Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,822 results · page 271 of 817
Oct 22, 2025SUMO Memberships for WooCommerce: Incorrect Privilege AssignmentCVE-2025-60222 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Privilege Escalation.This issue affects SUMO Memberships for WooCommerce: from n/a through <= 7.8.0.
- Product
- SUMO Memberships for WooCommerce
- Affected
- up to 7.8.0
- What to do
- Affects up to 7.8.0. Update SUMO Memberships for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Captivate Sync: Deserialization of Untrusted DataCVE-2025-60221 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Object Injection.This issue affects Captivate Sync: from n/a through <= 3.0.3.
- Product
- Captivate Sync
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025CouponXxL: Incorrect Privilege AssignmentCVE-2025-60220 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from n/a through <= 3.0.0.
- Product
- CouponXxL
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update CouponXxL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025PT Luxa Addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60217 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ypromo PT Luxa Addons pt-luxa-addons allows Path Traversal.This issue affects PT Luxa Addons: from n/a through <= 1.2.2.
- Product
- PT Luxa Addons
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update PT Luxa Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Addison: Deserialization of Untrusted DataCVE-2025-60216 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Addison addison allows Object Injection.This issue affects Addison: from n/a through < 1.4.8.
- Product
- Addison
- What to do
- Update Addison to the newest version.
Oct 22, 2025Kriya: Deserialization of Untrusted DataCVE-2025-60215 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Kriya kriya allows Object Injection.This issue affects Kriya: from n/a through <= 3.4.
- Product
- Kriya
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Kriya to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Goldenblatt: Deserialization of Untrusted DataCVE-2025-60214 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Goldenblatt goldenblatt allows Object Injection.This issue affects Goldenblatt: from n/a through < 1.3.0.
- Product
- Goldenblatt
- What to do
- Update Goldenblatt to the newest version.
Oct 22, 2025Scape: Deserialization of Untrusted DataCVE-2025-60213 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Whitebox-Studio Scape scape allows Object Injection.This issue affects Scape: from n/a through <= 1.5.13.
- Product
- Scape
- Affected
- up to 1.5.13
- What to do
- Affects up to 1.5.13. Update Scape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025VEDA: Deserialization of Untrusted DataCVE-2025-60212 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.
- Product
- VEDA
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update VEDA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Registration Fields Plugin - Custom Signup Fields: Incorrect Privilege AssignmentCVE-2025-60211 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Privilege Escalation.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.
- Product
- WooCommerce Registration Fields Plugin - Custom Signup Fields
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update WooCommerce Registration Fields Plugin - Custom Signup Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Everest Forms - Frontend Listing: Deserialization of Untrusted DataCVE-2025-60210 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpeverest Everest Forms - Frontend Listing everest-forms-frontend-listing allows Object Injection.This issue affects Everest Forms - Frontend Listing: from n/a through <= 1.0.5.
- Product
- Everest Forms - Frontend Listing
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Everest Forms - Frontend Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Connector for Gravity Forms and Google Sheets: Deserialization of Untrusted DataCVE-2025-60209 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.6.
- Product
- Connector for Gravity Forms and Google Sheets
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Connector for Gravity Forms and Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Advanced Custom Fields : CPT Options Pages: Cross-Site Request Forgery (CSRF)CVE-2025-60208 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Tusko Trush Advanced Custom Fields : CPT Options Pages acf-cpt-options-pages allows Object Injection.This issue affects Advanced Custom Fields : CPT Options Pages: from n/a through <= 2.0.9.
- Product
- Advanced Custom Fields : CPT Options Pages
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Advanced Custom Fields : CPT Options Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Alone: Improper Control of Generation of Code ('Code Injection')CVE-2025-60206 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through <= 7.8.3.
- Product
- Alone
- Affected
- up to 7.8.3
- What to do
- Affects up to 7.8.3. Update Alone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Tesseract: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60176 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tattersoftware WP Tesseract wp-tesseract allows Stored XSS.This issue affects WP Tesseract: from n/a through <= 1.0.2.
