Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

5,856 results · page 23 of 118

May 21, 2025DIGITS: WordPress Mobile Number Signup and Login: Does not rate limit OTP validation attemptsCVE-2025-4094 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
Product
DIGITS: WordPress Mobile Number Signup and Login
Fixed in
8.4.6.1
What to do
Update DIGITS: WordPress Mobile Number Signup and Login to 8.4.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2025WordPress Events Calendar Registration & Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39372 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Reflected XSS.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
Product
WordPress Events Calendar Registration & Tickets
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Events Calendar Registration & Tickets: Deserialization of Untrusted DataCVE-2025-47581 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.
Product
WordPress Events Calendar Registration & Tickets
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update WordPress Events Calendar Registration & Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WordPress Video Robot - The Ultimate Video Importer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.
Product
WordPress Video Robot - The Ultimate Video Importer
Affected
up to 1.20.0
What to do
Affects up to 1.20.0. Update WordPress Video Robot - The Ultimate Video Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Memberpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39407 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caseproof, LLC Memberpress allows Reflected XSS.This issue affects Memberpress: from n/a before 1.12.0.
Product
Memberpress
Fixed in
1.12.0
What to do
Update Memberpress to 1.12.0 or newer.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPBot Pro Wordpress Chatbot: Deserialization of Untrusted DataCVE-2025-47582 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chatbot: from n/a through 12.7.0.
Product
WPBot Pro Wordpress Chatbot
Affected
up to 12.7.0
What to do
Affects up to 12.7.0. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 17, 2025WPBot Pro Wordpress Chatbot: Arbitrary file deletionCVE-2025-3812 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the qcld_openai_delete_training_file() function in all versions up to, and including, 13.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WPBot Pro Wordpress Chatbot
Affected
up to 13.6.2
What to do
Affects up to 13.6.2. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpbot.pro
May 16, 2025Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce: Have a flawed CSRF checkCVE-2022-4363 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack
Product
Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce
Fixed in
2.2.2
What to do
Update Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2025Wordpress Auto Spinner: Missing AuthorizationCVE-2025-47534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through <= 3.25.0.
Product
Wordpress Auto Spinner
Affected
up to 3.25.0
What to do
Affects up to 3.25.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025WHMpress: Path TraversalCVE-2025-39492 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.
Product
WHMpress
What to do
Update WHMpress to the newest version.
Full record and what to do →NVD record patchstack.com
May 16, 2025WHMpress: Path TraversalCVE-2025-39491 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.
Product
WHMpress
What to do
Update WHMpress to the newest version.
Full record and what to do →NVD record patchstack.com
May 16, 2025Pixel WordPress Form BuilderPlugin & Autoresponder: Cross-Site Request Forgery (CSRF)CVE-2025-31915 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request Forgery.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1.0.3.
Product
Pixel WordPress Form BuilderPlugin & Autoresponder
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Pixel WordPress Form BuilderPlugin & Autoresponder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Contact Form builder with drag & drop for WordPress: Does not sanitise and escape some of its settingsCVE-2025-3201 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
Product
Contact Form builder with drag & drop for WordPress
Fixed in
2.4.3
What to do
Update Contact Form builder with drag & drop for WordPress to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025AI ChatBot for WordPress: Does not sanitise and escape some of its settingsCVE-2025-0329 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
AI ChatBot for WordPress
Fixed in
6.2.4
What to do
Update AI ChatBot for WordPress to 6.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9879 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Melapress File Monitor
Fixed in
2.1.1
What to do
Update Melapress File Monitor to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directoryCVE-2024-9765 · WordPress plugins & themes · reported by WPScanMedium 6.5
The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its settingsCVE-2024-9227 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.9.18
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.9.18 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2024-8620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
MapPress Maps for
Fixed in
2.93
What to do
Update MapPress Maps for to 2.93 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025GamiPress: Does not have CSRF check in placeCVE-2024-8245 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
GamiPress
Fixed in
1.0.1
What to do
Update GamiPress to 1.0.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students pageCVE-2024-8009 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page
Product
Sensei LMS
Fixed in
4.20.0
What to do
Update Sensei LMS to 4.20.0 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of thCVE-2024-7761 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
Product
process of testing the Simple Job Board
Fixed in
2.12.2
What to do
Update process of testing the Simple Job Board to 2.12.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025ImageMagick Engine ImageMagick Engine: For WordPress is vulnerable to OS Command Injection via the "cli_path" parameterCVE-2024-6486 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.
