Updated 44 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

477new WordPress flaws this week

393,150entries in the database

40,869 results · page 291 of 818

Sep 11, 2025My WP Translate: Unauthorized modification of dataCVE-2025-8423 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mtswpt_remove_plugin() and ajax_update_export_code() functions in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete arbitrary WordPress options which can cause a denial of service.
Product
My WP Translate
Affected
up to 1.1
What to do
Affects up to 1.1. Update My WP Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025Propovoice: All-in-One Client Management System: Arbitrary File ReadCVE-2025-8422 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.7.6.7 via the send_email() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Propovoice: All-in-One Client Management System
Affected
up to 1.7.6.7
What to do
Affects up to 1.7.6.7. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025Catalog Importer, Scraper & Crawler: PHP code injectionCVE-2025-8417 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Catalog Importer, Scraper & Crawler plugin for WordPress is vulnerable to PHP code injection in all versions up to, and including, 5.1.4. This is due to reliance on a guessable numeric token (e.g. ?key= 900001705) without proper authentication, combined with the unsafe use of eval() on user-supplied input. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server via a forged request granted they can guess or brute-force the numeric key.
Product
Catalog Importer, Scraper & Crawler
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update Catalog Importer, Scraper & Crawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025azurecurve BBCode: Stored Cross-Site ScriptingCVE-2025-8398 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
azurecurve BBCode
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update azurecurve BBCode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025Mitfahrgelegenheit: Stored Cross-Site ScriptingCVE-2025-8392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mitfahrgelegenheit
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Mitfahrgelegenheit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025Jobify: Stored Cross-Site ScriptingCVE-2025-8318 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jobify
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Jobify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025Certifica WP: Stored Cross-Site ScriptingCVE-2025-8316 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Certifica WP
Affected
up to 3.1
What to do
Affects up to 3.1. Update Certifica WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Sep 11, 2025Responsive Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-8215 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Addons for Elementor
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 11, 2025Digital Events Calendar: Stored Cross-Site ScriptingCVE-2025-5801 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Digital Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘column’ parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Digital Events Calendar
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Digital Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 11, 2025Ultimate Classified Listings: Unauthorized modification of dataCVE-2025-0763 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_custom_fields function in all versions up to, and including, 1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin custom fields.
Product
Ultimate Classified Listings
Affected
up to 1.7
What to do
Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 11, 2025Zoho Flow: Cross-Site Request ForgeryCVE-2025-8479 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Zoho Flow plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.14.1. This is due to missing or incorrect nonce validation on the zoho_flow_deactivate_plugin function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Zoho Flow
Affected
up to 2.14.1
What to do
Affects up to 2.14.1. Update Zoho Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 11, 2025Wp Edit Password Protected: Does not validate a parameter before redirecting the user to its valueCVE-2025-9034 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp Edit Password Protected WordPress plugin before 1.3.5 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
Product
Wp Edit Password Protected
Fixed in
1.3.5
What to do
Update Wp Edit Password Protected to 1.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2025CatFolders – Tame Your WordPress Media Library by Category: Time-based SQL InjectionCVE-2025-9776 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in all versions up to, and including, 2.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
CatFolders – Tame Your WordPress Media Library by Category
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update CatFolders – Tame Your WordPress Media Library by Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Resideo Plugin for Resideo - Real Estate: Privilege escalationCVE-2025-7718 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.5.4. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
Resideo Plugin for Resideo - Real Estate
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Resideo Plugin for Resideo - Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 10, 2025Maspik: Missing Authorization in version 2CVE-2025-9979 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spamlog_download_csv function. This makes it possible for authenticated attackers, with subscriber-level access and above, to export and download the spam log database containing blocked submission attempts, which may include misclassified but legitimate submissions with sensitive data.
