Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,221 results · page 26 of 85
May 7, 2025Contact Form Widget: Cross-Site Request Forgery (CSRF)CVE-2025-47491 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.4.6.
- Product
- Contact Form Widget
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Display Remote Posts Block: Server-Side Request Forgery (SSRF)CVE-2025-47484 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through <= 1.1.0.
- Product
- Display Remote Posts Block
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Display Remote Posts Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Easy Replace Image: Server-Side Request Forgery (SSRF)CVE-2025-47483 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Iulia Cazan Easy Replace Image easy-replace-image allows Server Side Request Forgery.This issue affects Easy Replace Image: from n/a through <= 3.5.0.
- Product
- Easy Replace Image
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update Easy Replace Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025PW WooCommerce Bulk Edit: Cross-Site Request Forgery (CSRF)CVE-2025-47473 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pimwick PW WooCommerce Bulk Edit pw-bulk-edit allows Cross Site Request Forgery.This issue affects PW WooCommerce Bulk Edit: from n/a through <= 2.134.
- Product
- PW WooCommerce Bulk Edit
- Affected
- up to 2.134
- What to do
- Affects up to 2.134. Update PW WooCommerce Bulk Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025GPT3 AI Content Writer: Cross-Site Request Forgery (CSRF)CVE-2025-47470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in senols GPT3 AI Content Writer gpt3-ai-content-generator allows Cross Site Request Forgery.This issue affects GPT3 AI Content Writer: from n/a through <= 1.9.14.
- Product
- GPT3 AI Content Writer
- Affected
- up to 1.9.14
- What to do
- Affects up to 1.9.14. Update GPT3 AI Content Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Hash Form: Cross-Site Request Forgery (CSRF)CVE-2025-47468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in hashthemes Hash Form hash-form allows Cross Site Request Forgery.This issue affects Hash Form: from n/a through <= 1.2.8.
- Product
- Hash Form
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Hash Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Ultimate WP Mail: Cross-Site Request Forgery (CSRF)CVE-2025-47466 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Cross Site Request Forgery.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.
- Product
- Ultimate WP Mail
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Solace Extra: Server-Side Request Forgery (SSRF)CVE-2025-47464 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.1.
- Product
- Solace Extra
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Solace Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Challan: Cross-Site Request Forgery (CSRF)CVE-2025-47462 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in WebAppick Challan webappick-pdf-invoice-for-woocommerce allows Privilege Escalation.This issue affects Challan: from n/a through <= 3.7.58.
- Product
- Challan
- Affected
- up to 3.7.58
- What to do
- Affects up to 3.7.58. Update Challan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025FundEngine: Cross-Site Request Forgery (CSRF)CVE-2025-47459 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Roxnor FundEngine wp-fundraising-donation allows Cross Site Request Forgery.This issue affects FundEngine: from n/a through <= 1.7.3.
- Product
- FundEngine
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update FundEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Product Quantity Dropdown For Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2025-47451 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Product Quantity Dropdown For Woocommerce product-quantity-dropdown-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Quantity Dropdown For Woocommerce: from n/a through <= 1.2.
- Product
- Product Quantity Dropdown For Woocommerce
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Product Quantity Dropdown For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025WP Hotel Booking: Cross-Site Request Forgery (CSRF)CVE-2025-47448 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Booking: from n/a through <= 2.1.9.
- Product
- WP Hotel Booking
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Cool Author Box: Cross-Site Request Forgery (CSRF)CVE-2025-47447 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Cross Site Request Forgery.This issue affects Cool Author Box: from n/a through <= 3.0.0.
- Product
- Cool Author Box
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Cool Author Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Listamester: Cross-Site Request Forgery (CSRF)CVE-2025-47446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in listamester Listamester listamester allows Cross Site Request Forgery.This issue affects Listamester: from n/a through <= 2.3.6.
