Vulnerability database

5,856 results · page 24 of 118

• May 6, 2025Download Manager and Payment Form WordPress Plugin – WP SmartPay: Insecure Direct Object ReferenceCVE-2025-3851 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's data like email address, name, and notes.

  Product

  Download Manager and Payment Form WordPress Plugin – WP SmartPay

  Affected

  1.1.0 to 2.7.13

  What to do

  Affects 1.1.0 to 2.7.13. Update Download Manager and Payment Form WordPress Plugin – WP SmartPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_secCVE-2024-13420 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• May 2, 2025Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOpCVE-2024-13419 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• May 2, 2025Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in varCVE-2024-13418 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• May 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2024-13322 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager

  Affected

  up to 4.88

  What to do

  Affects up to 4.88. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.networdfence.com

• May 1, 2025WordPress Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2025-3890 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  WordPress Simple Shopping Cart

  Affected

  up to 5.1.3

  What to do

  Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3889 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the 'process_payment_data' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the quantity of a product to a negative number, which subtracts the product cost from the total order cost. The attack will only work with Manual Checkout mode, as PayPal and Stripe will not process payments for a negative quantity.

  Product

  WordPress Simple Shopping Cart

  Affected

  up to 5.1.3

  What to do

  Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 1, 2025WordPress Simple Shopping Cart: Insecure Direct Object ReferenceCVE-2025-3874 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and edit product links, add or delete products, and discover coupon codes.

  Product

  WordPress Simple Shopping Cart

  Affected

  up to 5.1.3

  What to do

  Affects up to 5.1.3. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddeveloper.wordpress.orgplugins.trac.wordpress.org

• May 1, 2025Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder: Stored Cross-Site ScriptingCVE-2025-3521 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social Link icons in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• May 1, 2025Projectopia – WordPress Project Management: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-3952 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'pto_remove_logo' function in all versions up to, and including, 5.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

  Product

  Projectopia – WordPress Project Management

  Affected

  up to 5.1.16

  What to do

  Affects up to 5.1.16. Update Projectopia – WordPress Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 29, 2025SecuPress Free — WordPress Security: Unauthorized modification of dataCVE-2025-3452 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secupress_reinstall_plugins_admin_ajax_cb' function in all versions up to, and including, 2.3.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins.

  Product

  SecuPress Free — WordPress Security

  Affected

  up to 2.3.9

  What to do

  Affects up to 2.3.9. Update SecuPress Free — WordPress Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 28, 2025The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS.CVE-2015-4582 · WordPress plugins & themes · reported by MITREHigh 7.2

  The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not assigned to any Oracle product.

  Affected

  1.6.4 to 1.6.4

  What to do

  Affects 1.6.4 to 1.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemes.trac.wordpress.org

• Apr 28, 2025WordPress Tag, Category, and Taxonomy Manager: Does not sanitise and escape some of its Widgets settingsCVE-2025-0627 · WordPress plugins & themes · reported by WPScanLow 3.5

  The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  WordPress Tag, Category, and Taxonomy Manager

  Fixed in

  3.30.0

  What to do

  Update WordPress Tag, Category, and Taxonomy Manager to 3.30.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Apr 26, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1458 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites

  Affected

  up to 5.10.29

  What to do

  Affects up to 5.10.29. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 26, 2025The Create custom forms for WordPress with a smart form plugin for smart businesses: Arbitrary shortcode executionCVE-2025-2801 · WordPress plugins & themes · reported by WordfenceHigh 7.3

  The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

  Product

  The Create custom forms for WordPress with a smart form plugin for smart businesses

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update The Create custom forms for WordPress with a smart form plugin for smart businesses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 25, 2025The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation inCVE-2025-2470 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it possible for unauthenticated attackers to register an account on the site with an arbitrary role, including Administrator, when registering via a social login. The Nextend Social Login plugin must be installed and configured to exploit the vulnerability.

  Affected

  up to 5.1

  What to do

  Affects up to 5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemeforest.networdfence.com

• Apr 25, 2025Prevent Direct Access – Protect WordPress Files: Sensitive Information ExposureCVE-2025-3923 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'generate_unique_string' due to insufficient randomness of the generated file name. This makes it possible for unauthenticated attackers to extract sensitive data including files protected by the plugin if the attacker can determine the file name.

  Product

  Prevent Direct Access – Protect WordPress Files

  Affected

  up to 2.8.8

  What to do

  Affects up to 2.8.8. Update Prevent Direct Access – Protect WordPress Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org

• Apr 25, 2025Prevent Direct Access – Protect WordPress Files: Unauthorized access and modification of data|CVE-2025-3861 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured capability check on the 'pda_lite_custom_permission_check' function in versions 2.8.6 to 2.8.8.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to access and change the protection status of media.

