Vulnerability database

40,758 results · page 245 of 816

• Dec 9, 2025Advanced FAQ Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67556 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows Stored XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.

  Product

  Advanced FAQ Manager

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025UseStrict's Calendly Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67555 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in useStrict UseStrict's Calendly Embedder cal-embedder-lite allows Stored XSS.This issue affects UseStrict's Calendly Embedder: from n/a through <= 1.1.7.2.

  Product

  UseStrict's Calendly Embedder

  Affected

  up to 1.1.7.2

  What to do

  Affects up to 1.1.7.2. Update UseStrict's Calendly Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Cookie Notice & Compliance for GDPR / CCPA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67554 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Humanityco Cookie Notice & Compliance for GDPR / CCPA cookie-notice allows Stored XSS.This issue affects Cookie Notice & Compliance for GDPR / CCPA: from n/a through <= 2.5.8.

  Product

  Cookie Notice & Compliance for GDPR / CCPA

  Affected

  up to 2.5.8

  What to do

  Affects up to 2.5.8. Update Cookie Notice & Compliance for GDPR / CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Advanced FAQ Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67553 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows DOM-Based XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.

  Product

  Advanced FAQ Manager

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Walker Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67552 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WalkerWP Walker Core walker-core allows DOM-Based XSS.This issue affects Walker Core: from n/a through <= 1.3.17.

  Product

  Walker Core

  Affected

  up to 1.3.17

  What to do

  Affects up to 1.3.17. Update Walker Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Wappointment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67551 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wappointment team Wappointment wappointment allows Stored XSS.This issue affects Wappointment: from n/a through <= 2.6.9.

  Product

  Wappointment

  Affected

  up to 2.6.9

  What to do

  Affects up to 2.6.9. Update Wappointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Donation Thermometer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67550 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through <= 2.2.6.

  Product

  Donation Thermometer

  Affected

  up to 2.2.6

  What to do

  Affects up to 2.2.6. Update Donation Thermometer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025oik: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67549 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows DOM-Based XSS.This issue affects oik: from n/a through <= 4.15.3.

  Product

  oik

  Affected

  up to 4.15.3

  What to do

  Affects up to 4.15.3. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP Delicious: Missing AuthorizationCVE-2025-67548 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.1.

  Product

  WP Delicious

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025FireBox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67545 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS.This issue affects FireBox: from n/a through <= 3.1.0-free.

  Product

  FireBox

  Affected

  up to 3.1.0-free

  What to do

  Affects up to 3.1.0-free. Update FireBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Shopkeeper Extender: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67544 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Shopkeeper Extender shopkeeper-extender allows Stored XSS.This issue affects Shopkeeper Extender: from n/a through < 7.0.

  Product

  Shopkeeper Extender

  What to do

  Update Shopkeeper Extender to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Essential Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67543 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Essential Widgets essential-widgets allows Stored XSS.This issue affects Essential Widgets: from n/a through <= 2.2.2.

  Product

  Essential Widgets

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Essential Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Multi-Step Checkout for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67542 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SilkyPress Multi-Step Checkout for WooCommerce wp-multi-step-checkout allows DOM-Based XSS.This issue affects Multi-Step Checkout for WooCommerce: from n/a through <= 2.33.

  Product

  Multi-Step Checkout for WooCommerce

  Affected

  up to 2.33

  What to do

  Affects up to 2.33. Update Multi-Step Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP-ShowHide: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67541 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-ShowHide wp-showhide allows Stored XSS.This issue affects WP-ShowHide: from n/a through <= 1.05.

  Product

  WP-ShowHide

  Affected

  up to 1.05

  What to do

  Affects up to 1.05. Update WP-ShowHide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Animation Addons for Elementor: Missing AuthorizationCVE-2025-67540 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animation Addons for Elementor: from n/a through <= 2.4.5.

  Product

  Animation Addons for Elementor

  Affected

  up to 2.4.5

  What to do

  Affects up to 2.4.5. Update Animation Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Select Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67539 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Select Core select-core allows DOM-Based XSS.This issue affects Select Core: from n/a through < 2.6.

