Updated 10 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

5,764 results · page 24 of 116

Apr 4, 2025The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturCVE-2025-2780 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
up to 5.4.21
What to do
Affects up to 5.4.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record hub.woffice.io wordfence.com
Apr 4, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Stored Cross-Site ScriptingCVE-2025-2836 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 6.0.4.3
What to do
Affects up to 6.0.4.3. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 3, 2025Search engine keywords highlighter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e1tekoap42 Search engine keywords highlighter keywords-highlight-tool allows Reflected XSS.This issue affects Search engine keywords highlighter: from n/a through <= 0.1.3.
Product
Search engine keywords highlighter
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Search engine keywords highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Blubrry PowerPress Podcasting plugin MultiSite add-on: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31436 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Angelo Mandato Blubrry PowerPress Podcasting plugin MultiSite add-on powerpress-multisite allows Reflected XSS.This issue affects Blubrry PowerPress Podcasting plugin MultiSite add-on: from n/a through <= 0.1.1.
Product
Blubrry PowerPress Podcasting plugin MultiSite add-on
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Blubrry PowerPress Podcasting plugin MultiSite add-on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Plugin Oficial – Getnet para WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30906 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lisandragetnet Plugin Oficial – Getnet para WooCommerce wc-checkout-getnet allows Reflected XSS.This issue affects Plugin Oficial – Getnet para WooCommerce: from n/a through <= 1.7.3.
Product
Plugin Oficial – Getnet para WooCommerce
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Plugin Oficial – Getnet para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025WP Plugin Info Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31835 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brice Capobianco WP Plugin Info Card wp-plugin-info-card allows DOM-Based XSS.This issue affects WP Plugin Info Card: from n/a through <= 5.3.0.
Product
WP Plugin Info Card
Affected
up to 5.3.0
What to do
Affects up to 5.3.0. Update WP Plugin Info Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Uptime Robot Plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-31776 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows Cross Site Request Forgery.This issue affects Uptime Robot Plugin for WordPress: from n/a through <= 2.3.
Product
Uptime Robot Plugin for
Affected
up to 2.3
What to do
Affects up to 2.3. Update Uptime Robot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025CLP – Custom Login Page by NiteoThemes: Cross-Site Request Forgery (CSRF)CVE-2025-31769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes clp-custom-login-page allows Cross Site Request Forgery.This issue affects CLP – Custom Login Page by NiteoThemes: from n/a through <= 1.5.5.
Product
CLP – Custom Login Page by NiteoThemes
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update CLP – Custom Login Page by NiteoThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26.CVE-2025-2237 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26. This is due to insufficient role restrictions in the 'process_register' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
Affected
up to 1.6.26
What to do
Affects up to 1.6.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Apr 1, 2025WP Travel Engine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30870 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.3.5.
Product
WP Travel Engine
Affected
up to 6.3.5
What to do
Affects up to 6.3.5. Update WP Travel Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Uptime Robot Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31562 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows DOM-Based XSS.This issue affects Uptime Robot Plugin for WordPress: from n/a through <= 2.3.
Product
Uptime Robot Plugin for
Affected
up to 2.3
What to do
Affects up to 2.3. Update Uptime Robot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Uptime Robot Plugin for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31547 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows SQL Injection.This issue affects Uptime Robot Plugin for WordPress: from n/a through <= 2.3.
Product
Uptime Robot Plugin for
Affected
up to 2.3
What to do
Affects up to 2.3. Update Uptime Robot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025PluginPass: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-54291 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows Manipulating Web Input to File System Calls.This issue affects PluginPass: from n/a through <= 0.9.10.
Product
PluginPass
Affected
up to 0.9.10
What to do
Affects up to 0.9.10. Update PluginPass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Login Alert: Cross-Site Request Forgery (CSRF)CVE-2025-31459 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in PasqualePuzio Login Alert login-alert allows Stored XSS.This issue affects Login Alert: from n/a through <= 0.2.1.
Product
Login Alert
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Login Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_usernamCVE-2025-2804 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 5.3
What to do
Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Mar 27, 2025SEO Plugin by Squirrly SEO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22783 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo allows SQL Injection.This issue affects SEO Plugin by Squirrly SEO: from n/a through <= 12.4.03.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.4.03
What to do
Affects up to 12.4.03. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025VikBooking Hotel Booking Engine & PMS: Missing AuthorizationCVE-2025-22670 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.7.2.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Login Widget for Ultimate Member: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30890 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SuitePlugins Login Widget for Ultimate Member login-widget-for-ultimate-member allows PHP Local File Inclusion.This issue affects Login Widget for Ultimate Member: from n/a through <= 1.1.2.
Product
Login Widget for Ultimate Member
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Login Widget for Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025WP Travel Engine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30871 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.3.5.
Product
WP Travel Engine
Affected
up to 6.3.5
What to do
Affects up to 6.3.5. Update WP Travel Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Custom Login Logo: Cross-Site Request Forgery (CSRF)CVE-2025-30822 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hakik Zaman Custom Login Logo ideal-wp-login-logo-changer allows Cross Site Request Forgery.This issue affects Custom Login Logo: from n/a through <= 1.1.7.
Product
Custom Login Logo
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Custom Login Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025RDP Linkedin Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23542 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP Linkedin Login rdp-linkedin-login allows Reflected XSS.This issue affects RDP Linkedin Login: from n/a through <= 1.7.0.
Product
RDP Linkedin Login
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update RDP Linkedin Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates: Sensitive Information ExposureCVE-2025-2228 · WordPress plugins & themes · reported by WordfenceMedium 5.7
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'register_user' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Edit Login | Registration Form widget, as long as that user opens the email notification for successful registration.