  Product

  Prevent Direct Access – Protect WordPress Files

  Affected

  2.8.6 to 2.8.8.2

  What to do

  Affects 2.8.6 to 2.8.8.2. Update Prevent Direct Access – Protect WordPress Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 25, 2025Icegram Express: Does not sanitise and escape some of its Template settingsCVE-2025-0671 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  Icegram Express

  Fixed in

  5.7.50

  What to do

  Update Icegram Express to 5.7.50 or newer.

  Full record and what to do →NVD recordwpscan.com

• Apr 24, 2025eForm - WordPress Form Builder: Stored Cross-Site ScriptingCVE-2025-1294 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.18.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  eForm - WordPress Form Builder

  Affected

  up to 4.18.0

  What to do

  Affects up to 4.18.0. Update eForm - WordPress Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodecanyon.neteform.live

• Apr 24, 2025PayPal Express Checkout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46499 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder PayPal Express Checkout paypal-express-checkout allows Stored XSS.This issue affects PayPal Express Checkout: from n/a through <= 2.1.2.

  Product

  PayPal Express Checkout

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update PayPal Express Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025PowerPress Podcasting: Unrestricted Upload of File with Dangerous TypeCVE-2025-46264 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue affects PowerPress Podcasting: from n/a through <= 11.12.5.

  Product

  PowerPress Podcasting

  Affected

  up to 11.12.5

  What to do

  Affects up to 11.12.5. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Buddypress Force Password Change: Authenticated account takeoverCVE-2025-3793 · WordPress plugins & themes · reported by WordfenceMedium 4.2

  The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bp_force_password_ajax' function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with subscriber-level access and above and under certain prerequisites, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their accounts.

  Product

  Buddypress Force Password Change

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update Buddypress Force Password Change to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 24, 2025The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticCVE-2025-2558 · WordPress plugins & themes · reported by WPScanHigh 8.6

  The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server

  Affected

  up to 0.0.1

  What to do

  Affects up to 0.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 23, 2025WordPress Simple Shopping Cart: Product price manipulationCVE-2025-3530 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.

  Product

  WordPress Simple Shopping Cart

  Affected

  up to 5.1.2

  What to do

  Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 23, 2025WordPress Simple Shopping Cart: Sensitive Information ExposureCVE-2025-3529 · WordPress plugins & themes · reported by WordfenceHigh 8.2

  The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital product without paying for it.

  Product

  WordPress Simple Shopping Cart

  Affected

  up to 5.1.2

  What to do

  Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 22, 2025Memberpress: Sensitive Information ExposureCVE-2024-11299 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.

  Product

  Memberpress

  Affected

  up to 1.11.37

  What to do

  Affects up to 1.11.37. Update Memberpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordmemberpress.comwordfence.com

• Apr 19, 2025Wordpress Plugin Smart Product Review: Arbitrary file uploadsCVE-2021-4455 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

  Product

  Wordpress Plugin Smart Product Review

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Wordpress Plugin Smart Product Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordexploit-db.comwordfence.com

• Apr 19, 2025Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites: Stored Cross-Site ScriptingCVE-2025-1457 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Wrapper Link, Countdown and Gallery widgets in all versions up to, and including, 5.10.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites

  Affected

  up to 5.10.28

  What to do

  Affects up to 5.10.28. Update Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 18, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2025-2162 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  MapPress Maps for

  Fixed in

  2.94.10

  What to do

  Update MapPress Maps for to 2.94.10 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 17, 2025bbPress2 shortcode whitelist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39432 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonchanning bbPress2 shortcode whitelist bbpress2-shortcode-whitelist allows Stored XSS.This issue affects bbPress2 shortcode whitelist: from n/a through <= 2.2.1.

  Product

  bbPress2 shortcode whitelist

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update bbPress2 shortcode whitelist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Redirect wordpress to welcome or landing page: Cross-Site Request Forgery (CSRF)CVE-2025-39417 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Stored XSS.This issue affects Redirect wordpress to welcome or landing page: from n/a through <= 2.0.

  Product

  Redirect wordpress to welcome or landing page

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Redirect wordpress to welcome or landing page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025MemberPress Discord Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32605 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discord Addon expresstechsoftwares-memberpress-discord-add-on allows Reflected XSS.This issue affects MemberPress Discord Addon: from n/a through <= 1.1.1.

  Product

  MemberPress Discord Addon

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update MemberPress Discord Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WordPress Health and Server Condition – Integrated with Google Page Speed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32520 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem WordPress Health and Server Condition – Integrated with Google Page Speed wp-condition allows Reflected XSS.This issue affects WordPress Health and Server Condition – Integrated with Google Page Speed: from n/a through <= 4.1.1.

  Product

  WordPress Health and Server Condition – Integrated with Google Page Speed

  Affected

  up to 4.1.1

  What to do

  Affects up to 4.1.1. Update WordPress Health and Server Condition – Integrated with Google Page Speed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Event Espresso – Custom Email Template Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32507 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Event Espresso – Custom Email Template Shortcode email-shortcode allows Reflected XSS.This issue affects Event Espresso – Custom Email Template Shortcode: from n/a through <= 1.0.0.

