Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,491 results · page 25 of 50
Jun 25, 2025Amazon Products to WooCommerce: Unauthorized modification of dataCVE-2025-5813 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_amazon_product_callback() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to create new produces.
- Product
- Amazon Products to WooCommerce
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Amazon Products to WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 25, 2025VG WORT METIS: Unauthorized modification of dataCVE-2025-5812 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenberg_save_post() function in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited post settings.
- Product
- VG WORT METIS
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update VG WORT METIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2025Custom Post Carousels with Owl: Uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using itCVE-2025-5125 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.
- Product
- Custom Post Carousels with Owl
- Fixed in
- 1.4.12
- What to do
- Update Custom Post Carousels with Owl to 1.4.12 or newer.
Jun 19, 2025AI Engine: Unauthorized modification of data and loss of dataCVE-2025-5071 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.
- Product
- AI Engine
- Affected
- 2.8.0 to 2.8.3
- What to do
- Affects 2.8.0 to 2.8.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized view and modification of dataCVE-2025-4571 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2025eCommerce Product Catalog: Deserialization of Untrusted DataCVE-2025-49331 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through <= 3.4.3.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Integration for Contact Form 7 and Zoho CRM, Bigin: Deserialization of Untrusted DataCVE-2025-49330 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through <= 1.3.0.
- Product
- Integration for Contact Form 7 and Zoho CRM, Bigin
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Integration for Contact Form 7 and Zoho CRM, Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Spare: Deserialization of Untrusted DataCVE-2025-31919 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7.
- Product
- Spare
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Spare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Rapyd Payment Extension for WooCommerce: Deserialization of Untrusted DataCVE-2025-30618 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rapyd Payment Extension for WooCommerce: from n/a through <= 1.2.0.
- Product
- Rapyd Payment Extension for WooCommerce
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Rapyd Payment Extension for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Unauthorized modification of dataCVE-2025-3880 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected.
- Product
- Poll, Survey & Quiz Maker Plugin by Opinion Stage
- Affected
- up to 19.9.0
- What to do
- Affects up to 19.9.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2025Traffic Monitor: Unauthorized modification of dataCVE-2025-5815 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.
- Product
- Traffic Monitor
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Traffic Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2025WP Travel Engine – Tour Booking Plugin – Tour Operator Software: Unauthorized loss of dataCVE-2025-5282 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to delete arbitrary posts.
- Product
- WP Travel Engine – Tour Booking Plugin – Tour Operator Software
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 10, 2025CozyStay: Deserialization of Untrusted DataCVE-2025-49507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through < 1.7.1.
- Product
- CozyStay
- What to do
- Update CozyStay to the newest version.
Jun 9, 2025MultiVendorX: Insertion of Sensitive Information Into Sent DataCVE-2025-48261 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through <= 4.2.22.
- Product
- MultiVendorX
- Affected
- up to 4.2.22
- What to do
- Affects up to 4.2.22. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025PressGrid - Frontend Publish Reaction & Multimedia: Deserialization of Untrusted DataCVE-2025-31429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.
- Product
- PressGrid - Frontend Publish Reaction & Multimedia
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update PressGrid - Frontend Publish Reaction & Multimedia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025PIMP - Creative MultiPurpose: Deserialization of Untrusted DataCVE-2025-31398 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton PIMP - Creative MultiPurpose allows Object Injection. This issue affects PIMP - Creative MultiPurpose: from n/a through 1.7.
- Product
- PIMP - Creative MultiPurpose
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PIMP - Creative MultiPurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025FLAP - Business: Deserialization of Untrusted DataCVE-2025-31396 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton FLAP - Business WordPress Theme allows Object Injection. This issue affects FLAP - Business WordPress Theme: from n/a through 1.5.
- Product
- FLAP - Business
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update FLAP - Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025The Fashion - Model Agency One Page Beauty: Deserialization of Untrusted DataCVE-2025-31052 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affects The Fashion - Model Agency One Page Beauty Theme: from n/a through <= 1.4.4.
