Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

40,758 results · page 240 of 816

Dec 16, 2025Read More & Accordion: Missing AuthorizationCVE-2025-64247 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through <= 3.5.5.1.
Product
Read More & Accordion
Affected
up to 3.5.5.1
What to do
Affects up to 3.5.5.1. Update Read More & Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Accessibility by AudioEye: Missing AuthorizationCVE-2025-64246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through <= 1.0.49.
Product
Accessibility by AudioEye
Affected
up to 1.0.49
What to do
Affects up to 1.0.49. Update Accessibility by AudioEye to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Import external attachments: Missing AuthorizationCVE-2025-64245 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through <= 1.5.12.
Product
Import external attachments
Affected
up to 1.5.12
What to do
Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Restrict Elementor Widgets, Columns and Sections: Missing AuthorizationCVE-2025-64244 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Elementor Widgets, Columns and Sections: from n/a through <= 1.12.
Product
Restrict Elementor Widgets, Columns and Sections
Affected
up to 1.12
What to do
Affects up to 1.12. Update Restrict Elementor Widgets, Columns and Sections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Directory Pro: Missing AuthorizationCVE-2025-64243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.
Product
Directory Pro
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Easy Property Listings: Missing AuthorizationCVE-2025-64242 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.22.
Product
Easy Property Listings
Affected
up to 3.5.22
What to do
Affects up to 3.5.22. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025WP Coupons and Deals: Missing AuthorizationCVE-2025-64241 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Coupons and Deals: from n/a through <= 3.2.4.
Product
WP Coupons and Deals
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update WP Coupons and Deals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Freshchat: Cross-Site Request Forgery (CSRF)CVE-2025-64240 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a through <= 2.3.4.
Product
Freshchat
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Freshchat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025RTL Tester: Cross-Site Request Forgery (CSRF)CVE-2025-64239 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yoav Farhi RTL Tester rtl-tester allows Cross Site Request Forgery.This issue affects RTL Tester: from n/a through <= 1.2.
Product
RTL Tester
Affected
up to 1.2
What to do
Affects up to 1.2. Update RTL Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025WPS Bidouille: Missing AuthorizationCVE-2025-64238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through <= 1.33.1.
Product
WPS Bidouille
Affected
up to 1.33.1
What to do
Affects up to 1.33.1. Update WPS Bidouille to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Quick Interest Slider: Cross-Site Request Forgery (CSRF)CVE-2025-64237 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Graham Quick Interest Slider quick-interest-slider allows Cross Site Request Forgery.This issue affects Quick Interest Slider: from n/a through <= 3.1.5.
Product
Quick Interest Slider
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Listify: Cross-Site Request Forgery (CSRF)CVE-2025-59009 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Listify listify allows Cross Site Request Forgery.This issue affects Listify: from n/a through <= 3.2.5.
Product
Listify
Affected
up to 3.2.5
What to do
Affects up to 3.2.5. Update Listify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Salient Core: Missing AuthorizationCVE-2025-59001 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8.
Product
Salient Core
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Salient Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025WP Attractive Donations System - Easy Stripe & Paypal donations: Cross-Site Request Forgery (CSRF)CVE-2025-58999 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Cross Site Request Forgery.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.
Product
WP Attractive Donations System - Easy Stripe & Paypal donations
Affected
up to 1.25
What to do
Affects up to 1.25. Update WP Attractive Donations System - Easy Stripe & Paypal donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025CM On Demand Search And Replace: Missing AuthorizationCVE-2025-54045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.5.
Product
CM On Demand Search And Replace
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025SKT Page Builder: Missing AuthorizationCVE-2025-54005 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SKT Page Builder: from n/a through <= 4.9.
Product
SKT Page Builder
Affected
up to 4.9
What to do
Affects up to 4.9. Update SKT Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025WCFM – Frontend Manager for WooCommerce: Missing AuthorizationCVE-2025-54004 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through <= 6.7.24.