- Product
- Listamester
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Listamester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025AHAthat: Cross-Site Request ForgeryCVE-2025-4337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the aha_plugin_page() function. This makes it possible for unauthenticated attackers to delete AHA pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2025Abundatrade: Cross-Site Request ForgeryCVE-2025-4199 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02. This is due to missing or incorrect nonce validation on the 'abundatrade' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Abundatrade
- Affected
- up to 1.8.02
- What to do
- Affects up to 1.8.02. Update Abundatrade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 2, 2025Alink Tap: Cross-Site Request ForgeryCVE-2025-4198 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Alink Tap
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Alink Tap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 2, 2025Advanced Reorder Image Text Slider: Cross-Site Request ForgeryCVE-2025-4188 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'reorder-simple-image-text-slider-setting' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Advanced Reorder Image Text Slider
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Advanced Reorder Image Text Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 1, 2025Gravity Forms WebHooks: Server-Side Request ForgeryCVE-2024-13845 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Gravity Forms WebHooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.0 via the 'process_feed' method of the GF_Webhooks class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Gravity Forms WebHooks
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Gravity Forms WebHooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgravityforms.comwordfence.com
May 1, 2025NewsBlogger: Cross-Site Request ForgeryCVE-2025-1305 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- NewsBlogger
- Affected
- up to 0.2.5.4
- What to do
- Affects up to 0.2.5.4. Update NewsBlogger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Apr 25, 20251 Decembrie 1918: Cross-Site Request ForgeryCVE-2025-3870 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- 1 Decembrie 1918
- Affected
- up to 1.dec.2012
- What to do
- Affects up to 1.dec.2012. Update 1 Decembrie 1918 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 25, 2025Ajax Comment Form CST: Cross-Site Request ForgeryCVE-2025-3867 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation via the 'acform_cst_settings' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ajax Comment Form CST
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Ajax Comment Form CST to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Apr 25, 2025Add Google +1 (Plus one) social share Button: Cross-Site Request ForgeryCVE-2025-3866 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the google-plus-one-share-button page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Add Google +1 (Plus one) social share Button
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Add Google +1 (Plus one) social share Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 25, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor): Server-Side Request ForgeryCVE-2025-3775 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services.
- Product
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor)
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 24, 2025WP AVCL Automation Helper (formerly WPFlyLeads): Server-Side Request Forgery (SSRF)CVE-2025-46531 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery.This issue affects WP AVCL Automation Helper (formerly WPFlyLeads): from n/a through <= 3.4.
- Product
- WP AVCL Automation Helper (formerly WPFlyLeads)
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update WP AVCL Automation Helper (formerly WPFlyLeads) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Hacklog Remote Attachment: Cross-Site Request Forgery (CSRF)CVE-2025-46530 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Attachment hacklog-remote-attachment allows Stored XSS.This issue affects Hacklog Remote Attachment: from n/a through <= 1.3.2.
- Product
- Hacklog Remote Attachment
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Hacklog Remote Attachment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Availability Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-46528 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Steve Availability Calendar availability allows Stored XSS.This issue affects Availability Calendar: from n/a through <= 0.2.4.
- Product
- Availability Calendar
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update Availability Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WP Filter Post Category: Cross-Site Request Forgery (CSRF)CVE-2025-46524 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in stesvis WP Filter Post Category wp-filter-post-categories allows Stored XSS.This issue affects WP Filter Post Category: from n/a through <= 2.1.4.
- Product
- WP Filter Post Category
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update WP Filter Post Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Tabs: Cross-Site Request Forgery (CSRF)CVE-2025-46522 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Billy Bryant Tabs gt-tabs allows Stored XSS.This issue affects Tabs: from n/a through <= 4.0.3.
- Product
- Tabs
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Related Posts via Taxonomies: Cross-Site Request Forgery (CSRF)CVE-2025-46520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alphasis Related Posts via Taxonomies related-posts-via-taxonomies allows Stored XSS.This issue affects Related Posts via Taxonomies: from n/a through <= 1.0.1.
- Product
- Related Posts via Taxonomies
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Related Posts via Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Twitter Card Generator: Cross-Site Request Forgery (CSRF)CVE-2025-46516 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in silencecm Twitter Card Generator twitter-card-generator allows Stored XSS.This issue affects Twitter Card Generator: from n/a through <= 1.0.5.
- Product
- Twitter Card Generator
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Twitter Card Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Milat jQuery Automatic Popup: Cross-Site Request Forgery (CSRF)CVE-2025-46514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in milat Milat jQuery Automatic Popup milat-jquery-automatic-popup allows Stored XSS.This issue affects Milat jQuery Automatic Popup: from n/a through <= 1.3.1.
- Product
- Milat jQuery Automatic Popup
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Milat jQuery Automatic Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025All in One Time Clock Lite: Cross-Site Request Forgery (CSRF)CVE-2025-46513 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite aio-time-clock-lite allows Cross Site Request Forgery.This issue affects All in One Time Clock Lite: from n/a through < 1.3.326.
- Product
- All in One Time Clock Lite
- What to do
- Update All in One Time Clock Lite to the newest version.
Apr 24, 2025Custom Functions: Cross-Site Request Forgery (CSRF)CVE-2025-46512 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shamim Hasan Custom Functions Plugin custom-functions allows Stored XSS.This issue affects Custom Functions Plugin: from n/a through <= 1.1.
