Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,869 results · page 296 of 818
Sep 3, 2025PuzzleMe for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58621 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress puzzleme allows Stored XSS.This issue affects PuzzleMe for WordPress: from n/a through <= 1.2.0.
- Product
- PuzzleMe for
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update PuzzleMe for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025PDF for WPForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored XSS.This issue affects PDF for WPForms: from n/a through <= 6.2.1.
- Product
- PDF for WPForms
- Affected
- up to 6.2.1
- What to do
- Affects up to 6.2.1. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Pie Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58618 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Based XSS.This issue affects Pie Calendar: from n/a through <= 1.2.8.
- Product
- Pie Calendar
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Pie Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025F4 Media Taxonomies: Missing AuthorizationCVE-2025-58617 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F4 Media Taxonomies: from n/a through <= 1.1.4.
- Product
- F4 Media Taxonomies
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update F4 Media Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Frisbii Pay: Missing AuthorizationCVE-2025-58616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frisbii Pay: from n/a through <= 1.8.2.1.
- Product
- Frisbii Pay
- Affected
- up to 1.8.2.1
- What to do
- Affects up to 1.8.2.1. Update Frisbii Pay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025WP Bannerize Pro: Server-Side Request Forgery (SSRF)CVE-2025-58615 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Bannerize Pro: from n/a through <= 1.10.0.
- Product
- WP Bannerize Pro
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update WP Bannerize Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Tooltipy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58614 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.6.
- Product
- Tooltipy
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update Tooltipy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Posts Table with Search & Sort: Missing AuthorizationCVE-2025-58613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through <= 1.4.10.
- Product
- Posts Table with Search & Sort
- Affected
- up to 1.4.10
- What to do
- Affects up to 1.4.10. Update Posts Table with Search & Sort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58612 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.5.
- Product
- PropertyHive
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Tickera: Cross-Site Request Forgery (CSRF)CVE-2025-58611 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera: from n/a through <= 3.5.5.6.
- Product
- Tickera
- Affected
- up to 3.5.5.6
- What to do
- Affects up to 3.5.5.6. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58610 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.1.
- Product
- Gallery PhotoBlocks
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Gallery PhotoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Latest Post Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58609 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Stored XSS.This issue affects Latest Post Shortcode: from n/a through <= 14.0.3.
- Product
- Latest Post Shortcode
- Affected
- up to 14.0.3
- What to do
- Affects up to 14.0.3. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025MediaPress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58608 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.
- Product
- MediaPress
- Affected
- up to 1.5.9.1
- What to do
- Affects up to 1.5.9.1. Update MediaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58607 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance: from n/a through <= 1.7.11.
- Product
- Cookie Notice & Consent Banner for GDPR & CCPA Compliance
- Affected
- up to 1.7.11
- What to do
- Affects up to 1.7.11. Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025SaasLauncher: Missing AuthorizationCVE-2025-58606 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.
- Product
- SaasLauncher
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update SaasLauncher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025WP Delicious: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58605 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.
- Product
- WP Delicious
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Mail Mint: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58604 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.5.
- Product
- Mail Mint
- Affected
- up to 1.18.5
- What to do
- Affects up to 1.18.5. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Surfer: Missing AuthorizationCVE-2025-58603 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.
- Product
- Surfer
- Affected
- up to 1.6.4.574
- What to do
- Affects up to 1.6.4.574. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58602 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.4.
- Product
- If-So Dynamic Content Personalization
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Classified Listing: Missing AuthorizationCVE-2025-58601 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.
- Product
- Classified Listing
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Paid Member Subscriptions: Missing AuthorizationCVE-2025-58600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.
- Product
- Paid Member Subscriptions
- Affected
- up to 2.15.9
- What to do
- Affects up to 2.15.9. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-58599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.
- Product
- Order Delivery Date for WooCommerce
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Klarna Order Management for WooCommerce: Insertion of Sensitive Information Into Debugging CodeCVE-2025-58598 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Insertion of Sensitive Information Into Debugging Code vulnerability in Klarna Klarna Order Management for WooCommerce klarna-order-management-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Klarna Order Management for WooCommerce: from n/a through <= 1.9.8.
- Product
- Klarna Order Management for WooCommerce
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Klarna Order Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2025-58597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.
- Product
- wpForo Forum
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025MailOptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58596 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through <= 1.2.75.0.
- Product
- MailOptin
- Affected
- up to 1.2.75.0
- What to do
- Affects up to 1.2.75.0. Update MailOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Brizy: Missing AuthorizationCVE-2025-58594 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.12.
- Product
- Brizy
- Affected
- up to 2.7.12
- What to do
- Affects up to 2.7.12. Update Brizy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Orbit Fox by ThemeIsle: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.
- Product
- Orbit Fox by ThemeIsle
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Orbit Fox by ThemeIsle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Malcure Malware Scanner: Missing AuthorizationCVE-2025-3701 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Malcure Malware Scanner: from n/a through <= 16.8.
