Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,776 results · page 261 of 816
Nov 6, 2025Leblix: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58995 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Leblix leblix allows PHP Local File Inclusion.This issue affects Leblix: from n/a through <= 2.4.
- Product
- Leblix
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Leblix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Greenify: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58994 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Greenify greenify allows PHP Local File Inclusion.This issue affects Greenify: from n/a through <= 2.2.
- Product
- Greenify
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Greenify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Jock On Air Now (JOAN): Missing AuthorizationCVE-2025-58986 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jock On Air Now (JOAN): from n/a through <= 6.0.4.
- Product
- Jock On Air Now (JOAN)
- Affected
- up to 6.0.4
- What to do
- Affects up to 6.0.4. Update Jock On Air Now (JOAN) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Barcode Scanner with Inventory & Order Manager: Path Traversal: '.../...//'CVE-2025-58972 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Path Traversal: '.../...//' vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.10.4.
- Product
- Barcode Scanner with Inventory & Order Manager
- Affected
- up to 1.10.4
- What to do
- Affects up to 1.10.4. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Enzy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58964 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Enzy enzy allows Reflected XSS.This issue affects Enzy: from n/a through < 1.6.4.
- Product
- Enzy
- What to do
- Update Enzy to the newest version.
Nov 6, 2025Institutions Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Institutions Directory institutions-directory allows Reflected XSS.This issue affects Institutions Directory: from n/a through <= 1.3.3.
- Product
- Institutions Directory
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WP Gravity Forms Keap/Infusionsoft: Deserialization of Untrusted DataCVE-2025-58636 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
- Product
- WP Gravity Forms Keap/Infusionsoft
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WP Gravity Forms Keap/Infusionsoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Miraculous: Missing AuthorizationCVE-2025-58629 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous: from n/a through < 2.0.9.
- Product
- Miraculous
- What to do
- Update Miraculous to the newest version.
Nov 6, 2025Miraculous Core: Authorization Bypass Through User-Controlled KeyCVE-2025-58627 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
- Product
- Miraculous Core
- What to do
- Update Miraculous Core to the newest version.
Nov 6, 2025Falang multilanguage: Deserialization of Untrusted DataCVE-2025-58619 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through <= 1.3.65.
- Product
- Falang multilanguage
- Affected
- up to 1.3.65
- What to do
- Affects up to 1.3.65. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025All In One Login: Authentication Bypass by SpoofingCVE-2025-58595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in Saad Iqbal All In One Login change-wp-admin-login allows Identity Spoofing.This issue affects All In One Login: from n/a through <= 2.0.8.
- Product
- All In One Login
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update All In One Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TranslatePress: Deserialization of Untrusted DataCVE-2025-58592 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.
- Product
- TranslatePress
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025imEvent: Missing AuthorizationCVE-2025-58243 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects imEvent: from n/a through <= 3.4.0.
- Product
- imEvent
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update imEvent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2025-58207 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.5.
- Product
- Ai Image Alt Text Generator for WP
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Jobmonster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54737 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8.
- Product
- Jobmonster
- Affected
- up to 4.7.8
- What to do
- Affects up to 4.7.8. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WooTour: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54722 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WooTour woo-tour allows Reflected XSS.This issue affects WooTour: from n/a through <= 3.6.3.
- Product
- WooTour
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update WooTour to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Resca: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54721 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Resca resca allows Reflected XSS.This issue affects Resca: from n/a through <= 3.0.2.
- Product
- Resca
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Resca to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Yogi - Health Beauty & Yoga: Deserialization of Untrusted DataCVE-2025-54719 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.
- Product
- Yogi - Health Beauty & Yoga
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Yogi - Health Beauty & Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Yogi - Health Beauty & Yoga: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Reflected XSS.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.
- Product
- Yogi - Health Beauty & Yoga
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Yogi - Health Beauty & Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Info Cards: Missing AuthorizationCVE-2025-54711 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info Cards: from n/a through <= 1.0.11.
- Product
- Info Cards
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Info Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WeMusic: Deserialization of Untrusted DataCVE-2025-53586 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1.
- Product
- WeMusic
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update WeMusic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WeMusic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53585 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme WeMusic noo-wemusic allows Reflected XSS.This issue affects WeMusic: from n/a through <= 1.9.1.
- Product
- WeMusic
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update WeMusic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Doliconnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53574 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ptibogxiv Doliconnect doliconnect allows Reflected XSS.This issue affects Doliconnect: from n/a through <= 9.3.2.
- Product
- Doliconnect
- Affected
- up to 9.3.2
- What to do
- Affects up to 9.3.2. Update Doliconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Epic Review: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53573 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme Epic Review epic-review allows Reflected XSS.This issue affects Epic Review: from n/a through <= 1.0.2.
- Product
- Epic Review
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Epic Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Kalium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53349 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laborator Kalium kalium allows Reflected XSS.This issue affects Kalium: from n/a through <= 3.18.3.
- Product
- Kalium
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update Kalium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Gutenify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeYatri Gutenify gutenify allows Stored XSS.This issue affects Gutenify: from n/a through <= 1.5.7.
- Product
- Gutenify
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Gutenify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WP GDPR Cookie Consent: Cross-Site Request Forgery (CSRF)CVE-2025-53316 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel WP GDPR Cookie Consent wp-gdpr-cookie-consent allows Stored XSS.This issue affects WP GDPR Cookie Consent: from n/a through <= 1.0.0.
- Product
- WP GDPR Cookie Consent
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP GDPR Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Dropify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53286 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhainey Milevis Dropify wc-dropi-integration allows Reflected XSS.This issue affects Dropify: from n/a through <= 4.7.2.
