Vulnerability database

4,221 results · page 27 of 85

• Apr 24, 2025occupancyplan: Cross-Site Request Forgery (CSRF)CVE-2025-46450 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows Stored XSS.This issue affects occupancyplan: from n/a through <= 1.0.3.0.

  Product

  occupancyplan

  Affected

  up to 1.0.3.0

  What to do

  Affects up to 1.0.3.0. Update occupancyplan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Animate: Server-Side Request Forgery (SSRF)CVE-2025-46443 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through <= 0.5.

  Product

  Animate

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Animate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Loan Calculator: Cross-Site Request Forgery (CSRF)CVE-2025-46442 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Casey Johnson Loan Calculator repayment-calculator allows Stored XSS.This issue affects Loan Calculator: from n/a through <= 1.3.

  Product

  Loan Calculator

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Loan Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Plugin Central: Cross-Site Request Forgery (CSRF)CVE-2025-46439 · WordPress plugins & themes · reported by PatchstackHigh 7.4

  Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Plugin Central plugin-central allows Path Traversal.This issue affects Plugin Central: from n/a through <= 2.5.1.

  Product

  Plugin Central

  Affected

  up to 2.5.1

  What to do

  Affects up to 2.5.1. Update Plugin Central to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025SCSS-Library: Cross-Site Request Forgery (CSRF)CVE-2025-46436 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Sebastian Echeverry SCSS-Library scss-library allows Cross Site Request Forgery.This issue affects SCSS-Library: from n/a through <= 0.4.1.

  Product

  SCSS-Library

  Affected

  up to 0.4.1

  What to do

  Affects up to 0.4.1. Update SCSS-Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025Time Based Greeting: Cross-Site Request Forgery (CSRF)CVE-2025-46435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Yash Binani Time Based Greeting time-based-greeting allows Stored XSS.This issue affects Time Based Greeting: from n/a through <= 2.2.2.

  Product

  Time Based Greeting

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Time Based Greeting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 24, 2025KiotViet Sync: Cross-Site Request Forgery (CSRF)CVE-2025-39381 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Kiotviet KiotViet Sync allows Stored XSS. This issue affects KiotViet Sync: from n/a through 1.8.4.

  Product

  KiotViet Sync

  Affected

  up to 1.8.4

  What to do

  Affects up to 1.8.4. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025VikRestaurants: Cross-Site Request Forgery (CSRF)CVE-2025-46251 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Cross Site Request Forgery.This issue affects VikRestaurants: from n/a through <= 1.3.3.

  Product

  VikRestaurants

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Simple calendar for Elementor: Cross-Site Request Forgery (CSRF)CVE-2025-46249 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through <= 1.6.4.

  Product

  Simple calendar for Elementor

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update Simple calendar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025CM Answers: Cross-Site Request Forgery (CSRF)CVE-2025-46246 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Cross Site Request Forgery.This issue affects CM Answers: from n/a through <= 3.3.3.

  Product

  CM Answers

  Affected

  up to 3.3.3

  What to do

  Affects up to 3.3.3. Update CM Answers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025CM Ad Changer: Cross-Site Request Forgery (CSRF)CVE-2025-46245 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer cm-ad-changer allows Cross Site Request Forgery.This issue affects CM Ad Changer: from n/a through <= 2.0.5.

  Product

  CM Ad Changer

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update CM Ad Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Recover abandoned cart for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-46243 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows Cross Site Request Forgery.This issue affects Recover abandoned cart for WooCommerce: from n/a through <= 2.2.

  Product

  Recover abandoned cart for WooCommerce

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Recover abandoned cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025Appointment Booking Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-46241 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

  Product

  Appointment Booking Calendar

  Affected

  up to 1.3.92

  What to do

  Affects up to 1.3.92. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 22, 2025affiliate-toolkit: Cross-Site Request Forgery (CSRF)CVE-2025-46231 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This issue affects affiliate-toolkit: from n/a through <= 3.7.3.

  Product

  affiliate-toolkit

  Affected

  up to 3.7.3

  What to do

  Affects up to 3.7.3. Update affiliate-toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 19, 2025Insert Headers And Footers: Cross-Site Request ForgeryCVE-2025-2111 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.

  Product

  Insert Headers And Footers

  Affected

  up to 3.1.1

  What to do

  Affects up to 3.1.1. Update Insert Headers And Footers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 18, 2025User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Cross-Site Request ForgeryCVE-2025-3284 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the user_registration_pro_delete_account() function. This makes it possible for unauthenticated attackers to force delete users, including administrators, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  User Registration & Membership – Custom Registration Form, Login Form, and User Profile

  Affected

  up to 5.1.3

  What to do

  Affects up to 5.1.3. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpuserregistration.comwordfence.com

• Apr 17, 2025IP2Location Variables: Cross-Site Request Forgery (CSRF)CVE-2025-39455 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through <= 2.9.5.

