Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,834 results · page 283 of 817
Sep 22, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-59576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP Travel Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel Engine WP Travel Engine wte-elementor-widgets allows Stored XSS.This issue affects WP Travel Engine: from n/a through <= 1.4.2.
- Product
- WP Travel Engine
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Travel Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Cozy Blocks: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-59573 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CozyThemes Cozy Blocks cozy-addons allows Code Injection.This issue affects Cozy Blocks: from n/a through <= 2.1.29.
- Product
- Cozy Blocks
- Affected
- up to 2.1.29
- What to do
- Affects up to 2.1.29. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WorkScout-Core: Cross-Site Request Forgery (CSRF)CVE-2025-59572 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Cross Site Request Forgery.This issue affects WorkScout-Core: from n/a through < 1.7.06.
- Product
- WorkScout-Core
- What to do
- Update WorkScout-Core to the newest version.
Sep 22, 2025Mail Mint: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59570 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.6.
- Product
- Mail Mint
- Affected
- up to 1.18.6
- What to do
- Affects up to 1.18.6. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CubeWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Stored XSS.This issue affects CubeWP: from n/a through <= 1.1.26.
- Product
- CubeWP
- Affected
- up to 1.1.26
- What to do
- Affects up to 1.1.26. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Zoho Flow: Cross-Site Request Forgery (CSRF)CVE-2025-59568 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow zoho-flow allows Cross Site Request Forgery.This issue affects Zoho Flow: from n/a through <= 2.14.1.
- Product
- Zoho Flow
- Affected
- up to 2.14.1
- What to do
- Affects up to 2.14.1. Update Zoho Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Coupon Affiliates: Missing AuthorizationCVE-2025-59567 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.8.0.
- Product
- Coupon Affiliates
- Affected
- up to 6.8.0
- What to do
- Affects up to 6.8.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Upsell Order Bump Offer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59565 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Stored XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through <= 3.0.7.
- Product
- Upsell Order Bump Offer for WooCommerce
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Upsell Order Bump Offer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Academy LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-59562 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.3.4.
- Product
- Academy LMS
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Smart Blocks: Missing AuthorizationCVE-2025-59561 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.
- Product
- Smart Blocks
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Smart Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Payrexx Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-59559 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in payrexx Payrexx Payment Gateway for WooCommerce woo-payrexx-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payrexx Payment Gateway for WooCommerce: from n/a through <= 3.1.5.
- Product
- Payrexx Payment Gateway for WooCommerce
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Payrexx Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Custom iFrame for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59553 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coderz Studio Custom iFrame for Elementor custom-iframe allows DOM-Based XSS.This issue affects Custom iFrame for Elementor: from n/a through <= 1.0.13.
- Product
- Custom iFrame for Elementor
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Custom iFrame for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Save as PDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59552 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Stored XSS.This issue affects Save as PDF: from n/a through <= 4.5.2.
- Product
- Save as PDF
- Affected
- up to 4.5.2
- What to do
- Affects up to 4.5.2. Update Save as PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Revive.so: Missing AuthorizationCVE-2025-59551 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.6.
- Product
- Revive.so
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Revive.so to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025GetResponse Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59549 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps GetResponse Forms getresponse allows Stored XSS.This issue affects GetResponse Forms: from n/a through <= 2.6.0.
- Product
- GetResponse Forms
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update GetResponse Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Product Catalog Simple: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58992 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.2.
- Product
- Product Catalog Simple
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update Product Catalog Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WPComplete: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58974 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.2.
- Product
- WPComplete
- Affected
- up to 2.9.5.2
- What to do
- Affects up to 2.9.5.2. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Easy Elementor Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58973 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a through <= 2.2.8.
- Product
- Easy Elementor Addons
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Custom Login URL: Missing AuthorizationCVE-2025-58969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through <= 1.0.2.
- Product
- Custom Login URL
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Custom Login URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025MaxiBlocks: Missing AuthorizationCVE-2025-58968 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MaxiBlocks: from n/a through <= 2.1.3.
- Product
- MaxiBlocks
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update MaxiBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Fusion Page Builder : Extension – Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58965 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion Page Builder : Extension – Gallery fusion-extension-gallery allows Stored XSS.This issue affects Fusion Page Builder : Extension – Gallery: from n/a through <= 1.7.6.
- Product
- Fusion Page Builder : Extension – Gallery
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update Fusion Page Builder : Extension – Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Publitio: Server-Side Request Forgery (SSRF)CVE-2025-58962 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through <= 2.2.1.
- Product
- Publitio
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025IP Based Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58960 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through <= 2.4.3.
- Product
- IP Based Login
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update IP Based Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025VPSUForm: Missing AuthorizationCVE-2025-58957 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.2.20.
- Product
- VPSUForm
- Affected
- up to 3.2.20
- What to do
- Affects up to 3.2.20. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP Attractive Donations System: Cross-Site Request Forgery (CSRF)CVE-2025-58956 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System wp-attractive-donations-system-easy-stripe-paypal-donations allows Stored XSS.This issue affects WP Attractive Donations System: from n/a through < 1.29.
- Product
- WP Attractive Donations System
- What to do
- Update WP Attractive Donations System to the newest version.
Sep 22, 2025WP Delete User Accounts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58704 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows Stored XSS.This issue affects WP Delete User Accounts: from n/a through <= 1.2.4.
- Product
- WP Delete User Accounts
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update WP Delete User Accounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Skyword API: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58703 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skyword Skyword API Plugin skyword-plugin allows Stored XSS.This issue affects Skyword API Plugin: from n/a through <= 2.5.3.