- Product
- The Fashion - Model Agency One Page Beauty
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update The Fashion - Model Agency One Page Beauty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2025Profiler – What Slowing Down Your WP: Unauthorized modification of dataCVE-2025-5814 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsd_plugin_control() function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate previously deactivated plugins after accessing the "Profiler" page.
- Product
- Profiler – What Slowing Down Your WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Profiler – What Slowing Down Your WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 6, 2025Crawlomatic Multisite Scraper Post Generator: Insertion of Sensitive Information Into Sent DataCVE-2025-49294 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Retrieve Embedded Sensitive Data.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
- Product
- Crawlomatic Multisite Scraper Post Generator
- Affected
- up to 2.6.8.2
- What to do
- Affects up to 2.6.8.2. Update Crawlomatic Multisite Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Sweet Dessert: Deserialization of Untrusted DataCVE-2025-49073 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Sweet Dessert sweet-dessert allows Object Injection.This issue affects Sweet Dessert: from n/a through < 1.1.13.
- Product
- Sweet Dessert
- Fixed in
- 1.1.13
- What to do
- Update Sweet Dessert to 1.1.13 or newer.
Jun 6, 2025Mr. Murphy: Deserialization of Untrusted DataCVE-2025-49072 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy mr-murphy allows Object Injection.This issue affects Mr. Murphy: from n/a through < 1.2.12.1.
- Product
- Mr. Murphy
- What to do
- Update Mr. Murphy to the newest version.
Jun 6, 2025«Подсказки» от DaData.ru: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30931 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamil Shafeev «Подсказки» от DaData.ru dadata-ru allows Stored XSS.This issue affects «Подсказки» от DaData.ru: from n/a through <= 1.0.6.
- Product
- «Подсказки» от DaData.ru
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update «Подсказки» от DaData.ru to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Simple History: Sensitive data exposureCVE-2025-5760 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.
- Product
- Simple History
- What to do
- Update Simple History to the newest version.
Jun 6, 2025Photography: Deserialization of Untrusted DataCVE-2025-47584 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2.
- Product
- Photography
- Affected
- up to 7.5.2
- What to do
- Affects up to 7.5.2. Update Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Posts Carousel: Deserialization of Untrusted DataCVE-2025-39358 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through <= 1.3.12.
- Product
- WP Posts Carousel
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update WP Posts Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Hive Support: Unauthorized access and modification of dataCVE-2025-5018 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hs_update_ai_chat_settings() and hive_lite_support_get_all_binbox() functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and overwrite the site’s OpenAI API key and inspection data or modify AI-chat prompts and behavior. This vulnerability is potentially a duplicate of CVE-2025-32208 or/and CVE-2025-32242.
- Product
- Hive Support
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025BM Content Builder: Unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' functionCVE-2025-1777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BM Content Builder
- Affected
- up to 3.16.2.1
- What to do
- Affects up to 3.16.2.1. Update BM Content Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseatheme.networdfence.com
Jun 5, 2025HyperComments: Unauthorized modification of data that can lead to privilege escalationCVE-2025-5701 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- HyperComments
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update HyperComments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 2, 2025Broken Link Checker: Unauthorized data accessCVE-2025-4047 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajax_full_status and ajax_dashboard_status functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the plugin's status.
- Product
- Broken Link Checker
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2025Ninja Tables – Easy Data Table Builder: PHP Object InjectionCVE-2025-2939 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.
- Product
- Ninja Tables – Easy Data Table Builder
- Affected
- up to 5.0.18
- What to do
- Affects up to 5.0.18. Update Ninja Tables – Easy Data Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2025WordPress Comments Import & Export: Unauthorized modification of dataCVE-2025-3919 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page. The vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4
- Product
- WordPress Comments Import & Export
- Affected
- up to 2.4.3
- Fixed in
- 2.4.3
- What to do
- Update WordPress Comments Import & Export to 2.4.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 30, 2025WooCommerce Orders & Customers Exporter: Insertion of Sensitive Information Into Sent DataCVE-2025-48331 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.0.
