Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
471 results · page 3 of 10
Jan 23, 2026PopCash.Net Code Integration Tool: Missing AuthorizationCVE-2026-24619 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PopCash PopCash.Net Code Integration Tool popcashnet-code-integration-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PopCash.Net Code Integration Tool: from n/a through <= 1.8.
- Product
- PopCash.Net Code Integration Tool
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update PopCash.Net Code Integration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Bayarcash WooCommerce: Missing AuthorizationCVE-2026-24606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.
- Product
- Bayarcash WooCommerce
- Affected
- up to 4.3.13
- What to do
- Affects up to 4.3.13. Update Bayarcash WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Rashy: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69043 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Rashy rashy allows PHP Local File Inclusion.This issue affects Rashy: from n/a through <= 1.1.3.
- Product
- Rashy
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Rashy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Payment Gateway bKash for WC: Missing AuthorizationCVE-2025-62754 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway bKash for WC: from n/a through <= 3.1.0.
- Product
- Payment Gateway bKash for WC
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Payment Gateway bKash for WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2026Netcash WooCommerce Payment Gateway: Unauthorized modification of dataCVE-2025-14880 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_return_url function in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processing/completed.
- Product
- Netcash WooCommerce Payment Gateway
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Netcash WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 14, 2026DASHBOARD BUILDER – WordPress plugin for Charts and Graphs: Cross-Site Request ForgeryCVE-2025-14615 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.7. This is due to missing nonce validation on the settings handler in dashboardbuilder-admin.php. This makes it possible for unauthenticated attackers to modify the stored SQL query and database credentials used by the [show-dashboardbuilder] shortcode via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The modified SQL query is subsequently executed on the front-end when the shortcode is rendered, enabling arbitrary SQL injection and data exfiltration through the publicly visible chart output.
- Product
- DASHBOARD BUILDER – WordPress plugin for Charts and Graphs
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update DASHBOARD BUILDER – WordPress plugin for Charts and Graphs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2026Dashboard Welcome for Beaver Builder: Missing AuthorizationCVE-2026-22488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Welcome for Beaver Builder: from n/a through <= 1.0.8.
- Product
- Dashboard Welcome for Beaver Builder
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Dashboard Welcome for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026Flashcard: Path TraversalCVE-2025-14867 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Flashcard
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Flashcard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2026ShareThis Dashboard for Google Analytics: Sensitive Information ExposureCVE-2025-12540 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to craft a link to the sharethis.com server, which will share an authorization token for Google Analytics with a malicious website, if the attacker can trick an administrator logged into the website and Google Analytics to click the link.
- Product
- ShareThis Dashboard for Google Analytics
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2026Logo Slider: Does not validate and escape some of its slider options before outputting them back in the dashboardCVE-2025-13153 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Logo Slider WordPress plugin before 4.9.0 does not validate and escape some of its slider options before outputting them back in the dashboard, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Logo Slider
- Fixed in
- 4.9.0
- What to do
- Update Logo Slider to 4.9.0 or newer.
Dec 31, 2025Dashboard Beacon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49337 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janhenckens Dashboard Beacon wp-dashboard-beacon allows Stored XSS.This issue affects Dashboard Beacon: from n/a through <= 1.2.0.
- Product
- Dashboard Beacon
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Dashboard Beacon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Trash Duplicate and 301 Redirect: Missing AuthorizationCVE-2025-62122 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in solwininfotech Trash Duplicate and 301 Redirect trash-duplicate-and-301-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trash Duplicate and 301 Redirect: from n/a through <= 1.9.1.
- Product
- Trash Duplicate and 301 Redirect
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Trash Duplicate and 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Sticky Notes for WP Dashboard: Missing AuthorizationCVE-2025-62087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.
- Product
- Sticky Notes for WP Dashboard
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Sticky Notes for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025OnLeash: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60054 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes OnLeash onleash allows PHP Local File Inclusion.This issue affects OnLeash: from n/a through <= 1.5.2.
- Product
- OnLeash
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update OnLeash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025The Flash: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58888 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes The Flash theflash allows PHP Local File Inclusion.This issue affects The Flash: from n/a through <= 1.15.
- Product
- The Flash
- Affected
- up to 1.15
- What to do
- Affects up to 1.15. Update The Flash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Smash: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53443 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Smash smash allows PHP Local File Inclusion.This issue affects Smash: from n/a through <= 1.7.
- Product
- Smash
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Smash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Get Cash: Missing AuthorizationCVE-2025-49041 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in The African Boss Get Cash get-cash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Get Cash: from n/a through <= 3.2.3.
- Product
- Get Cash
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Get Cash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2025Download Plugins and Themes in ZIP from Dashboard: Cross-Site Request ForgeryCVE-2025-14399 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.6. This is due to missing or incorrect nonce validation on the download_plugin_bulk and download_theme_bulk functions. This makes it possible for unauthenticated attackers to archive all the sites plugins and themes and place them in the `wp-content/uploads/` directory via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Download Plugins and Themes in ZIP from Dashboard
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Download Plugins and Themes in ZIP from Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 16, 2025Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Unauthorized access of dataCVE-2025-13741 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAuthors function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve emails for all users with edit_posts capability.