  Product

  IP2Location Variables

  Affected

  up to 2.9.5

  What to do

  Affects up to 2.9.5. Update IP2Location Variables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Advanced Dynamic Pricing for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-39453 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Cross Site Request Forgery.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through <= 4.9.3.

  Product

  Advanced Dynamic Pricing for WooCommerce

  Affected

  up to 4.9.3

  What to do

  Affects up to 4.9.3. Update Advanced Dynamic Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Verge3D: Cross-Site Request Forgery (CSRF)CVE-2025-39443 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.9.0.

  Product

  Verge3D

  Affected

  up to 4.9.0

  What to do

  Affects up to 4.9.0. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Review Wave – Google Places Reviews: Cross-Site Request Forgery (CSRF)CVE-2025-39442 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This issue affects Review Wave – Google Places Reviews: from n/a through <= 1.4.7.

  Product

  Review Wave – Google Places Reviews

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update Review Wave – Google Places Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Dashboard Notepads: Cross-Site Request Forgery (CSRF)CVE-2025-39441 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Dashboard Notepads dashboard-notepads allows Stored XSS.This issue affects Dashboard Notepads: from n/a through <= 1.2.1.

  Product

  Dashboard Notepads

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Dashboard Notepads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Broken Links Remover: Cross-Site Request Forgery (CSRF)CVE-2025-39440 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover: from n/a through <= 1.2.2.

  Product

  Broken Links Remover

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Broken Links Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Theme Changer: Cross-Site Request Forgery (CSRF)CVE-2025-39438 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in momen2009 Theme Changer theme-changer allows Cross Site Request Forgery.This issue affects Theme Changer: from n/a through <= 1.4.

  Product

  Theme Changer

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Theme Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Anthologize: Cross-Site Request Forgery (CSRF)CVE-2025-39437 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from n/a through <= 0.8.3.

  Product

  Anthologize

  Affected

  up to 0.8.3

  What to do

  Affects up to 0.8.3. Update Anthologize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025My Marginalia: Cross-Site Request Forgery (CSRF)CVE-2025-39435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in davidfcarr My Marginalia my-marginalia allows Stored XSS.This issue affects My Marginalia: from n/a through <= 1.0.6.

  Product

  My Marginalia

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update My Marginalia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Bknewsticker: Cross-Site Request Forgery (CSRF)CVE-2025-39433 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in beke_ro Bknewsticker bknewsticker allows Stored XSS.This issue affects Bknewsticker: from n/a through <= 1.0.5.

  Product

  Bknewsticker

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Bknewsticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Amazon Showcase: Cross-Site Request Forgery (CSRF)CVE-2025-39431 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue affects Amazon Showcase WordPress Plugin: from n/a through <= 2.2.

  Product

  Amazon Showcase

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update Amazon Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025mLanguage: Cross-Site Request Forgery (CSRF)CVE-2025-39430 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Alexander Rauscha mLanguage mlanguage allows Stored XSS.This issue affects mLanguage: from n/a through <= 1.6.1.

  Product

  mLanguage

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update mLanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025illow – Cookies Consent: Cross-Site Request Forgery (CSRF)CVE-2025-39426 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in illow illow – Cookies Consent lgpd-compliant-cookie-banner allows Cross Site Request Forgery.This issue affects illow – Cookies Consent: from n/a through <= 0.2.0.

  Product

  illow – Cookies Consent

  Affected

  up to 0.2.0

  What to do

  Affects up to 0.2.0. Update illow – Cookies Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Style Manager: Cross-Site Request Forgery (CSRF)CVE-2025-39425 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in pixelgrade Style Manager style-manager allows Cross Site Request Forgery.This issue affects Style Manager: from n/a through <= 2.2.7.

  Product

  Style Manager

  Affected

  up to 2.2.7

  What to do

  Affects up to 2.2.7. Update Style Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Simple Maps: Cross-Site Request Forgery (CSRF)CVE-2025-39424 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in simplemaps Simple Maps interactive-maps allows Stored XSS.This issue affects Simple Maps: from n/a through <= 0.98.

  Product

  Simple Maps

  Affected

  up to 0.98

  What to do

  Affects up to 0.98. Update Simple Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Add to Header: Cross-Site Request Forgery (CSRF)CVE-2025-39423 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jenst Add to Header add-to-header allows Stored XSS.This issue affects Add to Header: from n/a through <= 1.0.

  Product

  Add to Header

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Add to Header to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Social Bookmarking: Cross-Site Request Forgery (CSRF)CVE-2025-39422 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in PResponsive WP Social Bookmarking wp-social-bookmarking allows Stored XSS.This issue affects WP Social Bookmarking: from n/a through <= 3.6.

  Product

  WP Social Bookmarking

  Affected

  up to 3.6

  What to do

  Affects up to 3.6. Update WP Social Bookmarking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WP Sticky Side Buttons: Cross-Site Request Forgery (CSRF)CVE-2025-39421 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky Side Buttons: from n/a through <= 2.1.