- Product
- WP Tesseract
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Tesseract to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025HotelRunner Booking Widget: Cross-Site Request Forgery (CSRF)CVE-2025-60168 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in integrationshotelrunner HotelRunner Booking Widget hotelrunner allows Stored XSS.This issue affects HotelRunner Booking Widget: from n/a through <= 1.6.
- Product
- HotelRunner Booking Widget
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update HotelRunner Booking Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Gravity Forms HubSpot: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-60151 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.5.
- Product
- WP Gravity Forms HubSpot
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Gravity Forms HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WeShare Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60135 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NIKITAS GEORGOPOULOS WeShare Buttons e-mailit allows Stored XSS.This issue affects WeShare Buttons: from n/a through <= 13.0.0.
- Product
- WeShare Buttons
- Affected
- up to 13.0.0
- What to do
- Affects up to 13.0.0. Update WeShare Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Media Categories: Cross-Site Request Forgery (CSRF)CVE-2025-60134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through <= 2.1.0.
- Product
- WP Media Categories
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Media Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Video Blogster Lite: Cross-Site Request Forgery (CSRF)CVE-2025-60132 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.
- Product
- Video Blogster Lite
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Video Blogster Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Werk aan de Muur: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60131 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XSS.This issue affects Werk aan de Muur: from n/a through <= 1.5.
- Product
- Werk aan de Muur
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Werk aan de Muur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Emails Catch All: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-60041 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3.
- Product
- Emails Catch All
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Emails Catch All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Noisa: Deserialization of Untrusted DataCVE-2025-60039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.
- Product
- Noisa
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Noisa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Colibri Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59593 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.
- Product
- Colibri Page Builder
- Fixed in
- 1.0.334
- What to do
- Update Colibri Page Builder to 1.0.334 or newer.
Oct 22, 2025Goodlayers Core: Incorrect Privilege AssignmentCVE-2025-59580 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in GoodLayers Goodlayers Core goodlayers-core allows Privilege Escalation.This issue affects Goodlayers Core: from n/a through < 2.1.7.
- Product
- Goodlayers Core
- What to do
- Update Goodlayers Core to the newest version.
Oct 22, 2025Simple Job Board: Insertion of Sensitive Information Into Sent DataCVE-2025-59579 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in PressTigers Simple Job Board simple-job-board allows Retrieve Embedded Sensitive Data.This issue affects Simple Job Board: from n/a through <= 2.13.7.
- Product
- Simple Job Board
- Affected
- up to 2.13.7
- What to do
- Affects up to 2.13.7. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025ShopMagic: Insertion of Sensitive Information Into Sent DataCVE-2025-59578 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through <= 4.5.6.
- Product
- ShopMagic
- Affected
- up to 4.5.6
- What to do
- Affects up to 4.5.6. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MasterStudy LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59575 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through < 1.7.06.
- Product
- WorkScout-Core
- What to do
- Update WorkScout-Core to the newest version.
Oct 22, 2025Workreap (theme's plugin): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-59566 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.5.
- Product
- Workreap (theme's plugin)
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Workreap (theme's plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025EduMall: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59564 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through < 4.4.5.
- Product
- EduMall
- Fixed in
- 4.4.5
- What to do
- Update EduMall to 4.4.5 or newer.
Oct 22, 2025Billey: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59558 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through < 2.1.6.
- Product
- Billey
- Fixed in
- 2.1.6
- What to do
- Update Billey to 2.1.6 or newer.
Oct 22, 2025Learts Addons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59557 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injection.This issue affects Learts Addons: from n/a through < 1.7.5.
- Product
- Learts Addons
- What to do
- Update Learts Addons to the newest version.
Oct 22, 2025Medizin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59555 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through < 1.9.7.
- Product
- Medizin
- Fixed in
- 1.9.7
- What to do
- Update Medizin to 1.9.7 or newer.