Product
WCFM – Frontend Manager for WooCommerce
Affected
up to 6.7.24
What to do
Affects up to 6.7.24. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Traveler Option Tree: Insertion of Sensitive Information Into Sent DataCVE-2025-49300 · WordPress plugins & themes · reported by PatchstackLow 2.7
Insertion of Sensitive Information Into Sent Data vulnerability in Shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through 2.8.
Product
Traveler Option Tree
Affected
up to 2.8
What to do
Affects up to 2.8. Update Traveler Option Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Fancy Product Designer: Server-Side Request ForgeryCVE-2025-13231 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This makes it possible for unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.fancyproductdesigner.com wordfence.com
Dec 16, 2025Fancy Product Designer: Information Disclosure and PHAR DeserializationCVE-2025-13439 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.fancyproductdesigner.com wordfence.com
Dec 16, 2025JetFormBuilder — Dynamic Blocks Form Builder: Unauthorized modification of dataCVE-2025-11991 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.
Product
JetFormBuilder — Dynamic Blocks Form Builder
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2025Auto Featured Image (Auto Post Thumbnail): Unauthorized modification of dataCVE-2025-13794 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.
Product
Auto Featured Image (Auto Post Thumbnail)
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Auto Featured Image (Auto Post Thumbnail) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Dec 16, 2025Dokan Pro: Unauthorized access of dataCVE-2025-12809 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve their email addresses via the REST API by providing a user ID, along with other information such as usernames, display names, user roles, and registration dates.
Product
Dokan Pro
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update Dokan Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dokan.co wordfence.com
Dec 16, 2025LearnPress – WordPress LMS: Unauthorized access of dataCVE-2025-13956 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts
Product
LearnPress – WordPress LMS
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2025-14387 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress – WordPress LMS
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Dec 15, 2025Booking Calendar: Time-based blind SQL InjectionCVE-2025-14383 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Booking Calendar
Affected
up to 10.14.8
What to do
Affects up to 10.14.8. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025Fox LMS – WordPress LMS: Privilege escalationCVE-2025-14156 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.
Product
Fox LMS – WordPress LMS
Affected
up to 1.0.5.1
What to do
Affects up to 1.0.5.1. Update Fox LMS – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025Image Gallery – Photo Grid & Video Gallery: Unauthorized modification of dataCVE-2025-14003 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with Author-level access and above, to add images to arbitrary Modula galleries owned by other users.
Product
Image Gallery – Photo Grid & Video Gallery
Affected
up to 2.13.3
What to do
Affects up to 2.13.3. Update Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025OneSignal – Web Push Notifications: Unauthorized modification of dataCVE-2025-13950 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying user capabilities or nonces. This makes it possible for unauthenticated attackers to overwrite the OneSignal App ID, REST API key, and notification behavior via direct POST requests.
Product
OneSignal – Web Push Notifications
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update OneSignal – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Dec 15, 2025FluentAuth – The Ultimate Authorization & Security Plugin for: Stored Cross-Site ScriptingCVE-2025-13728 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FluentAuth – The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FluentAuth – The Ultimate Authorization & Security Plugin for
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update FluentAuth – The Ultimate Authorization & Security Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Stored Cross-Site ScriptingCVE-2025-13610 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitization and output escaping on the 'theme' attribute. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 6.0.6.7
What to do
Affects up to 6.0.6.7. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025CC Child Pages: Stored Cross-Site ScriptingCVE-2025-13608 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'child_pages' shortcode in all versions up to, and including, 2.0.0. This is due to insufficient input sanitization and output escaping on four user-supplied attributes (use_custom_link, use_custom_link_target, use_custom_thumbs, and use_custom_excerpt) in the 'show_child_pages' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CC Child Pages
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update CC Child Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress isCVE-2025-13367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 15, 2025FileBird – WordPress Media Library Folders & File Manager: Missing authorizationCVE-2025-12900 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author level access and above, to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025URL Shortify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13355 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
URL Shortify
Fixed in
1.11.4
What to do
Update URL Shortify to 1.11.4 or newer.