  Product

  WP Sticky Side Buttons

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update WP Sticky Side Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Revision Diet: Cross-Site Request Forgery (CSRF)CVE-2025-39419 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in David Miller Revision Diet revision-diet allows Stored XSS.This issue affects Revision Diet: from n/a through <= 1.0.1.

  Product

  Revision Diet

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Revision Diet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025RSS Manager: Cross-Site Request Forgery (CSRF)CVE-2025-39418 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ajayver RSS Manager rss-manager allows Stored XSS.This issue affects RSS Manager: from n/a through <= 0.06.

  Product

  RSS Manager

  Affected

  up to 0.06

  What to do

  Affects up to 0.06. Update RSS Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Redirect wordpress to welcome or landing page: Cross-Site Request Forgery (CSRF)CVE-2025-39417 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Stored XSS.This issue affects Redirect wordpress to welcome or landing page: from n/a through <= 2.0.

  Product

  Redirect wordpress to welcome or landing page

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Redirect wordpress to welcome or landing page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025translit it!: Cross-Site Request Forgery (CSRF)CVE-2025-39416 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ichi translit it! translit-it allows Stored XSS.This issue affects translit it!: from n/a through <= 1.6.

  Product

  translit it!

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update translit it! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Social Media Links: Cross-Site Request Forgery (CSRF)CVE-2025-39415 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jayesh Parejiya Social Media Links social-media-links allows Stored XSS.This issue affects Social Media Links: from n/a through <= 1.0.3.

  Product

  Social Media Links

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Social Media Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025spam-stopper: Cross-Site Request Forgery (CSRF)CVE-2025-39414 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mike spam-stopper spam-stopper allows Stored XSS.This issue affects spam-stopper: from n/a through <= 3.1.3.

  Product

  spam-stopper

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update spam-stopper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Restrict User Registration: Cross-Site Request Forgery (CSRF)CVE-2025-32655 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in DevriX Restrict User Registration restrict-user-registration allows Stored XSS.This issue affects Restrict User Registration: from n/a through <= 1.0.1.

  Product

  Restrict User Registration

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Restrict User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025Listings for Buildium: Cross-Site Request Forgery (CSRF)CVE-2025-32606 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Deepak Khokhar Listings for Buildium listings-for-buildium allows Stored XSS.This issue affects Listings for Buildium: from n/a through <= 0.1.5.

  Product

  Listings for Buildium

  Affected

  up to 0.1.5

  What to do

  Affects up to 0.1.5. Update Listings for Buildium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025All push notification for WP: Cross-Site Request Forgery (CSRF)CVE-2025-32546 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through <= 1.5.3.

  Product

  All push notification for WP

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update All push notification for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 17, 2025WooCommerce Products without featured images: Cross-Site Request Forgery (CSRF)CVE-2025-32545 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in SOFTAGON WooCommerce Products without featured images woocommerce-products-without-featured-images allows Reflected XSS.This issue affects WooCommerce Products without featured images: from n/a through <= 0.1.

  Product

  WooCommerce Products without featured images

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update WooCommerce Products without featured images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025WooCommerce Social Login: Cross-Site Request Forgery (CSRF)CVE-2025-39472 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through < 2.8.3.

  Product

  WooCommerce Social Login

  Fixed in

  2.8.3

  What to do

  Update WooCommerce Social Login to 2.8.3 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Custom CSS, JS & PHP: Cross-Site Request Forgery (CSRF)CVE-2025-39601 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Custom CSS, JS & PHP custom-css allows Remote Code Inclusion.This issue affects Custom CSS, JS & PHP: from n/a through <= 2.4.1.

  Product

  Custom CSS, JS & PHP

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Custom CSS, JS & PHP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Integration for WooCommerce and QuickBooks: Cross-Site Request Forgery (CSRF)CVE-2025-39600 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cross Site Request Forgery.This issue affects Integration for WooCommerce and QuickBooks: from n/a through <= 1.3.1.

  Product

  Integration for WooCommerce and QuickBooks

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Integration for WooCommerce and QuickBooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Ever Accounting: Cross-Site Request Forgery (CSRF)CVE-2025-39593 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in EverAccounting Ever Accounting wp-ever-accounting allows Cross Site Request Forgery.This issue affects Ever Accounting: from n/a through <= 2.1.5.

  Product

  Ever Accounting

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Ever Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Conditional Shipping for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-39564 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in WP Trio Conditional Shipping for WooCommerce conditional-shipping-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Shipping for WooCommerce: from n/a through <= 3.4.0.

  Product

  Conditional Shipping for WooCommerce

  Affected

  up to 3.4.0

  What to do

  Affects up to 3.4.0. Update Conditional Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 16, 2025Conditional Payments for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-39563 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in WP Trio Conditional Payments for WooCommerce conditional-payments-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Payments for WooCommerce: from n/a through <= 3.3.0.

  Product

  Conditional Payments for WooCommerce

  Affected

  up to 3.3.0

  What to do

  Affects up to 3.3.0. Update Conditional Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.