Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

594 results · page 3 of 12

Nov 6, 2025Better Find and Replace – AI-Powered Suggestions: Unauthorized API usageCVE-2025-12360 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost.
Product
Better Find and Replace – AI-Powered Suggestions
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Better Find and Replace – AI-Powered Suggestions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025Ace User Management: Does not properly validate that a password reset token is associated with the user who requested itCVE-2025-6027 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticated users, such as subscriber to reset the password of arbitrary accounts, including administrators.
Product
Ace User Management
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Ace User Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 29, 2025Facebook for WooCommerce: Missing AuthorizationCVE-2025-64296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
Product
Facebook for WooCommerce
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Facebook for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2025Photospace Responsive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62899 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THRIVE - Web Design Gold Coast Photospace Responsive photospace-responsive allows Stored XSS.This issue affects Photospace Responsive: from n/a through <= 2.2.0.
Product
Photospace Responsive
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Photospace Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2025Find And Replace content for: Unauthorized Stored Cross-Site Scripting and Arbitrary Content ReplacementCVE-2025-10313 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the far_admin_ajax_fun() function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that can make privilege escalation and malicious redirects possible.
Product
Find And Replace content for
Affected
up to 1.1
What to do
Affects up to 1.1. Update Find And Replace content for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 11, 2025Enable Media Replace: Stored Cross-Site ScriptingCVE-2025-9496 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Enable Media Replace
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update Enable Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder: Missing authorizationCVE-2025-9029 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorization via the wdkit_handle_review_submission function in versions less than, or equal to, 1.2.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to submit feedback data to external services.
Product
WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
What to do
Update WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 30, 2025Survey Anyplace: Stored Cross-Site ScriptingCVE-2025-10196 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplace_embed' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Survey Anyplace
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Survey Anyplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Sep 22, 2025MasterStudy LMS: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2025-59577 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Product
MasterStudy LMS
Affected
up to 3.6.20
What to do
Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Nextend Facebook Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-connect allows Stored XSS.This issue affects Nextend Facebook Connect : from n/a through <= 3.1.19.
Product
Nextend Facebook Connect
Affected
up to 3.1.19
What to do
Affects up to 3.1.19. Update Nextend Facebook Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Better Find and Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53466 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Stored XSS.This issue affects Better Find and Replace: from n/a through <= 1.7.6.
Product
Better Find and Replace
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025REHub - Price Comparison, Multi Vendor Marketplace: Information ExposureCVE-2025-7368 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 19.9.7 via the 'ajax_action_re_getfullcontent' function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected posts that they should not have access to.
Product
REHub - Price Comparison, Multi Vendor Marketplace
Affected
up to 19.9.7
What to do
Affects up to 19.9.7. Update REHub - Price Comparison, Multi Vendor Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 5, 2025The REHub - Price Comparison, Multi Vendor Marketplace: Arbitrary shortcode executionCVE-2025-7366 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 19.9.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The REHub - Price Comparison, Multi Vendor Marketplace
Affected
up to 19.9.7
What to do
Affects up to 19.9.7. Update The REHub - Price Comparison, Multi Vendor Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 27, 2025Solace Extra: Server-Side Request Forgery (SSRF)CVE-2025-58203 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.2.
Product
Solace Extra
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Solace Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2025Real Spaces - WordPress Properties Directory: Privilege escalationCVE-2025-8218 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during a profile update.
Product
Real Spaces - WordPress Properties Directory
Affected
up to 3.5
What to do
Affects up to 3.5. Update Real Spaces - WordPress Properties Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 19, 2025Real Spaces - WordPress Properties Directory: Privilege escalationCVE-2025-6758 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during user registration.
Product
Real Spaces - WordPress Properties Directory
Affected
up to 3.6
What to do
Affects up to 3.6. Update Real Spaces - WordPress Properties Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 14, 2025CM On Demand Search And Replace: Cross-Site Request Forgery (CSRF)CVE-2025-54728 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Cross Site Request Forgery.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.
Product
CM On Demand Search And Replace
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025CM On Demand Search And Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54727 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Stored XSS.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.
Product
CM On Demand Search And Replace
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025myCred: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2025-54667 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Saad Iqbal myCred mycred allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.This issue affects myCred: from n/a through <= 2.9.4.3.
Product
myCred
Affected
up to 2.9.4.3
What to do
Affects up to 2.9.4.3. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025DigitalOcean Spaces Sync: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49047 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeross DigitalOcean Spaces Sync do-spaces-sync allows Stored XSS.This issue affects DigitalOcean Spaces Sync: from n/a through <= 2.2.1.
Product
DigitalOcean Spaces Sync
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update DigitalOcean Spaces Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Quiz and Survey Master (QSM): Does not have CSRF check in placeCVE-2025-6790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Product
Quiz and Survey Master (QSM)
Fixed in
10.2.3
What to do
Update Quiz and Survey Master (QSM) to 10.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 11, 2025CBX Restaurant Booking: Does not have CSRF check in placeCVE-2025-7965 · WordPress plugins & themes · reported by WPScanMedium 4.3
The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
CBX Restaurant Booking
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update CBX Restaurant Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 4, 2025LMSACE Connect: Missing AuthorizationCVE-2025-29007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LMSACE Connect: from n/a through <= 3.4.