- Product
- Custom Functions
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Custom Functions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025BeerXML Shortcode: Server-Side Request Forgery (SSRF)CVE-2025-46511 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode beerxml-shortcode allows Server Side Request Forgery.This issue affects BeerXML Shortcode: from n/a through <= 0.7.1.
- Product
- BeerXML Shortcode
- Affected
- up to 0.7.1
- What to do
- Affects up to 0.7.1. Update BeerXML Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Contact Form 7 Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-46510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in harrysudana Contact Form 7 Calendar cf7-calendar allows Stored XSS.This issue affects Contact Form 7 Calendar: from n/a through <= 3.0.1.
- Product
- Contact Form 7 Calendar
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Contact Form 7 Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Advanced lazy load: Cross-Site Request Forgery (CSRF)CVE-2025-46508 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao Advanced lazy load advanced-lazy-load allows Stored XSS.This issue affects Advanced lazy load: from n/a through <= 1.6.0.
- Product
- Advanced lazy load
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Advanced lazy load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Unsafe Mimetypes: Cross-Site Request Forgery (CSRF)CVE-2025-46507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ldrumm Unsafe Mimetypes unsafe-mimetypes allows Stored XSS.This issue affects Unsafe Mimetypes: from n/a through <= 0.1.4.
- Product
- Unsafe Mimetypes
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update Unsafe Mimetypes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WpZon – Amazon Affiliate: Cross-Site Request Forgery (CSRF)CVE-2025-46506 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliate Plugin: from n/a through <= 1.3.
- Product
- WpZon – Amazon Affiliate
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update WpZon – Amazon Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Vasaio QR Code: Cross-Site Request Forgery (CSRF)CVE-2025-46504 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Olar Marius Vasaio QR Code vasaio-qr-code allows Stored XSS.This issue affects Vasaio QR Code: from n/a through <= 1.2.5.
- Product
- Vasaio QR Code
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Vasaio QR Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Simple Google Photos Grid: Server-Side Request Forgery (SSRF)CVE-2025-46503 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue affects Simple Google Photos Grid: from n/a through <= 1.5.
- Product
- Simple Google Photos Grid
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Simple Google Photos Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Zalo Official Live Chat: Cross-Site Request Forgery (CSRF)CVE-2025-46498 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in nghialuu Zalo Official Live Chat zalo-official-live-chat allows Cross Site Request Forgery.This issue affects Zalo Official Live Chat: from n/a through <= 1.0.0.
- Product
- Zalo Official Live Chat
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Zalo Official Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Navegg Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-46497 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Navegg Navegg Analytics navegg allows Stored XSS.This issue affects Navegg Analytics: from n/a through <= 3.3.3.
- Product
- Navegg Analytics
- Affected
- up to 3.3.3
- What to do
- Affects up to 3.3.3. Update Navegg Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Drop Caps: Cross-Site Request Forgery (CSRF)CVE-2025-46495 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through <= 2.1.
- Product
- Drop Caps
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Drop Caps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Call Now PHT Blog: Cross-Site Request Forgery (CSRF)CVE-2025-46492 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pham Thanh Call Now PHT Blog call-now-coccoc-pht-blog allows Stored XSS.This issue affects Call Now PHT Blog: from n/a through <= 2.4.1.
- Product
- Call Now PHT Blog
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Call Now PHT Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Modern Polls: Cross-Site Request Forgery (CSRF)CVE-2025-46466 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in felixtz Modern Polls modern-polls allows Stored XSS.This issue affects Modern Polls: from n/a through <= 1.0.10.
- Product
- Modern Polls
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Modern Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Print Science Designer: Cross-Site Request Forgery (CSRF)CVE-2025-46465 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in John Weissberg Print Science Designer print-science-designer allows Stored XSS.This issue affects Print Science Designer: from n/a through <= 1.3.155.
- Product
- Print Science Designer
- Affected
- up to 1.3.155
- What to do
- Affects up to 1.3.155. Update Print Science Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WPVN: Cross-Site Request Forgery (CSRF)CVE-2025-46462 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Trân Minh-Quân WPVN wpvn-username-changer allows Cross Site Request Forgery.This issue affects WPVN: from n/a through <= 0.7.8.
- Product
- WPVN
- Affected
- up to 0.7.8
- What to do
- Affects up to 0.7.8. Update WPVN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Wp Custom CMS Block: Cross-Site Request Forgery (CSRF)CVE-2025-46457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ahsanullah Akanda Wp Custom CMS Block wp-custom-cms-block allows Stored XSS.This issue affects Wp Custom CMS Block: from n/a through <= 2.1.
- Product
- Wp Custom CMS Block
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Wp Custom CMS Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Google News: Cross-Site Request Forgery (CSRF)CVE-2025-46452 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1.
- Product
- Google News
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Google News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.