Oct 22, 2025Xcare: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-59550 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Xcare xcare allows PHP Local File Inclusion.This issue affects Xcare: from n/a through < 6.5.
- Product
- Xcare
- What to do
- Update Xcare to the newest version.
Oct 22, 2025TF Woo Product Grid Addon For Elementor: Deserialization of Untrusted DataCVE-2025-59007 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themesflat TF Woo Product Grid Addon For Elementor tf-woo-product-grid allows Object Injection.This issue affects TF Woo Product Grid Addon For Elementor: from n/a through <= 1.0.1.
- Product
- TF Woo Product Grid Addon For Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update TF Woo Product Grid Addon For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Easy Woocommerce Customizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59006 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS.This issue affects Easy Woocommerce Customizer: from n/a through <= 1.0.2.
- Product
- Easy Woocommerce Customizer
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Easy Woocommerce Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WC Return products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pco_58 WC Return products wc-return-product allows Reflected XSS.This issue affects WC Return products: from n/a through <= 1.5.
- Product
- WC Return products
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WC Return products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Doctreat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58971 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmentoTech Doctreat doctreat allows Reflected XSS.This issue affects Doctreat: from n/a through <= 1.6.7.
- Product
- Doctreat
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Doctreat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Doctreat: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-58970 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.
- Product
- Doctreat
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Doctreat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Businext: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58967 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Businext businext allows PHP Local File Inclusion.This issue affects Businext: from n/a through < 2.4.4.
- Product
- Businext
- Fixed in
- 2.4.4
- What to do
- Update Businext to 2.4.4 or newer.
Oct 22, 2025NEX-Forms LITE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58966 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms LITE nex-forms-lite allows Reflected XSS.This issue affects NEX-Forms LITE: from n/a through < 8.2.
- Product
- NEX-Forms LITE
- What to do
- Update NEX-Forms LITE to the newest version.
Oct 22, 2025Medcity: Unrestricted Upload of File with Dangerous TypeCVE-2025-58963 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: from n/a through < 1.1.9.
- Product
- Medcity
- What to do
- Update Medcity to the newest version.
Oct 22, 2025CF7 Auto Responder Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58961 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav CF7 Auto Responder Addon CF7-autoresponder-addon allows DOM-Based XSS.This issue affects CF7 Auto Responder Addon: from n/a through <= 2.4.
- Product
- CF7 Auto Responder Addon
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update CF7 Auto Responder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Taskbot: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-58959 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Taskbot taskbot allows Path Traversal.This issue affects Taskbot: from n/a through <= 6.4.
- Product
- Taskbot
- Affected
- up to 6.4
- What to do
- Affects up to 6.4. Update Taskbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025SmilePure: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58958 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove SmilePure smilepure allows PHP Local File Inclusion.This issue affects SmilePure: from n/a through < 1.8.5.
- Product
- SmilePure
- Fixed in
- 1.8.5
- What to do
- Update SmilePure to 1.8.5 or newer.
Oct 22, 2025Karzo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58955 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Karzo karzo allows PHP Local File Inclusion.This issue affects Karzo: from n/a through < 2.6.
- Product
- Karzo
- What to do
- Update Karzo to the newest version.
Oct 22, 2025WP Tactical Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58921 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arevico WP Tactical Popup wp-tactical-popup allows Reflected XSS.This issue affects WP Tactical Popup: from n/a through <= 1.1.
- Product
- WP Tactical Popup
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Tactical Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Author: Munzir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58916 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munzir Author: Munzir myshouts-shoutbox allows Reflected XSS.This issue affects Author: Munzir: from n/a through <= 0.9.
- Product
- Author: Munzir
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Author: Munzir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Simple User Registration: Incorrect Privilege AssignmentCVE-2025-53428 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in N-Media Simple User Registration wp-registration allows Privilege Escalation.This issue affects Simple User Registration: from n/a through <= 6.8.
- Product
- Simple User Registration
- Affected
- up to 6.8
- What to do
- Affects up to 6.8. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.