Updated 26 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

34added in the last 30 days

563new WordPress flaws this week

392,577entries in the database

40,776 results · page 249 of 816

Dec 6, 2025Accessiy By CodeConfig Accessibility: Unauthorized page creationCVE-2025-13358 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to, and including, 1.0.0. This is due to the plugin not performing capability checks in the `Settings::createPage()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published pages on the site via the `ccpcaCreatePage` AJAX action.
Product
Accessiy By CodeConfig Accessibility
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Accessiy By CodeConfig Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters: Authorization bypassCVE-2025-13309 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to modify the plugin’s global accessibility settings.
Product
Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Application Passwords: Reflected Cross-Site ScriptingCVE-2025-13308 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the "No, I do not approve of this connection" button, granted they can successfully trick the victim into performing an action such as clicking on a link.
Product
Application Passwords
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Application Passwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Live Sales Notification for Woocommerce – Woomotiv: Reflected Cross-Site ScriptingCVE-2025-13137 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woomotiv_limit' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Live Sales Notification for Woocommerce – Woomotiv
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Live Sales Notification for Woocommerce – Woomotiv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 6, 2025g-FFL Cockpit: Sensitive Information ExposureCVE-2025-12721 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the server.
Product
g-FFL Cockpit
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update g-FFL Cockpit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 6, 2025g-FFL Cockpit: Unauthorized modification of dataCVE-2025-12720 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to delete arbitrary products.
Product
g-FFL Cockpit
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update g-FFL Cockpit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 6, 2025List Attachments Shortcode: Stored Cross-Site ScriptingCVE-2025-12717 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' parameter in the [list-attachments] shortcode in all versions up to, and including, 0.4.1a due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
List Attachments Shortcode
Affected
up to 0.4.1a
What to do
Affects up to 0.4.1a. Update List Attachments Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Canadian Nutrition Facts Label: Stored Cross-Site ScriptingCVE-2025-12715 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Canadian Nutrition Facts Label plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'percentage' field in the Nutrition Label custom post type in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Canadian Nutrition Facts Label
Affected
up to 3.0
What to do
Affects up to 3.0. Update Canadian Nutrition Facts Label to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2025Flex QR Code Generator: Arbitrary file uploadsCVE-2025-12673 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Flex QR Code Generator
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 6, 2025Listar – Directory Listing & Classifieds: Unauthorized modification of dataCVE-2025-12577 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/listar/v1/place/save' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update listing details.
Product
Listar – Directory Listing & Classifieds
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Listar – Directory Listing & Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 6, 2025Listar – Directory Listing & Classifieds: Unauthorized loss of dataCVE-2025-12574 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/listar/v1/place/delete' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
Product
Listar – Directory Listing & Classifieds
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Listar – Directory Listing & Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 6, 2025Search, Filters & Merchandising for WooCommerce: Unauthorized modification of dataCVE-2025-12091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin.
Product
Search, Filters & Merchandising for WooCommerce
Affected
up to 3.0.67
What to do
Affects up to 3.0.67. Update Search, Filters & Merchandising for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI: Time-based blind SQL InjectionCVE-2025-13922 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of SQL query parameterization. This makes it possible for authenticated attackers, with Contributor-level access and above who have AI metabox permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, cause performance degradation, or enable data inference through time-based techniques.
Product
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
Affected
up to 3.40.1
What to do
Affects up to 3.40.1. Update Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025weDocs: Unauthorized accessCVE-2025-12505 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global plugin settings.
Product
weDocs
Affected
up to 2.1.14
What to do
Affects up to 2.1.14. Update weDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 5, 2025Widgets for Google Reviews: Stored Cross-Site ScriptingCVE-2025-12510 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site.
Product
Widgets for Google Reviews
Affected
up to 13.2.4
What to do
Affects up to 13.2.4. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Link Whisper Free: Reflected Cross-Site ScriptingCVE-2025-11263 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Link Whisper Free
Affected
up to 0.8.8
What to do
Affects up to 0.8.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025Wp Social Login and Register Social Counter: Missing authorizationCVE-2025-13620 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
Product
Wp Social Login and Register Social Counter
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Dec 5, 2025CryptX: Stored Cross-Site ScriptingCVE-2025-13739 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CryptX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `cryptx` shortcode in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CryptX
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update CryptX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Trail Manager: Stored Cross-Site ScriptingCVE-2025-13682 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Trail Manager
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Trail Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 5, 2025Thai Lottery Widget: Stored Cross-Site ScriptingCVE-2025-13678 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `thailottery` shortcode in all versions up to, and including, 2.5. This is due to insufficient input sanitization and output escaping on the user supplied `width` and `height` shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Thai Lottery Widget
Affected
up to 2.5
What to do
Affects up to 2.5. Update Thai Lottery Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Cool Tag Cloud: Stored Cross-Site ScriptingCVE-2025-13614 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' shortcode in all versions up to, and including, 2.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cool Tag Cloud
Affected
up to 2.29
What to do
Affects up to 2.29. Update Cool Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025User Generator and Importer: Cross-Site Request ForgeryCVE-2025-12879 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the "Import Using CSV File" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
Product
User Generator and Importer
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update User Generator and Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025Projectopia – WordPress Project Management: Unauthorized modification of dataCVE-2025-12876 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAX action in all versions up to, and including, 5.1.19. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
Product
Projectopia – WordPress Project Management
Affected
up to 5.1.19
What to do
Affects up to 5.1.19. Update Projectopia – WordPress Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025My auctions allegro: Local File InclusionCVE-2025-12851 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
My auctions allegro
Affected
up to 3.6.32
What to do
Affects up to 3.6.32. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025ARK Related Posts: Cross-Site Request Forgery in version 2CVE-2025-13684 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on the ark_rp_options_page function. This makes it possible for unauthenticated attackers to modify the plugin's configuration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ARK Related Posts