  Product

  Event Espresso – Custom Email Template Shortcode

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Event Espresso – Custom Email Template Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Activity Reactions For Buddypress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31006 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arete-it Activity Reactions For Buddypress activity-reactions-for-buddypress allows Reflected XSS.This issue affects Activity Reactions For Buddypress: from n/a through <= 1.0.22.

  Product

  Activity Reactions For Buddypress

  Affected

  up to 1.0.22

  What to do

  Affects up to 1.0.22. Update Activity Reactions For Buddypress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WordPress Photo Gallery – Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27291 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxgallery WordPress Photo Gallery – Image Gallery photo-image-gallery allows Reflected XSS.This issue affects WordPress Photo Gallery – Image Gallery: from n/a through <= 2.0.4.

  Product

  WordPress Photo Gallery – Image Gallery

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update WordPress Photo Gallery – Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WordPress Backup & Migration: Insertion of Sensitive Information into Log FileCVE-2025-24651 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Retrieve Embedded Sensitive Data.This issue affects WordPress Backup & Migration: from n/a through <= 1.5.3.

  Product

  WordPress Backup & Migration

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Autoglot – Automatic WordPress Translation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24548 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Autoglot Autoglot – Automatic WordPress Translation autoglot allows Reflected XSS.This issue affects Autoglot – Automatic WordPress Translation: from n/a through <= 2.4.7.

  Product

  Autoglot – Automatic WordPress Translation

  Affected

  up to 2.4.7

  What to do

  Affects up to 2.4.7. Update Autoglot – Automatic WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WordPress Dashboard Tweeter: Missing AuthorizationCVE-2025-23906 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in wpseek WordPress Dashboard Tweeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Dashboard Tweeter: from n/a through 1.3.2.

  Product

  WordPress Dashboard Tweeter

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update WordPress Dashboard Tweeter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin foCVE-2025-3453 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'password_protected_cookie' function. This makes it possible for unauthenticated attackers to extract sensitive data including all protected site content if the 'Use Transient' setting is enabled.

  Affected

  up to 2.7.7

  What to do

  Affects up to 2.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 17, 2025Icegram Express formerly known as Email Subscribers: Does not sanitise and escape some of its settingsCVE-2024-11924 · WordPress plugins & themes · reported by WPScanLow 3.5

  The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  Icegram Express formerly known as Email Subscribers

  Fixed in

  5.7.52

  What to do

  Update Icegram Express formerly known as Email Subscribers to 5.7.52 or newer.

  Full record and what to do →NVD recordwpscan.com

• Apr 16, 2025MelaPress Login Security: Deserialization of Untrusted DataCVE-2025-39565 · WordPress plugins & themes · reported by PatchstackMedium 6.6

  Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaPress Login Security: from n/a through <= 2.1.0.

  Product

  MelaPress Login Security

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update MelaPress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025WordPress REST API Authentication: Missing AuthorizationCVE-2025-39545 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress REST API Authentication: from n/a through <= 3.6.3.

  Product

  WordPress REST API Authentication

  Affected

  up to 3.6.3

  What to do

  Affects up to 3.6.3. Update WordPress REST API Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025WP STAGING Pro WordPress Backup: Information ExposureCVE-2025-3104 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins.

  Product

  WP STAGING Pro WordPress Backup

  Affected

  up to 6.1.2

  What to do

  Affects up to 6.1.2. Update WP STAGING Pro WordPress Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwp-staging.comwordfence.com

• Apr 14, 2025PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its settingsCVE-2024-9230 · WordPress plugins & themes · reported by WPScanMedium 5.9

  The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks

  Product

  PowerPress Podcasting plugin by Blubrry

  Fixed in

  11.9.18

  What to do

  Update PowerPress Podcasting plugin by Blubrry to 11.9.18 or newer.

  Full record and what to do →NVD recordwpscan.com

• Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13338 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13337 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcr_clearfy' page. This makes it possible for unauthenticated attackers to update the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.devplugins.trac.wordpress.org

• Apr 12, 2025WordPress Mega Menu – QuadMenu: Cross-Site Request ForgeryCVE-2025-2871 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The WordPress Mega Menu – QuadMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the ajax_dismiss_notice() function. This makes it possible for unauthenticated attackers to update any user meta to a value of one, including wp_capabilities which could result in a privilege deescalation of an administrator, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  WordPress Mega Menu – QuadMenu

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update WordPress Mega Menu – QuadMenu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 11, 2025RestroPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32553 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Reflected XSS.This issue affects RestroPress: from n/a through <= 3.2.8.4.

  Product

  RestroPress

  Affected

  up to 3.2.8.4

  What to do

  Affects up to 3.2.8.4. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.