Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

2,807 results · page 25 of 57

May 16, 2025Radio Player Shoutcast & Icecast: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32306 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin audio4-html5 allows Blind SQL Injection.This issue affects Radio Player Shoutcast & Icecast WordPress Plugin: from n/a through <= 4.4.6.
Product
Radio Player Shoutcast & Icecast
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update Radio Player Shoutcast & Icecast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025CountDown Pro WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32301 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown Pro WP Plugin circular_countdown allows SQL Injection.This issue affects CountDown Pro WP Plugin: from n/a through <= 2.7.
Product
CountDown Pro WP
Affected
up to 2.7
What to do
Affects up to 2.7. Update CountDown Pro WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Sticky HTML5 Music Player: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32290 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky HTML5 Music Player lbg-audio3-html5 allows SQL Injection.This issue affects Sticky HTML5 Music Player: from n/a through <= 3.1.6.
Product
Sticky HTML5 Music Player
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Sticky HTML5 Music Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Responsive HTML5 Audio Player PRO With Playlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32287 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows SQL Injection.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.7.
Product
Responsive HTML5 Audio Player PRO With Playlist
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Responsive HTML5 Audio Player PRO With Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Multimedia Responsive Carousel with Image Video Audio Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31928 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Multimedia Responsive Carousel with Image Video Audio Support multimedia-carousel allows SQL Injection.This issue affects Multimedia Responsive Carousel with Image Video Audio Support: from n/a through <= 2.6.0.
Product
Multimedia Responsive Carousel with Image Video Audio Support
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Multimedia Responsive Carousel with Image Video Audio Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Sticky Radio Player: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31926 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows SQL Injection.This issue affects Sticky Radio Player: from n/a through <= 3.4.
Product
Sticky Radio Player
Affected
up to 3.4
What to do
Affects up to 3.4. Update Sticky Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025UberSlider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31641 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup UberSlider uber-classic allows SQL Injection.This issue affects UberSlider: from n/a through < 2.6.
Product
UberSlider
What to do
Update UberSlider to the newest version.
Full record and what to do →NVD record patchstack.com
May 16, 2025Magic Responsive Slider and Carousel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31640 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic-carousel allows SQL Injection.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through < 1.6.
Product
Magic Responsive Slider and Carousel
What to do
Update Magic Responsive Slider and Carousel to the newest version.
Full record and what to do →NVD record patchstack.com
May 16, 2025SHOUT: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31637 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows SQL Injection.This issue affects SHOUT: from n/a through <= 3.5.3.
Product
SHOUT
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update SHOUT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs.CVE-2025-47275 · WordPress plugins & themes · reported by GitHubCritical 9.1
Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
May 15, 2025WP-PManager: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2248 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025WP-PManager: Does not have CSRF check in placeCVE-2025-2247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directoryCVE-2024-9765 · WordPress plugins & themes · reported by WPScanMedium 6.5
The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9711 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9709 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Download Manager: Does not sanitise and escape some of its settingsCVE-2024-8284 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Download Manager
Fixed in
3.2.99
What to do
Update Download Manager to 3.2.99 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025ImageMagick Engine ImageMagick Engine: For WordPress is vulnerable to OS Command Injection via the "cli_path" parameterCVE-2024-6486 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.
Product
ImageMagick Engine ImageMagick Engine
Fixed in
1.7.11
What to do
Update ImageMagick Engine ImageMagick Engine to 1.7.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Tracking Code Manager: Does not sanitise and escape some of its settingsCVE-2024-6335 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Tracking Code Manager
Fixed in
2.3.0
What to do
Update Tracking Code Manager to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Advanced Cron Manager: Does not sanitise and escape some of its settingsCVE-2024-4004 · WordPress plugins & themes · reported by WPScanLow 3.5
The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Advanced Cron Manager
Fixed in
2.5.7
What to do
Update Advanced Cron Manager to 2.5.7 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Custom Field Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Custom Field Manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Field Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting: Is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employeesCVE-2024-12812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees.
Product
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Fixed in
1.13.4
What to do
Update WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting to 1.13.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to maniCVE-2024-0970 · WordPress plugins & themes · reported by WPScanMedium 5.3
This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.
Fixed in
4.1.4
What to do
Update the plugin to 4.1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025File Manager Advanced Shortcode: Local File InclusionCVE-2024-13914 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanced-shortcode) and 2.5.6 (advanced-file-manager-pro-premium), via the 'file_manager_advanced' shortcode. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary JavaScript files on the server. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Sites currently using 2.5.4 (file-manager-advanced-shortcode) should be updated to 2.6.0 (advanced-file-manager-pro-premium).
Product
File Manager Advanced Shortcode
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update File Manager Advanced Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advancedfilemanager.com wordfence.com
May 12, 2025SMS Alert Order Notifications: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47682 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.1.
Product
SMS Alert Order Notifications
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 8, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Arbitrary file readCVE-2025-3419 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.26
What to do
Affects up to 4.0.26. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 7, 2025Advanced File Manager: Missing AuthorizationCVE-2025-47688 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through <= 5.3.1.
Product
Advanced File Manager
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Productive Commerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47657 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through <= 1.1.40.
Product
Productive Commerce
Affected
up to 1.1.40
What to do
Affects up to 1.1.40. Update Productive Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Sidebar Manager Light: Cross-Site Request Forgery (CSRF)CVE-2025-47647 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Sidebar Manager Light sidebar-manager-light allows Cross Site Request Forgery.This issue affects Sidebar Manager Light: from n/a through <= 1.18.