Product
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Remote Code ExecutionCVE-2025-2257 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.16.10
What to do
Affects up to 1.16.10. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.svn.wordpress.org
Mar 25, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Unauthorized access and modification of dataCVE-2025-2224 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
Product
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
Affected
up to 8.2
What to do
Affects up to 8.2. Update Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025IP Based Login: Does not have CSRF checks in some placesCVE-2024-13118 · WordPress plugins & themes · reported by WPScanMedium 4.3
The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack
Product
IP Based Login
Fixed in
2.4.1
What to do
Update IP Based Login to 2.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11273 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Contact Form & SMTP Plugin for WordPress by PirateForms
Fixed in
2.6.0
What to do
Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Login Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30575 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect login-redirect allows Stored XSS.This issue affects Login Redirect: from n/a through <= 1.0.5.
Product
Login Redirect
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Typekit plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-30526 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in lucksy Typekit plugin for WordPress typekit allows Cross Site Request Forgery.This issue affects Typekit plugin for WordPress: from n/a through <= 1.2.3.
Product
Typekit plugin for
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Typekit plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 22, 2025GiveWP – Donation Plugin and Fundraising Platform: Sensitive Information ExposureCVE-2025-2331 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.22.1
What to do
Affects up to 3.22.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2025The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to, aCVE-2024-13410 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to, and including 3.9.0, respectively, via deserialization of untrusted input in the 'ajax_handler' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net themeforest.net
Mar 15, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access of dataCVE-2025-2025 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 3.22.0
What to do
Affects up to 3.22.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: Stored Cross-Site ScriptingCVE-2024-13497 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.
Product
WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
Affected
up to 8.0.9
What to do
Affects up to 8.0.9. Update WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025Directory Listings WordPress plugin – uListing: Unauthorized modification of data and PHP Object InjectionCVE-2025-1657 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update post meta data and inject PHP Objects that may be unserialized. A capability check was added in 2.1.8, but the unserialize is still present.
Product
Directory Listings WordPress plugin – uListing
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Directory Listings WordPress plugin – uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 14, 2025Directory Listings WordPress plugin – uListing: Privilege EscalationCVE-2025-1653 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta that can be updated. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Product
Directory Listings WordPress plugin – uListing
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Directory Listings WordPress plugin – uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 14, 2025The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, andCVE-2025-2232 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.purethemes.net wordfence.com
Mar 14, 2025LoginPress | wp-login Custom Login Page Customizer: Cross-Site Request ForgeryCVE-2025-1764 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.
Product
LoginPress | wp-login Custom Login Page Customizer
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update LoginPress | wp-login Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025InstaWP Connect – 1-click WP Staging & Migration: Cross-Site Request ForgeryCVE-2024-13913 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.83
What to do
Affects up to 0.1.0.83. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2025WordPress Report Brute Force Attacks and Login Protection ReportAttacks: SQL InjectionCVE-2025-2250 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WordPress Report Brute Force Attacks and Login Protection ReportAttacks
Affected
up to 2.32
What to do
Affects up to 2.32. Update WordPress Report Brute Force Attacks and Login Protection ReportAttacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Mar 13, 2025Business Directory Plugin – Easy Listing Directories for: Insecure Direct Object ReferenceCVE-2024-13887 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the 'ajax_listing_submit_image_upload' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to add arbitrary images to listings.
Product
Business Directory Plugin – Easy Listing Directories for
Affected
up to 6.4.14
What to do
Affects up to 6.4.14. Update Business Directory Plugin – Easy Listing Directories for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2025Tabbed Login Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vivek Marakana Tabbed Login Widget tabbed-login allows Stored XSS.This issue affects Tabbed Login Widget: from n/a through <= 1.1.2.
Product
Tabbed Login Widget
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Tabbed Login Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025wordpress login form to anywhere: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28914 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Sharma wordpress login form to anywhere wp-show-login-form allows Stored XSS.This issue affects wordpress login form to anywhere: from n/a through <= 0.2.
Product
wordpress login form to anywhere
Affected
up to 0.2
What to do
Affects up to 0.2. Update wordpress login form to anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025List of Posts from each Category plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-28894 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through <= 2.0.
Product
List of Posts from each Category plugin for
Affected
up to 2.0
What to do
Affects up to 2.0. Update List of Posts from each Category plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Plugins Last Updated Column: Cross-Site Request Forgery (CSRF)CVE-2025-28887 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This issue affects Plugins Last Updated Column: from n/a through <= 0.1.3.
Product
Plugins Last Updated Column
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Plugins Last Updated Column to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Login Logger: Cross-Site Request Forgery (CSRF)CVE-2025-28866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from n/a through <= 1.2.1.
Product
Login Logger
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Login Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Delete Original Image: Cross-Site Request Forgery (CSRF)CVE-2025-28863 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image delete-original-image allows Cross Site Request Forgery.This issue affects Delete Original Image: from n/a through <= 0.4.
Product
Delete Original Image
Affected
up to 0.4
What to do
Affects up to 0.4. Update Delete Original Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WP Login Control: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13836 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
WP Login Control
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update WP Login Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2025Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap: Does not sanitise and escape some of its settingsCVE-2024-13615 · WordPress plugins & themes · reported by WPScanLow 3.5
The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 8, 2025miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon: Authentication bypassCVE-2024-11087 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Product
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon
Affected
up to 200.3.9
What to do
Affects up to 200.3.9. Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record miniorange.com wordfence.com
Mar 7, 2025SEO Plugin by Squirrly SEO: Blind SQL InjectionCVE-2025-1768 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.4.05
What to do
Affects up to 12.4.05. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.