- Product
- Malcure Malware Scanner
- Affected
- up to 16.8
- What to do
- Affects up to 16.8. Update Malcure Malware Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin forCVE-2025-9219 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_post_smtp_pro_option_callback' function in all versions up to, and including, 3.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable pro extensions.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2025Vayu Blocks – Website Builder for the Block Editor: Stored Cross-Site ScriptingCVE-2025-9378 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Vayu Blocks – Website Builder for the Block Editor
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Vayu Blocks – Website Builder for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2025Makeaholic: Missing AuthorizationCVE-2025-58210 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through <= 1.8.5.
- Product
- Makeaholic
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update Makeaholic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025RealHomes: Incorrect Privilege AssignmentCVE-2024-32444 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.3.6.
- Product
- RealHomes
- Affected
- up to 4.3.6
- What to do
- Affects up to 4.3.6. Update RealHomes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Sticky Side Buttons: Does not sanitise and escape some of its settingsCVE-2023-3666 · WordPress plugins & themes · reported by WPScanLow 3.3
The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Sticky Side Buttons
- Fixed in
- 2.0.0
- What to do
- Update Sticky Side Buttons to 2.0.0 or newer.
Sep 2, 2025Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: PHP Object InjectionCVE-2025-9260 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to read arbitrary files. If allow_url_include is enabled on the server, remote code execution is possible. While the vendor patched this issue in version 6.1.0, the patch caused a fatal error in the vulnerable code, due to a missing class import, so we consider 6.1.2 to be the most complete and best patched version
- Product
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- Affected
- 5.1.16 to 6.1.1
- What to do
- Affects 5.1.16 to 6.1.1. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2025Amministrazione Trasparente: Stored Cross-Site ScriptingCVE-2025-5083 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Amministrazione Trasparente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Amministrazione Trasparente
- Affected
- up to 9.0
- What to do
- Affects up to 9.0. Update Amministrazione Trasparente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025Blog Designer PRO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47696 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.
- Product
- Blog Designer PRO
- Affected
- up to 3.4.7
- What to do
- Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025School Management: Unrestricted Upload of File with Dangerous TypeCVE-2025-31100 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Mojoomla School Management allows Upload a Web Shell to a Web Server.This issue affects School Management: from n/a through 1.93.1 (02-07-2025).
- Product
- School Management
- Affected
- up to 1.93.1
- What to do
- Affects up to 1.93.1. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025Login with phone number: Missing AuthorizationCVE-2024-32832 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
- Product
- Login with phone number
- Affected
- up to 1.6.93
- What to do
- Affects up to 1.6.93. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025Barcode Scanner with Inventory & Order Manager: Missing AuthorizationCVE-2024-32589 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.
- Product
- Barcode Scanner with Inventory & Order Manager
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 30, 2025TablePress: Stored Cross-Site ScriptingCVE-2025-9500 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode_debug’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TablePress
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update TablePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2025Ocean Extra: Stored Cross-Site ScriptingCVE-2025-9499 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ocean Extra
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2025Related Posts Lite: Cross-Site Request ForgeryCVE-2025-9618 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Related Posts Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Related Posts Lite
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Related Posts Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 29, 2025Pro Bulk Watermark Plugin for: Path Traversal: '.../...//'CVE-2025-4956 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through 2.0.
- Product
- Pro Bulk Watermark Plugin for
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Pro Bulk Watermark Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2025Slider Revolution: Path TraversalCVE-2025-9217 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Slider Revolution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.7.36 via the 'used_svg' and 'used_images' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Slider Revolution
- Affected
- up to 6.7.36
- What to do
- Affects up to 6.7.36. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsliderrevolution.comwordfence.com
Aug 29, 2025Booster for WooCommerce: Arbitrary file uploadsCVE-2024-13342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.
- Product
- Booster for WooCommerce
- Affected
- up to 7.2.4
- What to do
- Affects up to 7.2.4. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2025Events Addon for Elementor: Stored Cross-Site ScriptingCVE-2025-8150 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Events Addon for Elementor
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Events Addon for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 29, 2025iATS Online Forms: Time-based SQL InjectionCVE-2025-9441 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The iATS Online Forms plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order' parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- iATS Online Forms
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update iATS Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 29, 2025Ultimate Tag Warrior Importer: Cross-Site Request ForgeryCVE-2025-9374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Tag Warrior Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to import tags granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ultimate Tag Warrior Importer
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Ultimate Tag Warrior Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Aug 29, 2025OSM Map Widget for Elementor: Stored Cross-Site ScriptingCVE-2025-8619 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map Block URL in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- OSM Map Widget for Elementor
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update OSM Map Widget for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2025List Subpages: Stored Cross-Site ScriptingCVE-2025-8290 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- List Subpages
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update List Subpages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.