Product
LMSACE Connect
Affected
up to 3.4
What to do
Affects up to 3.4. Update LMSACE Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025re.place: Cross-Site Request Forgery (CSRF)CVE-2025-53338 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dor re.place replace allows Stored XSS.This issue affects re.place: from n/a through <= 0.2.1.
Product
re.place
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update re.place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Add & Replace Affiliate Links for Amazon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53285 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Website Flip Add & Replace Affiliate Links for Amazon add-replace-affiliate-links-for-amazon allows Stored XSS.This issue affects Add & Replace Affiliate Links for Amazon: from n/a through <= 1.0.6.
Product
Add & Replace Affiliate Links for Amazon
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Add & Replace Affiliate Links for Amazon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 20, 2025TM Replace Howdy: Cross-Site Request Forgery (CSRF)CVE-2025-49972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace Howdy: from n/a through <= 1.4.2.
Product
TM Replace Howdy
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update TM Replace Howdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 12, 2025The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file typCVE-2025-5012 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreap_temp_upload_to_media' function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 12, 2025The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, aCVE-2025-4973 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an account with an email address. This makes it possible for unauthenticated attackers to log in as registered users, including administrators, if they know user's email address. This is only exploitable fi the user's confirmation_key has not already been set by the plugin.
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 6, 2025WC Vendors Marketplace: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49263 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WCVendors WC Vendors Marketplace wc-vendors allows Blind SQL Injection.This issue affects WC Vendors Marketplace: from n/a through <= 2.5.6.
Product
WC Vendors Marketplace
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update WC Vendors Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 4, 2025File Provider: Does not have CSRF check in placeCVE-2025-4580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
File Provider
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update File Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 23, 2025Acerola: Deserialization of Untrusted DataCVE-2025-31927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.
Product
Acerola
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Acerola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 17, 2025MultiVendorX – WooCommerce Multivendor Marketplace Solutions: Unauthorized loss of dataCVE-2025-4101 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary posts, pages, attachments, and products. The vulnerability was partially patched in version 4.2.22.
Product
MultiVendorX – WooCommerce Multivendor Marketplace Solutions
Affected
up to 4.2.22
What to do
Affects up to 4.2.22. Update MultiVendorX – WooCommerce Multivendor Marketplace Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2025Acerola: Missing AuthorizationCVE-2025-31066 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acerola: from n/a through <= 1.6.5.
Product
Acerola
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Acerola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025WP-PManager: Does not have CSRF check in placeCVE-2025-2247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
WP-PManager
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025WOOEXIM: Does not have CSRF check in some placesCVE-2025-1288 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack.
Product
WOOEXIM
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9711 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025EKC Tournament Manager: Does not have CSRF check in placeCVE-2024-9709 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
EKC Tournament Manager
Fixed in
2.2.2
What to do
Update EKC Tournament Manager to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Free Booking Plugin for Hotels, Restaurants and Car Rentals: Does not have CSRF check in placeCVE-2024-9450 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack
Product
Free Booking Plugin for Hotels, Restaurants and Car Rentals
Fixed in
1.3.15
What to do
Update Free Booking Plugin for Hotels, Restaurants and Car Rentals to 1.3.15 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Logo Slider: Does not have CSRF check in placeCVE-2024-9233 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Logo Slider
Fixed in
3.7.1
What to do
Update Logo Slider to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025Simple Nav Archives: Does not have CSRF check in placeCVE-2024-8398 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Simple Nav Archives
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Simple Nav Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025GamiPress: Does not have CSRF check in placeCVE-2024-8245 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
GamiPress
Fixed in
1.0.1
What to do
Update GamiPress to 1.0.1 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025BabelZ: Does not have CSRF check in some placesCVE-2024-8095 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
BabelZ
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update BabelZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Ntz Antispam: Does not have CSRF check in placeCVE-2024-8094 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Ntz Antispam
Affected
up to 2.0e
What to do
Affects up to 2.0e. Update Ntz Antispam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025JavaScript Logic: Does not have CSRF check in some placesCVE-2024-8090 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
JavaScript Logic
Affected
up to 0.1
What to do
Affects up to 0.1. Update JavaScript Logic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025PeoplePond: Does not have CSRF check in some placesCVE-2024-8085 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
PeoplePond
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update PeoplePond to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Widgets Reset: Does not have CSRF check in placeCVE-2024-8082 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Widgets Reset
Affected
up to 0.1
What to do
Affects up to 0.1. Update Widgets Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Custom Author Base: Does not have CSRF check in placeCVE-2024-8050 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Custom Author Base
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Custom Author Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Smooth Gallery Replacement: Does not have CSRF check in some placesCVE-2024-8032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Product
Smooth Gallery Replacement
Affected
up to 1.0
What to do
Affects up to 1.0. Update Smooth Gallery Replacement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Joy Of Text Lite: Does not have CSRF check in placeCVE-2024-7984 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Joy Of Text Lite
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Joy Of Text Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 15, 2025Offload Videos: Does not have CSRF check in placeCVE-2024-6719 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack
Product
Offload Videos
Fixed in
1.0.1
What to do
Update Offload Videos to 1.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.