expiration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31734 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Simple Post Expiration simple-post-expiration allows DOM-Based XSS.This issue affects Simple Post Expiration: from n/a through <= 1.0.1.
- Product
- Simple Post Expiration
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Simple Post Expiration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Our Team Members: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-30802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPBean Our Team Members our-team-members.This issue affects Our Team Members: from n/a through <= 2.2.
- Product
- Our Team Members
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Our Team Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025PostMash: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30622 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in torsteino PostMash postmash-custom allows SQL Injection.This issue affects PostMash: from n/a through <= 1.0.3.
- Product
- PostMash
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update PostMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Advanced Post Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through <= 1.1.0.
- Product
- Advanced Post Search
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Advanced Post Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025OK Poster Group: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svmidi OK Poster Group ok-poster-group allows Reflected XSS.This issue affects OK Poster Group: from n/a through <= 1.1.
- Product
- OK Poster Group
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update OK Poster Group to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-22277 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.
- Product
- Vitepos
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Awesome Support – WordPress HelpDesk & Support: Sensitive Information ExposureCVE-2024-13567 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 31, 2025PostmarkApp Email Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-31617 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
- Product
- PostmarkApp Email Integrator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Auto Post After Image Upload: Missing AuthorizationCVE-2025-31611 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Post After Image Upload: from n/a through <= 1.6.
- Product
- Auto Post After Image Upload
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Auto Post After Image Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025PostmarkApp Email Integrator: Missing AuthorizationCVE-2025-31576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
- Product
- PostmarkApp Email Integrator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.