- Product
- Dropify
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update Dropify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Drop Uploader for CF7 - Drag&Drop File Uploader Addon: Unrestricted Upload of File with Dangerous TypeCVE-2025-53283 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through <= 2.4.1.
- Product
- Drop Uploader for CF7 - Drag&Drop File Uploader Addon
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Drop Uploader for CF7 - Drag&Drop File Uploader Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Zegen: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53252 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Zegen zegen allows PHP Local File Inclusion.This issue affects Zegen: from n/a through <= 1.1.9.
- Product
- Zegen
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Zegen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Backup and Move: Missing AuthorizationCVE-2025-53246 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup and Move: from n/a through <= 0.1.
- Product
- Backup and Move
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Backup and Move to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WP Logo Changer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53245 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Afzal Multani WP Logo Changer am-login-logo allows Stored XSS.This issue affects WP Logo Changer: from n/a through <= 1.2.
- Product
- WP Logo Changer
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP Logo Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Seil: Deserialization of Untrusted DataCVE-2025-53242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
- Product
- Seil
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Seil to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025User Registration Aide: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53239 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bnovotny User Registration Aide user-registration-aide allows Reflected XSS.This issue affects User Registration Aide: from n/a through <= 1.5.3.8.
- Product
- User Registration Aide
- Affected
- up to 1.5.3.8
- What to do
- Affects up to 1.5.3.8. Update User Registration Aide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Sertifier Certificate & Badge Maker: Missing AuthorizationCVE-2025-53214 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in sertifier Sertifier Certificate & Badge Maker sertifier-certificates-open-badges allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sertifier Certificate & Badge Maker: from n/a through <= 1.21.
- Product
- Sertifier Certificate & Badge Maker
- Affected
- up to 1.21
- What to do
- Affects up to 1.21. Update Sertifier Certificate & Badge Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025HieCOR Payment Gateway: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway allows SQL Injection.This issue affects HieCOR Payment Gateway Plugin: from n/a through <= 1.5.11.
- Product
- HieCOR Payment Gateway
- Affected
- up to 1.5.11
- What to do
- Affects up to 1.5.11. Update HieCOR Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025flexoslider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52764 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marielav flexoslider flexoslider allows Reflected XSS.This issue affects flexoslider: from n/a through <= 1.0004.
- Product
- flexoslider
- Affected
- up to 1.0004
- What to do
- Affects up to 1.0004. Update flexoslider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Penci Bookmark & Follow: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49909 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Bookmark & Follow penci-bookmark-follow allows Reflected XSS.This issue affects Penci Bookmark & Follow: from n/a through < 2.4.
- Product
- Penci Bookmark & Follow
- What to do
- Update Penci Bookmark & Follow to the newest version.
Nov 6, 2025Range Slider Addon for Gravity Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49905 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Range Slider Addon for Gravity Forms range-slider-addon-for-gravity-forms allows Reflected XSS.This issue affects Range Slider Addon for Gravity Forms: from n/a through <= 1.1.6.
- Product
- Range Slider Addon for Gravity Forms
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Range Slider Addon for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Booking and Rental Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49904 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Reflected XSS.This issue affects Booking and Rental Manager: from n/a through <= 2.5.3.
- Product
- Booking and Rental Manager
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Advanced scrollbar: Incorrect Privilege AssignmentCVE-2025-49900 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in bPlugins Advanced scrollbar advanced-scrollbar allows Privilege Escalation.This issue affects Advanced scrollbar: from n/a through <= 1.1.8.
- Product
- Advanced scrollbar
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Advanced scrollbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Easy Appointments: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-49398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Easy Appointments Easy Appointments easy-appointments allows Code Injection.This issue affects Easy Appointments: from n/a through <= 3.12.14.
- Product
- Easy Appointments
- Affected
- up to 3.12.14
- What to do
- Affects up to 3.12.14. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Image Gallery block – Create and display photo gallery/photo album.: Missing AuthorizationCVE-2025-49394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through <= 1.0.7.
- Product
- Image Gallery block – Create and display photo gallery/photo album.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Image Gallery block – Create and display photo gallery/photo album. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Sign-up Sheets: Deserialization of Untrusted DataCVE-2025-49393 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
- Product
- Sign-up Sheets
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Sign-up Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Cookie Notice & Consent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49390 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christophrado Cookie Notice & Consent cookie-notice-consent allows Stored XSS.This issue affects Cookie Notice & Consent: from n/a through <= 1.6.4.
- Product
- Cookie Notice & Consent
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Cookie Notice & Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Preserve Code Formatting: Deserialization of Untrusted DataCVE-2025-49386 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through <= 4.0.1.
- Product
- Preserve Code Formatting
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Preserve Code Formatting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025HAPPY: Improper Control of Generation of Code ('Code Injection')CVE-2025-49372 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Remote Code Inclusion.This issue affects HAPPY: from n/a through <= 1.0.7.
- Product
- HAPPY
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Real Time Validation for Gravity Forms: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48330 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows PHP Local File Inclusion.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.
- Product
- Real Time Validation for Gravity Forms
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Real Time Validation for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Kinsley: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48290 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Kinsley kinsley allows PHP Local File Inclusion.This issue affects Kinsley: from n/a through <= 3.4.4.
- Product
- Kinsley
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Kinsley to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Blanka - One Page: Path Traversal: '.../...//'CVE-2025-48090 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5.
- Product
- Blanka - One Page
- What to do
- Update Blanka - One Page to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.