  Product

  Select Core

  What to do

  Update Select Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025JNews Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67538 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews Gallery jnews-gallery allows Stored XSS.This issue affects JNews Gallery: from n/a through < 12.0.1.

  Product

  JNews Gallery

  What to do

  Update JNews Gallery to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ThirstyAffiliates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67537 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Stored XSS.This issue affects ThirstyAffiliates: from n/a through <= 3.11.8.

  Product

  ThirstyAffiliates

  Affected

  up to 3.11.8

  What to do

  Affects up to 3.11.8. Update ThirstyAffiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025LearnPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67536 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XSS.This issue affects LearnPress: from n/a through <= 4.2.9.4.

  Product

  LearnPress

  Affected

  up to 4.2.9.4

  What to do

  Affects up to 4.2.9.4. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP Maps: Deserialization of Untrusted DataCVE-2025-67535 · WordPress plugins & themes · reported by PatchstackMedium 6.6

  Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.

  Product

  WP Maps

  Affected

  up to 4.8.6

  What to do

  Affects up to 4.8.6. Update WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Rencontre: Cross-Site Request Forgery (CSRF)CVE-2025-67534 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS.This issue affects Rencontre: from n/a through <= 3.13.7.

  Product

  Rencontre

  Affected

  up to 3.13.7

  What to do

  Affects up to 3.13.7. Update Rencontre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Themify Portfolio Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67533 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Portfolio Post themify-portfolio-post allows Stored XSS.This issue affects Themify Portfolio Post: from n/a through <= 1.3.0.

  Product

  Themify Portfolio Post

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Themify Portfolio Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Hara: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67532 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.17.

  Product

  Hara

  Affected

  up to 1.2.17

  What to do

  Affects up to 1.2.17. Update Hara to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Turitor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67531 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in trippleS Turitor turitor allows PHP Local File Inclusion.This issue affects Turitor: from n/a through < 1.5.3.

  Product

  Turitor

  What to do

  Update Turitor to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Besa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67530 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.15.

  Product

  Besa

  Affected

  up to 2.3.15

  What to do

  Affects up to 2.3.15. Update Besa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Fashion: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67529 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opal_WP Fashion fashion2 allows PHP Local File Inclusion.This issue affects Fashion: from n/a through < 5.3.0.

  Product

  Fashion

  What to do

  Update Fashion to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Urna: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67528 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna urna allows PHP Local File Inclusion.This issue affects Urna: from n/a through <= 2.5.12.

  Product

  Urna

  Affected

  up to 2.5.12

  What to do

  Affects up to 2.5.12. Update Urna to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Digiqole: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67527 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in trippleS Digiqole digiqole allows PHP Local File Inclusion.This issue affects Digiqole: from n/a through < 2.2.7.

  Product

  Digiqole

  What to do

  Update Digiqole to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Sailing: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67526 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Sailing sailing allows PHP Local File Inclusion.This issue affects Sailing: from n/a through < 4.4.6.

  Product

  Sailing

  What to do

  Update Sailing to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ekommart: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67525 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opal_WP ekommart ekommart allows PHP Local File Inclusion.This issue affects ekommart: from n/a through < 4.3.1.

  Product

  ekommart

  What to do

  Update ekommart to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Jobmonster Elementor Addon: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67524 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster Elementor Addon jobmonster-addon allows PHP Local File Inclusion.This issue affects Jobmonster Elementor Addon: from n/a through <= 1.1.4.

  Product

  Jobmonster Elementor Addon

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Jobmonster Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Exhibz: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67523 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in trippleS Exhibz exhibz allows PHP Local File Inclusion.This issue affects Exhibz: from n/a through <= 3.0.9.

  Product

  Exhibz

  Affected

  up to 3.0.9

  What to do

  Affects up to 3.0.9. Update Exhibz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Jobmonster: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67522 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster noo-jobmonster allows PHP Local File Inclusion.This issue affects Jobmonster: from n/a through <= 4.8.2.

  Product

  Jobmonster

  Affected

  up to 4.8.2

  What to do

  Affects up to 4.8.2. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Select Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67521 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Select Core select-core allows PHP Local File Inclusion.This issue affects Select Core: from n/a through < 2.6.