- Product
- WooCommerce Orders & Customers Exporter
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025Woo Slider Pro – Drag Drop Slider Builder For WooCommerce: Unauthorized modification of dataCVE-2025-4597 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Woo Slider Pro – Drag Drop Slider Builder For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woo_slide_pro_delete_draft_preview AJAX action in all versions up to, and including, 1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
- Product
- Woo Slider Pro – Drag Drop Slider Builder For WooCommerce
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Woo Slider Pro – Drag Drop Slider Builder For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2025Featured Image Plus – Quick & Bulk Edit with Unsplash: Unauthorized modification of dataCVE-2025-4431 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fip_save_attach_featured function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update featured image of any post.
- Product
- Featured Image Plus – Quick & Bulk Edit with Unsplash
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Featured Image Plus – Quick & Bulk Edit with Unsplash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 29, 2025Course Builder: Deserialization of Untrusted DataCVE-2025-48336 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a through < 3.6.6.
- Product
- Course Builder
- What to do
- Update Course Builder to the newest version.
May 26, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized modification of dataCVE-2025-4683 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
- Product
- MStore API – Create Native Android & iOS Apps On The Cloud
- Affected
- up to 4.17.5
- What to do
- Affects up to 4.17.5. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 26, 2025Spotlight - Social Media Feeds (Premium): Insertion of Sensitive Information Into Sent DataCVE-2025-39498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds (Premium): from n/a through 1.7.1.
- Product
- Spotlight - Social Media Feeds (Premium)
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Spotlight - Social Media Feeds (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Kids Planet: Deserialization of Untrusted DataCVE-2025-48289 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through <= 2.2.14.
- Product
- Kids Planet
- Affected
- up to 2.2.14
- What to do
- Affects up to 2.2.14. Update Kids Planet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Pix 4x sem juros - Pagaleve: Deserialization of Untrusted DataCVE-2025-48287 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through <= 1.6.9.
- Product
- Pix 4x sem juros - Pagaleve
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update Pix 4x sem juros - Pagaleve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Lead Form Data Collection to CRM: Missing AuthorizationCVE-2025-47690 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.
- Product
- Lead Form Data Collection to CRM
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025WC Affiliate: Deserialization of Untrusted DataCVE-2025-47660 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a through <= 2.16.
- Product
- WC Affiliate
- Affected
- up to 2.16
- What to do
- Affects up to 2.16. Update WC Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025ZoomSounds: Deserialization of Untrusted DataCVE-2025-47568 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ZoomIt ZoomSounds dzs-zoomsounds allows Object Injection.This issue affects ZoomSounds: from n/a through <= 6.91.
- Product
- ZoomSounds
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Mail Mint: Insertion of Sensitive Information Into Sent DataCVE-2025-47541 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through <= 1.17.7.
- Product
- Mail Mint
- Affected
- up to 1.17.7
- What to do
- Affects up to 1.17.7. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025CoinPayments.net Payment Gateway for WooCommerce: Deserialization of Untrusted DataCVE-2025-47532 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object Injection.This issue affects CoinPayments.net Payment Gateway for WooCommerce: from n/a through <= 1.0.17.
- Product
- CoinPayments.net Payment Gateway for WooCommerce
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update CoinPayments.net Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025WPFunnels: Deserialization of Untrusted DataCVE-2025-47530 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in WPFunnels WPFunnels wpfunnels allows Object Injection.This issue affects WPFunnels: from n/a through <= 3.5.18.
- Product
- WPFunnels
- Affected
- up to 3.5.18
- What to do
- Affects up to 3.5.18. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Goodlayers Hotel: Deserialization of Untrusted DataCVE-2025-39503 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.
- Product
- Goodlayers Hotel
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Goodlayers Hotel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Goodlayers Hostel: Deserialization of Untrusted DataCVE-2025-39500 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.
- Product
- Goodlayers Hostel
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Goodlayers Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Medicare: Deserialization of Untrusted DataCVE-2025-39499 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0.
- Product
- Medicare
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Medicare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Avantage: Deserialization of Untrusted DataCVE-2025-39495 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9.
- Product
- Avantage
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Avantage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.