Full record and what to do →NVD record wpscan.com
Dec 15, 2025URL Shortify: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2025-12684 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.
Product
URL Shortify
Fixed in
1.11.3
What to do
Update URL Shortify to 1.11.3 or newer.
Full record and what to do →NVD record wpscan.com
Dec 15, 2025Royal Addons for Elementor: Does not have proper authorisationCVE-2025-11363 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.
Product
Royal Addons for Elementor
Fixed in
1.7.1037
What to do
Update Royal Addons for Elementor to 1.7.1037 or newer.
Full record and what to do →NVD record wpscan.com
Dec 14, 2025Lightweight Accordion: Stored Cross-Site ScriptingCVE-2025-13740 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `lightweight-accordion` shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lightweight Accordion
Affected
up to 1.5.20
What to do
Affects up to 1.5.20. Update Lightweight Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2025HelloLeads CRM Form Shortcode: Does not have authorisation and CSRF checkCVE-2025-12696 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them
Product
HelloLeads CRM Form Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update HelloLeads CRM Form Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 14, 2025Addon Elements for Elementor: Stored Cross-Site ScriptingCVE-2025-12537 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to insufficient input sanitization and output escaping on multiple widget parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via multiple widget parameters in pages that will execute whenever a user accesses an injected page.
Product
Addon Elements for Elementor
Affected
up to 1.14.3
What to do
Affects up to 1.14.3. Update Addon Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2025wpForo Forum: Generic SQL InjectionCVE-2025-13126 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the `post_args` and `topic_args` parameters in all versions up to, and including, 2.4.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
wpForo Forum
Affected
up to 2.4.12
What to do
Affects up to 2.4.12. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025a3 Lazy Load: Stored Cross-Site ScriptingCVE-2025-9873 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
a3 Lazy Load
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update a3 Lazy Load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025Popup Builder – Create highly converting, mobile friendly marketing popups.: Stored Cross-Site ScriptingCVE-2025-9856 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sg_popup' shortcode in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Popup Builder – Create highly converting, mobile friendly marketing popups.
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Popup Builder – Create highly converting, mobile friendly marketing popups. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025Redux Framework: Stored Cross-Site ScriptingCVE-2025-9488 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 4.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Redux Framework
Affected
up to 4.5.8
What to do
Affects up to 4.5.8. Update Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025rtMedia for WordPress, BuddyPress and bbPress: To Information DisclosureCVE-2025-9218 · WordPress plugins & themes · reported by WordfenceLow 3.7
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_rest_pre_dispatch() function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to retrieve media items associated with draft or private posts.
Product
rtMedia for WordPress, BuddyPress and bbPress
Affected
4.7.0 to 4.7.3
What to do
Affects 4.7.0 to 4.7.3. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 13, 2025TI WooCommerce Wishlist: HTML InjectionCVE-2025-9207 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.10.0. This is due to the plugin accepting hidden fields and not limiting the values or data that can input and is later output. This makes it possible for unauthenticated attackers to inject arbitrary HTML into wishlist items.
Product
TI WooCommerce Wishlist
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025WPS Visitor Counter: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2025-9116 · WordPress plugins & themes · reported by WPScanMedium 5.8
The WPS Visitor Counter WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
Product
WPS Visitor Counter
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update WPS Visitor Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 13, 2025Livemesh SiteOrigin Widgets: Stored Cross-Site ScriptingCVE-2025-8780 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Hero Header and Pricing Table widgets in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Livemesh SiteOrigin Widgets
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update Livemesh SiteOrigin Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025All-in-One Addons for Elementor – WidgetKit: Stored Cross-Site ScriptingCVE-2025-8779 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All-in-One Addons for Elementor – WidgetKit
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update All-in-One Addons for Elementor – WidgetKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 13, 2025Enter Addons: Stored Cross-Site ScriptingCVE-2025-8687 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enter Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown and Image Comparison widgets in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Enter Addons
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Enter Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.