What to do
Update ARK Related Posts to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors: Cross-Site Request ForgeryCVE-2025-12130 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. This makes it possible for unauthenticated attackers to delete vendor products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025Nouri.sh Newsletter: Reflected Cross-Site ScriptingCVE-2025-13515 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Nouri.sh Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.0.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Nouri.sh Newsletter
Affected
up to 1.0.1.3
What to do
Affects up to 1.0.1.3. Update Nouri.sh Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025My auctions allegro: SQL InjectionCVE-2025-12850 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
My auctions allegro
Affected
up to 3.6.32
What to do
Affects up to 3.6.32. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification: Authentication bypassCVE-2025-12374 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.
Product
Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification
Affected
up to 2.0.44
What to do
Affects up to 2.0.44. Update Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Torod – The smart shipping and delivery portal for e-shops and retailers: Cross-Site Request ForgeryCVE-2025-12373 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the save_settings function. This makes it possible for unauthenticated attackers to modify plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Torod – The smart shipping and delivery portal for e-shops and retailers
Affected
up to 1.9
What to do
Affects up to 1.9. Update Torod – The smart shipping and delivery portal for e-shops and retailers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Payaza: Unauthorized modification of dataCVE-2025-12355 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses.
Product
Payaza
Affected
up to 0.3.8
What to do
Affects up to 0.3.8. Update Payaza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 5, 2025Live CSS Preview: Unauthorized modification of dataCVE-2025-12354 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Live CSS Preview plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_frontend_save' AJAX endpoint in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's css setting.
Product
Live CSS Preview
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Live CSS Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 5, 2025Weekly Planner: Stored Cross-Site ScriptingCVE-2025-12186 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Weekly Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Weekly Planner
Affected
up to 1.0
What to do
Affects up to 1.0. Update Weekly Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 5, 2025Voidek Employee Portal: Unauthorized accessCVE-2025-12093 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Voidek Employee Portal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to perform several actions like registering an account, deleting users, and modifying details within the employee portal.
Product
Voidek Employee Portal
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Voidek Employee Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 5, 2025Easy Jump Links Menus: Stored Cross-Site ScriptingCVE-2025-13860 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Jump Links Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `h_tags` parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Jump Links Menus
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Easy Jump Links Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025WP-SOS-Donate Donation Sidebar: Reflected Cross-Site ScriptingCVE-2025-13625 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-SOS-Donate Donation Sidebar Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP-SOS-Donate Donation Sidebar
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update WP-SOS-Donate Donation Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Twitscription: Reflected Cross-Site ScriptingCVE-2025-13623 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Twitscription plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Twitscription
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Twitscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Jabbernotification: Reflected Cross-Site ScriptingCVE-2025-13622 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.99-RC2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Jabbernotification
Affected
up to 0.99-RC2
What to do
Affects up to 0.99-RC2. Update Jabbernotification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025dream gallery: Cross-Site Request ForgeryCVE-2025-13621 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'dreampluginsmain' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
dream gallery
Affected
up to 1.0
What to do
Affects up to 1.0. Update dream gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Feedback Modal for Website: Unauthorized access of dataCVE-2025-13528 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_export' function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to export all feedback data in CSV or JSON format via the 'export_data' parameter.
Product
Feedback Modal for Website
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Feedback Modal for Website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025CoSign Single Signon: Reflected Cross-Site ScriptingCVE-2025-13512 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CoSign Single Signon
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update CoSign Single Signon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Quantic Social Image Hover: Cross-Site Request ForgeryCVE-2025-13360 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Quantic Social Image Hover
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Quantic Social Image Hover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025ContentStudio: Cross-Site Request ForgeryCVE-2025-13144 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.7. This is due to missing or insufficient nonce validation on the add_cstu_settings function. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ContentStudio
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Takeads: Authorization bypassCVE-2025-12370 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Takeads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.13. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the plugin's configuration options.
Product
Takeads
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Takeads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025Sermon Manager: Stored Cross-Site ScriptingCVE-2025-12368 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sermon Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `sermon-views` shortcode in all versions up to, and including, 2.30.0. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sermon Manager
Affected
up to 2.30.0
What to do
Affects up to 2.30.0. Update Sermon Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 5, 2025PDF Catalog for WooCommerce: Stored Cross-Site ScriptingCVE-2025-12191 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The PDF Catalog for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdfcatalog' AJAX action in all versions up to, and including, 1.1.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PDF Catalog for WooCommerce
Affected
up to 1.1.18
What to do
Affects up to 1.1.18. Update PDF Catalog for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 5, 2025Image Optimizer by wps.sk: Cross-Site Request ForgeryCVE-2025-12190 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the imagopby_ajax_optimize_gallery() function. This makes it possible for unauthenticated attackers to trigger bulk optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Image Optimizer by wps.sk
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Image Optimizer by wps.sk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents: Cross-Site Request ForgeryCVE-2025-12189 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents
Affected
up to 7.11.1374
What to do
Affects up to 7.11.1374. Update Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 5, 2025ContentStudio: Arbitrary file uploadsCVE-2025-12181 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the cstu_update_post() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVE-2025-67910 is likely a duplicate of this.
Product
ContentStudio
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 5, 2025Webcake – Landing Page Builder: Unauthorized modification of dataCVE-2025-12165 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Webcake – Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'webcake_save_config' AJAX endpoint in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings.
Product
Webcake – Landing Page Builder
Affected
up to 1.1
What to do
Affects up to 1.1. Update Webcake – Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.