- Product
- Skyword API
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Skyword API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025MarketKing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58702 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebWizards MarketKing marketking-multivendor-marketplace-for-woocommerce allows Stored XSS.This issue affects MarketKing: from n/a through <= 2.0.92.
- Product
- MarketKing
- Affected
- up to 2.0.92
- What to do
- Affects up to 2.0.92. Update MarketKing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Genesis Club Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58691 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Genesis Club Lite genesis-club-lite allows Stored XSS.This issue affects Genesis Club Lite: from n/a through <= 1.17.
- Product
- Genesis Club Lite
- Affected
- up to 1.17
- What to do
- Affects up to 1.17. Update Genesis Club Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Doliconnect: Cross-Site Request Forgery (CSRF)CVE-2025-58690 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ptibogxiv Doliconnect doliconnect allows Stored XSS.This issue affects Doliconnect: from n/a through <= 9.5.7.
- Product
- Doliconnect
- Affected
- up to 9.5.7
- What to do
- Affects up to 9.5.7. Update Doliconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Tapfiliate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58689 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tapfiliate Tapfiliate tapfiliate allows Stored XSS.This issue affects Tapfiliate: from n/a through <= 3.2.2.
- Product
- Tapfiliate
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Tapfiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Casengo Live Chat Support: Cross-Site Request Forgery (CSRF)CVE-2025-58688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Casengo Casengo Live Chat Support the-casengo-chat-widget allows Stored XSS.This issue affects Casengo Live Chat Support: from n/a through <= 2.1.4.
- Product
- Casengo Live Chat Support
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Casengo Live Chat Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Current Age: Cross-Site Request Forgery (CSRF)CVE-2025-58687 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Current Age Plugin current-age allows Stored XSS.This issue affects Current Age Plugin: from n/a through <= 1.6.
- Product
- Current Age
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Current Age to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Perfect Brands for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58686 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quadlayers Perfect Brands for WooCommerce perfect-woocommerce-brands allows SQL Injection.This issue affects Perfect Brands for WooCommerce: from n/a through <= 3.6.2.
- Product
- Perfect Brands for WooCommerce
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update Perfect Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Cecabank WooCommerce: Missing AuthorizationCVE-2025-58685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cecabank WooCommerce Plugin: from n/a through <= 0.3.4.
- Product
- Cecabank WooCommerce
- Affected
- up to 0.3.4
- What to do
- Affects up to 0.3.4. Update Cecabank WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Logo Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58684 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through <= 4.0.1.
- Product
- Logo Showcase
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Logo Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Last Updated Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58683 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luke Mlsna Last Updated Shortcode last-updated-shortcode allows Stored XSS.This issue affects Last Updated Shortcode: from n/a through <= 1.0.1.
- Product
- Last Updated Shortcode
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Last Updated Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Kama Click Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58682 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through <= 4.0.4.
- Product
- Kama Click Counter
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Kama Click Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Easy Quotes: Missing AuthorizationCVE-2025-58681 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Quotes: from n/a through <= 1.2.4.
- Product
- Easy Quotes
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Easy Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Gutentor: Missing AuthorizationCVE-2025-58680 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.2.
- Product
- Gutentor
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Gutentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025AppMySite: Missing AuthorizationCVE-2025-58679 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AppMySite: from n/a through <= 3.15.0.
- Product
- AppMySite
- Affected
- up to 3.15.0
- What to do
- Affects up to 3.15.0. Update AppMySite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Accordion: Missing AuthorizationCVE-2025-58678 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.15.
- Product
- Accordion
- Affected
- up to 2.3.15
- What to do
- Affects up to 2.3.15. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025ShrinkTheWeb (STW) Website Previews: Cross-Site Request Forgery (CSRF)CVE-2025-58677 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in puravida1976 ShrinkTheWeb (STW) Website Previews shrinktheweb-website-preview-plugin allows Stored XSS.This issue affects ShrinkTheWeb (STW) Website Previews: from n/a through <= 2.8.5.
- Product
- ShrinkTheWeb (STW) Website Previews
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update ShrinkTheWeb (STW) Website Previews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025HORIZONTAL SLIDER: Cross-Site Request Forgery (CSRF)CVE-2025-58676 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in extendyourweb HORIZONTAL SLIDER horizontal-slider allows Stored XSS.This issue affects HORIZONTAL SLIDER: from n/a through <= 2.4.
- Product
- HORIZONTAL SLIDER
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update HORIZONTAL SLIDER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Interact: Embed A Quiz On Your Site: Cross-Site Request Forgery (CSRF)CVE-2025-58675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in tryinteract Interact: Embed A Quiz On Your Site interact-quiz-embed allows Cross Site Request Forgery.This issue affects Interact: Embed A Quiz On Your Site: from n/a through <= 3.1.
- Product
- Interact: Embed A Quiz On Your Site
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Interact: Embed A Quiz On Your Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP User Frontend: Improper Control of Generation of Code ('Code Injection')CVE-2025-58673 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through <= 4.1.12.
- Product
- WP User Frontend
- Affected
- up to 4.1.12
- What to do
- Affects up to 4.1.12. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP User Frontend: Missing AuthorizationCVE-2025-58672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.1.12.
- Product
- WP User Frontend
- Affected
- up to 4.1.12
- What to do
- Affects up to 4.1.12. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Auction Feed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58671 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in morganrichards Auction Feed auction-feed allows Stored XSS.This issue affects Auction Feed: from n/a through <= 1.1.4.
- Product
- Auction Feed
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Auction Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP Content Protection: Cross-Site Request Forgery (CSRF)CVE-2025-58670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shankaranand Maurya WP Content Protection wp-content-protection allows Stored XSS.This issue affects WP Content Protection: from n/a through <= 1.3.
- Product
- WP Content Protection
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update WP Content Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.