Product
Maspik
What to do
Update Maspik to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Maspik – Ultimate Spam Protection: Cross-Site Request ForgeryCVE-2025-9888 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maspik – Ultimate Spam Protection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.6. This is due to missing or incorrect nonce validation on the clear_log function. This makes it possible for unauthenticated attackers to clear all spam logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Maspik – Ultimate Spam Protection
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Maspik – Ultimate Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Heateor Login – Social Login: Stored Cross-Site ScriptingCVE-2025-9857 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Heateor Login – Social Login Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Heateor_Facebook_Login' shortcode in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Heateor Login – Social Login
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Heateor Login – Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025WP Blast | SEO & Performance Booster: Cross-Site Request ForgeryCVE-2025-9622 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Blast | SEO & Performance Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.6. This is due to missing or incorrect nonce validation on multiple administrative actions in the Settings class. This makes it possible for unauthenticated attackers to trigger cache purging, sitemap clearing, plugin data purging, and score resetting operations via forged requests granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Blast | SEO & Performance Booster
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update WP Blast | SEO & Performance Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net: Time-based SQL InjectionCVE-2025-9463 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 1.117.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net
Affected
up to 1.117.5
What to do
Affects up to 1.117.5. Update Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Welcart e-Commerce: Stored Cross-Site ScriptingCVE-2025-9367 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 2.11.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Welcart e-Commerce
Affected
up to 2.11.20
What to do
Affects up to 2.11.20. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 10, 2025NitroPack: Unauthorized modification of dataCVE-2025-8778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the nitropack_set_compression_ajax() function in all versions up to, and including, 1.18.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the nitropack-enableCompression option and effectively change plugin compression settings.
Product
NitroPack
Affected
up to 1.18.4
What to do
Affects up to 1.18.4. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Auto Save Remote Images (Drafts): Server-Side Request ForgeryCVE-2025-7843 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetch_images() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Auto Save Remote Images (Drafts)
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Auto Save Remote Images (Drafts) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 10, 2025Testimonial: SQL InjectionCVE-2025-7826 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Testimonial
Affected
up to 2.3
What to do
Affects up to 2.3. Update Testimonial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 10, 2025WPGYM - Wordpress Gym Management System: Privilege escalationCVE-2025-7049 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ_gmgt_gmgt_add_user' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email, password, and other details of any user, including Administrator users.
Product
WPGYM - Wordpress Gym Management System
Affected
up to 67.7.0
What to do
Affects up to 67.7.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 10, 2025Duplicate Page and Post: Time-based SQL InjectionCVE-2025-6189 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Duplicate Page and Post plugin for WordPress is vulnerable to time-based SQL Injection via the ‘meta_key’ parameter in all versions up to, and including, 2.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Duplicate Page and Post
Affected
up to 2.9.5
What to do
Affects up to 2.9.5. Update Duplicate Page and Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 10, 2025PagBank / PagSeguro Connect para WooCommerce: SQL InjectionCVE-2025-10142 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 4.44.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
PagBank / PagSeguro Connect para WooCommerce
Affected
up to 4.44.3
What to do
Affects up to 4.44.3. Update PagBank / PagSeguro Connect para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 10, 2025MyBrain Utilities: Stored Cross-Site ScriptingCVE-2025-10126 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MyBrain Utilities
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update MyBrain Utilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Responsive Filterable Portfolio: Arbitrary file uploadsCVE-2025-10049 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_image field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Responsive Filterable Portfolio
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update Responsive Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of dataCVE-2025-10040 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a configured set of SFTP/FTP credentials.
Product
WP Import – Ultimate CSV XML Importer for
Affected
up to 7.27
What to do
Affects up to 7.27. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2025Import any XML, CSV or Excel File to: Arbitrary file uploadsCVE-2025-10001 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Import any XML, CSV or Excel File to WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the import functionality in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload unsafe files like .phar files on the affected site's server which may make remote code execution possible.