Product
Sidebar Manager Light
Affected
up to 1.18
What to do
Affects up to 1.18. Update Sidebar Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025ELEX Product Feed for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47643 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2.
Product
ELEX Product Feed for WooCommerce
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update ELEX Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025WP Podcasts Manager: Cross-Site Request Forgery (CSRF)CVE-2025-47597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Maulik Vora WP Podcasts Manager wp-podcasts-manager allows Cross Site Request Forgery.This issue affects WP Podcasts Manager: from n/a through <= 1.3.
Product
WP Podcasts Manager
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Podcasts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025YaySMTP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47587 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP yaysmtp allows Blind SQL Injection.This issue affects YaySMTP: from n/a through <= 2.6.4.
Product
YaySMTP
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update YaySMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Dynamic Pricing With Discount Rules for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47544 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Blind SQL Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.8.
Product
Dynamic Pricing With Discount Rules for WooCommerce
Affected
up to 4.5.8
What to do
Affects up to 4.5.8. Update Dynamic Pricing With Discount Rules for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Cart tracking for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47538 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-woocommerce allows SQL Injection.This issue affects Cart tracking for WooCommerce: from n/a through <= 1.0.17.
Product
Cart tracking for WooCommerce
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update Cart tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025PDF Invoice Builder for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47537 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows SQL Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 5.3.8.
Product
PDF Invoice Builder for WooCommerce
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Ultimate WP Mail: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47490 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL Injection.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.
Product
Ultimate WP Mail
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025TrackShip for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47460 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TrackShip TrackShip for WooCommerce trackship-for-woocommerce allows SQL Injection.This issue affects TrackShip for WooCommerce: from n/a through <= 1.9.1.
Product
TrackShip for WooCommerce
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update TrackShip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 6, 2025Download Manager and Payment Form WordPress Plugin – WP SmartPay: Insecure Direct Object ReferenceCVE-2025-3851 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 to 2.7.13 via the show() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's data like email address, name, and notes.
Product
Download Manager and Payment Form WordPress Plugin – WP SmartPay
Affected
1.1.0 to 2.7.13
What to do
Affects 1.1.0 to 2.7.13. Update Download Manager and Payment Form WordPress Plugin – WP SmartPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2025Advance Seat Reservation Management for WooCommerce: SQL InjectionCVE-2024-13344 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to, and including, 3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advance Seat Reservation Management for WooCommerce
Affected
up to 3.3
What to do
Affects up to 3.3. Update Advance Seat Reservation Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
May 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2024-13322 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
Affected
up to 4.88
What to do
Affects up to 4.88. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
May 1, 2025GmapsMania: Stored Cross-Site ScriptingCVE-2025-4131 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GmapsMania
Affected
up to 1.1
What to do
Affects up to 1.1. Update GmapsMania to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 1, 2025Projectopia – WordPress Project Management: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-3952 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'pto_remove_logo' function in all versions up to, and including, 5.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
Projectopia – WordPress Project Management
Affected
up to 5.1.16
What to do
Affects up to 5.1.16. Update Projectopia – WordPress Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 28, 2025WordPress Tag, Category, and Taxonomy Manager: Does not sanitise and escape some of its Widgets settingsCVE-2025-0627 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress Tag, Category, and Taxonomy Manager WordPress plugin before 3.30.0 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WordPress Tag, Category, and Taxonomy Manager
Fixed in
3.30.0
What to do
Update WordPress Tag, Category, and Taxonomy Manager to 3.30.0 or newer.
Full record and what to do →NVD record wpscan.com
Apr 25, 2025Upsell Funnel Builder for WooCommerce: Order manipulationCVE-2025-3743 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to the plugin allowing the additional product ID and discount field to be manipulated prior to processing via the 'add_offer_in_cart' function. This makes it possible for unauthenticated attackers to arbitrarily update the product associated with any order bump, and arbitrarily update the discount applied to any order bump item, when adding it to the cart.
Product
Upsell Funnel Builder for WooCommerce
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Upsell Funnel Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2025Blog Manager WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46517 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Blog Manager WP blog-manager-wp allows Stored XSS.This issue affects Blog Manager WP: from n/a through <= 1.0.5.
Product
Blog Manager WP
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Blog Manager WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Frontend Dashboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46248 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5.
Product
Frontend Dashboard
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Booking and Rental Manager: Missing AuthorizationCVE-2025-39390 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking and Rental Manager: from n/a through <= 2.3.6.
Product
Booking and Rental Manager
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Appsero Helper: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39377 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection.This issue affects Appsero Helper: from n/a through <= 1.3.4.
Product
Appsero Helper
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Appsero Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Mang Board WP: Stored Cross-Site ScriptingCVE-2025-3435 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Mang Board WP
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 23, 2025WordPress Simple Shopping Cart: Product price manipulationCVE-2025-3530 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'product_tmp_two' for computing a security hash against price tampering while using 'wspsc_product' to display the product, allowing an unauthenticated attacker to substitute details from a cheaper product and bypass payment for a more expensive item.
Product
WordPress Simple Shopping Cart
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2025Message Filter for Contact Form 7: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46252 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2.
Product
Message Filter for Contact Form 7
Affected
up to 1.6.3.2
What to do
Affects up to 1.6.3.2. Update Message Filter for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.