  Product

  Select Core

  What to do

  Update Select Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Media Library Tools: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67520 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tiny Solutions Media Library Tools media-library-tools allows SQL Injection.This issue affects Media Library Tools: from n/a through <= 1.6.15.

  Product

  Media Library Tools

  Affected

  up to 1.6.15

  What to do

  Affects up to 1.6.15. Update Media Library Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Ninja Tables: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67519 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.3.

  Product

  Ninja Tables

  Affected

  up to 5.2.3

  What to do

  Affects up to 5.2.3. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Accordion Slider PRO: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67518 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Accordion Slider PRO accordion_slider_pro allows Blind SQL Injection.This issue affects Accordion Slider PRO: from n/a through <= 1.2.

  Product

  Accordion Slider PRO

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Accordion Slider PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ArtPlacer Widget: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67517 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Blind SQL Injection.This issue affects ArtPlacer Widget: from n/a through <= 2.22.9.2.

  Product

  ArtPlacer Widget

  Affected

  up to 2.22.9.2

  What to do

  Affects up to 2.22.9.2. Update ArtPlacer Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Store Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67516 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Blind SQL Injection.This issue affects Store Locator WordPress: from n/a through <= 1.6.2.

  Product

  Store Locator

  Affected

  up to 1.6.2

  What to do

  Affects up to 1.6.2. Update Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Wilmër: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67515 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër wilmer allows PHP Local File Inclusion.This issue affects Wilmër: from n/a through < 3.5.

  Product

  Wilmër

  Fixed in

  3.5

  What to do

  Update Wilmër to 3.5 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ForumWP: Missing AuthorizationCVE-2025-67474 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Ultimate Member ForumWP forumwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ForumWP: from n/a through <= 2.1.4.

  Product

  ForumWP

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update ForumWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025CWW Companion: Cross-Site Request Forgery (CSRF)CVE-2025-67473 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in codeworkweb CWW Companion cww-companion allows Cross Site Request Forgery.This issue affects CWW Companion: from n/a through <= 1.3.2.

  Product

  CWW Companion

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update CWW Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Cross-Site Request Forgery (CSRF)CVE-2025-67472 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.

  Product

  Online Booking & Scheduling Calendar for WordPress by vcita

  Affected

  up to 4.5.5

  What to do

  Affects up to 4.5.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Quick Contact Form: Cross-Site Request Forgery (CSRF)CVE-2025-67471 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Quick Contact Form quick-contact-form allows Cross Site Request Forgery.This issue affects Quick Contact Form: from n/a through <= 8.2.5.

  Product

  Quick Contact Form

  Affected

  up to 8.2.5

  What to do

  Affects up to 8.2.5. Update Quick Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Portfolio and Projects: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67470 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.

  Product

  Portfolio and Projects

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025PDF Thumbnail Generator: Cross-Site Request Forgery (CSRF)CVE-2025-67469 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in kubiq PDF Thumbnail Generator pdf-thumbnail-generator allows Cross Site Request Forgery.This issue affects PDF Thumbnail Generator: from n/a through <= 1.4.

  Product

  PDF Thumbnail Generator

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update PDF Thumbnail Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: Missing AuthorizationCVE-2025-67468 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: from n/a through <= 1.4.6.

  Product

  Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

  Affected

  up to 1.4.6

  What to do

  Affects up to 1.4.6. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025GiveWP: Cross-Site Request Forgery (CSRF)CVE-2025-67467 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give allows Cross Site Request Forgery.This issue affects GiveWP: from n/a through <= 4.13.1.

  Product

  GiveWP

  Affected

  up to 4.13.1

  What to do

  Affects up to 4.13.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Trinity Audio: Missing AuthorizationCVE-2025-67466 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3.

  Product

  Trinity Audio

  Affected

  up to 5.23.3

  What to do

  Affects up to 5.23.3. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Simple Link Directory: Cross-Site Request Forgery (CSRF)CVE-2025-67465 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Cross Site Request Forgery.This issue affects Simple Link Directory: from n/a through <= 8.8.3.

  Product

  Simple Link Directory

  Affected

  up to 8.8.3

  What to do

  Affects up to 8.8.3. Update Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.