Product
Import any XML, CSV or Excel File to
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update Import any XML, CSV or Excel File to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2025PowerPack Elementor Addons (Free Widgets, Extensions and Templates): Stored Cross-Site ScriptingCVE-2025-8388 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor_url’ parameter in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PowerPack Elementor Addons (Free Widgets, Extensions and Templates)
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update PowerPack Elementor Addons (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2025ZIP Code Based Content Protection: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59008 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection zip-code-based-content-protection allows SQL Injection.This issue affects ZIP Code Based Content Protection: from n/a through <= 1.0.0.
Product
ZIP Code Based Content Protection
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update ZIP Code Based Content Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Categorify: Missing AuthorizationCVE-2025-59005 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Categorify: from n/a through <= 1.0.7.5.
Product
Categorify
Affected
up to 1.0.7.5
What to do
Affects up to 1.0.7.5. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Mow: Cross-Site Request Forgery (CSRF)CVE-2025-58997 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow mow allows Code Injection.This issue affects Mow: from n/a through <= 4.10.
Product
Mow
Affected
up to 4.10
What to do
Affects up to 4.10. Update Mow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58993 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue affects Tutor LMS: from n/a through <= 3.7.4.
Product
Tutor LMS
Affected
up to 3.7.4
What to do
Affects up to 3.7.4. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025WooCommerce Booking Bundle Hours: Cross-Site Request Forgery (CSRF)CVE-2025-58991 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Cristiano Zanca WooCommerce Booking Bundle Hours allows Stored XSS. This issue affects WooCommerce Booking Bundle Hours: from n/a through 0.7.4.
Product
WooCommerce Booking Bundle Hours
Affected
up to 0.7.4
What to do
Affects up to 0.7.4. Update WooCommerce Booking Bundle Hours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025ShopLentor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58990 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.
Product
ShopLentor
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update ShopLentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Dynamic Text Field For Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58989 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dynamic-text-field-for-contact-form-7 allows Stored XSS.This issue affects Dynamic Text Field For Contact Form 7: from n/a through <= 1.0.
Product
Dynamic Text Field For Contact Form 7
Affected
up to 1.0
What to do
Affects up to 1.0. Update Dynamic Text Field For Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025My Tickets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This issue affects My Tickets: from n/a through <= 2.0.22.
Product
My Tickets
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Football Pool: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58987 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.6.
Product
Football Pool
Affected
up to 2.12.6
What to do
Affects up to 2.12.6. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Additional Custom Product Tabs for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58985 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through <= 1.7.3.
Product
Additional Custom Product Tabs for WooCommerce
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Additional Custom Product Tabs for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58984 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.20.
Product
Welcart e-Commerce
Affected
up to 2.11.20
What to do
Affects up to 2.11.20. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Include Me: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58983 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me include-me allows Stored XSS.This issue affects Include Me: from n/a through <= 1.3.2.
Product
Include Me
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Include Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Pixeline's Email Protector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector pixelines-email-protector allows Stored XSS.This issue affects Pixeline's Email Protector: from n/a through <= 1.3.8.
Product
Pixeline's Email Protector
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Pixeline's Email Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
Product
Accessibility Checker by Equalize Digital
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Export WP Page to Static HTML/CSS: Missing AuthorizationCVE-2025-58980 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HTML/CSS: from n/a through <= 4.1.0.
Product
Export WP Page to Static HTML/CSS
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025BerqWP: Missing AuthorizationCVE-2025-58979 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqWP: from n/a through <= 2.2.53.
Product
BerqWP
Affected
up to 2.2.53
What to do
Affects up to 2.2.53. Update BerqWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025PDF Generator for: Missing AuthorizationCVE-2025-58978 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Generator for WordPress: from n/a through <= 1.5.4.
Product
PDF Generator for
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update PDF Generator for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025WP eBay Product Feeds: Server-Side Request Forgery (SSRF)CVE-2025-58977 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Server Side Request Forgery.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.8.
Product
WP eBay Product Feeds
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update WP eBay Product Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
Product
Accessibility Checker by Equalize Digital
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.