Product
ImageMagick Engine ImageMagick Engine
Fixed in
1.7.11
What to do
Update ImageMagick Engine ImageMagick Engine to 1.7.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025CTT Expresso para WooCommerce: Does not sanitise and escape some of its settingsCVE-2024-6478 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
CTT Expresso para WooCommerce
Fixed in
3.2.13
What to do
Update CTT Expresso para WooCommerce to 3.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Push Notification for Post and BuddyPress: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6159 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Push Notification for Post and BuddyPress
Fixed in
1.9.4
What to do
Update Push Notification for Post and BuddyPress to 1.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13128 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
LearnPress
Fixed in
4.2.7.5.1
What to do
Update LearnPress to 4.2.7.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13127 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
LearnPress
Fixed in
4.2.7.5.1
What to do
Update LearnPress to 4.2.7.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private postsCVE-2024-12767 · WordPress plugins & themes · reported by WPScanLow 3.5
The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts
Product
buddyboss-platform
Fixed in
2.7.60
What to do
Update buddyboss-platform to 2.7.60 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12734 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025WordPress连接微博: Does not have CSRF check in some placesCVE-2024-12282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
WordPress连接微博
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update WordPress连接微博 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Countdown Timer for WordPress Block Editor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-10631 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Countdown Timer for WordPress Block Editor
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Countdown Timer for WordPress Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Giveaways and Contests by RafflePress: Does not sanitise and escape some of its settingsCVE-2024-10107 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Giveaways and Contests by RafflePress
Fixed in
1.12.17
What to do
Update Giveaways and Contests by RafflePress to 1.12.17 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Jetpack WordPress plugin before 13.8, Jetpack Boost: Use regexes in the Site Accelerator featuresCVE-2024-10076 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks
Product
Jetpack WordPress plugin before 13.8, Jetpack Boost
Fixed in
13.8
What to do
Update Jetpack WordPress plugin before 13.8, Jetpack Boost to 13.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10009 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
Melapress File Monitor
Fixed in
2.1.0
What to do
Update Melapress File Monitor to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to maniCVE-2024-0970 · WordPress plugins & themes · reported by WPScanMedium 5.3
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
Fixed in
4.1.4
What to do
Update the plugin to 4.1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector: Does not have CSRF checkCVE-2023-2334 · WordPress plugins & themes · reported by WPScanMedium 5.4
The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
Product
edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector
Fixed in
1.4
What to do
Update edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector to 1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Remote Code ExecutionCVE-2025-3053 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.07
What to do
Affects up to 3.5.07. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 12, 2025LightPress Lightbox: Does not check download links point to validCVE-2025-3649 · WordPress plugins & themes · reported by WPScanMedium 6.8
The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks.
Product
LightPress Lightbox
Fixed in
2.3.4
What to do
Update LightPress Lightbox to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com
May 10, 2025WordPress Review Plugin: The Ultimate Solution for Building a Review Website: Local File InclusionCVE-2025-2158 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Review Plugin: The Ultimate Solution for Building a Review Website plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.3.5 via the Post custom fields. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP file types can be uploaded and included, or pearcmd is enabled on a server with register_argc_argv also enabled.
Product
WordPress Review Plugin: The Ultimate Solution for Building a Review Website
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update WordPress Review Plugin: The Ultimate Solution for Building a Review Website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 9, 2025WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Stored Cross-Site ScriptingCVE-2025-3794 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 9, 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Arbitrary file deletionCVE-2025-4206 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'process_export_delete' and 'process_import_delete' functions in all versions up to, and including, 4.1.1.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
Affected
up to 4.1.1.2
What to do
Affects up to 4.1.1.2. Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 9, 20251 Click WordPress Migration Plugin – 100% FREE for a limited time: Unauthorized modification of dataCVE-2025-3455 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'start_restore' function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
1 Click WordPress Migration Plugin – 100% FREE for a limited time
Affected
up to 2.2
What to do
Affects up to 2.2. Update 1 Click WordPress Migration Plugin – 100% FREE for a limited time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 8, 2025Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insCVE-2025-3862 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 26.0.6
What to do
Affects up to 26.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 8, 2025The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions CVE-2025-2806 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 5.3
What to do
Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record localhost tagdiv.com
May 7, 2025WebinarPress: Server-Side Request Forgery (SSRF)CVE-2025-47635 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects WebinarPress: from n/a through <= 1.33.28.
Product
WebinarPress
Affected
up to 1.33.28
What to do
Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Wbcom Designs - Activity Link Preview For BuddyPress: Server-Side Request Forgery (SSRF)CVE-2025-47548 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress activity-link-preview-for-buddypress allows Server Side Request Forgery.This issue affects Wbcom Designs - Activity Link Preview For BuddyPress: from n/a through <= 1.4.4.
Product
Wbcom Designs - Activity Link Preview For BuddyPress
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Wbcom Designs - Activity Link Preview For BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WP Compress: Cross-Site Request Forgery (CSRF)CVE-2025-47546 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Cross Site Request Forgery.This issue affects WP Compress: from n/a through <= 6.30.30.
Product
WP Compress
Affected
up to 6.30.30
What to do
Affects up to 6.30.30. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025GamiPress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47508 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ruben Garcia GamiPress gamipress allows PHP Local File Inclusion.This issue affects GamiPress: from n/a through <= 7.3.7.
Product
GamiPress
Affected
up to 7.3.7
What to do
Affects up to 7.3.7. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025PublishPress Authors: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47496 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress PublishPress Authors publishpress-authors allows PHP Local File Inclusion.This issue affects PublishPress Authors: from n/a through <= 4.7.5.
Product
PublishPress Authors
Affected
up to 4.7.5
What to do
Affects up to 4.7.5. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 6, 2025CarDealerPress: Stored Cross-Site ScriptingCVE-2025-3860 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CarDealerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘saleclass' parameter in all versions up to, and including, 6.8.2505.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CarDealerPress
Affected
up to 6.8.2505.00
What to do
Affects up to 6.8.2505.00. Update CarDealerPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.