- Product
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- Affected
- up to 4.9.2
- What to do
- Affects up to 4.9.2. Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 11, 2025LT Unleashed: Local File InclusionCVE-2025-13886 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LT Unleashed plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'template' parameter in the `book` shortcode due to insufficient path sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files such as wp-config.php can be included.
- Product
- LT Unleashed
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update LT Unleashed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025Fashion: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67529 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opal_WP Fashion fashion2 allows PHP Local File Inclusion.This issue affects Fashion: from n/a through < 5.3.0.
- Product
- Fashion
- What to do
- Update Fashion to the newest version.
Dec 9, 2025WP Flashy Marketing Automation: Cross-Site Request Forgery (CSRF)CVE-2025-62873 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Flashyapp WP Flashy Marketing Automation wp-flashy-marketing-automation allows Cross Site Request Forgery.This issue affects WP Flashy Marketing Automation: from n/a through <= 2.0.8.
- Product
- WP Flashy Marketing Automation
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update WP Flashy Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 25, 2025Chamber Dashboard Business Directory: Unauthorized data exportCVE-2025-13414 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information, including sensitive business details.
- Product
- Chamber Dashboard Business Directory
- Affected
- up to 3.3.11
- What to do
- Affects up to 3.3.11. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Unauthorized modification of dataCVE-2025-13149 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.
- Product
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Nov 21, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2025-11815 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected.
- Product
- UiPress lite | Effortless custom dashboards, admin themes and pages
- Affected
- up to 3.5.08
- What to do
- Affects up to 3.5.08. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2025-11003 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_ui_template' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to save templates that contain custom JavaScript.
- Product
- UiPress lite | Effortless custom dashboards, admin themes and pages
- Affected
- up to 3.5.09
- What to do
- Affects up to 3.5.09. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 13, 2025Angel – Fashion Model Agency WordPress CMS: Stored Cross-Site Scripting the profile media uploaderCVE-2025-10295 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Angel – Fashion Model Agency WordPress CMS Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting the profile media uploader in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the user has access to the edit profile form with the media upload option.
- Product
- Angel – Fashion Model Agency WordPress CMS
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Angel – Fashion Model Agency WordPress CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 26, 2025Did Prestashop Display: Cross-Site Request Forgery (CSRF)CVE-2025-62945 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Eduard Pinuaga Linares Did Prestashop Display did-prestashop-display allows Stored XSS.This issue affects Did Prestashop Display: from n/a through <= 1.0.30.
- Product
- Did Prestashop Display
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Did Prestashop Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Smash Balloon Social Post Feed: Missing AuthorizationCVE-2025-49937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.
- Product
- Smash Balloon Social Post Feed
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Smash Balloon Social Post Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025WP Dashboard Chat: SQL InjectionCVE-2025-10660 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Dashboard Chat
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WP Dashboard Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2025Course Redirects for Learndash: Cross-Site Request ForgeryCVE-2025-10376 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to missing nonce validation when processing form submissions on the settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Course Redirects for Learndash
- Affected
- up to 0.4
- What to do
- Affects up to 0.4. Update Course Redirects for Learndash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 26, 2025System Dashboard: Cross-Site Request ForgeryCVE-2025-10377 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The System Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.20. This is due to missing nonce validation on the sd_toggle_logs() function. This makes it possible for unauthenticated attackers to toggle critical logging settings including Page Access Logs, Error Logs, and Email Delivery Logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- System Dashboard
- Affected
- up to 2.8.20
- What to do
- Affects up to 2.8.20. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.3.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.3
- What to do
- Affects up to 3.7.0.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Dashboard Notepad: Cross-Site Request Forgery (CSRF)CVE-2025-57927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stephanie Leary Dashboard Notepad dashboard-notepad allows Cross Site Request Forgery.This issue affects Dashboard Notepad: from n/a through <= 1.42.
- Product
- Dashboard Notepad
- Affected
- up to 1.42
- What to do
- Affects up to 1.42. Update Dashboard Notepad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Goracash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53458 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davaxi Goracash goracash allows Stored XSS.This issue affects Goracash: from n/a through <= 1.1.
- Product
- Goracash
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Goracash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CashBill.pl – Płatności WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53455 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CashBill CashBill.pl – Płatności WooCommerce cashbill-payment-method allows Stored XSS.This issue affects CashBill.pl – Płatności WooCommerce: from n/a through <= 3.2.1.
- Product
- CashBill.pl – Płatności WooCommerce
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update CashBill.pl – Płatności WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Material Dashboard: Weak Password Recovery Mechanism for Forgotten PasswordCVE-2025-32486 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: from n/a through <= 1.4.6.
- Product
- Material Dashboard
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Easy Flash Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48105 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed easy-flash-embed allows Stored XSS.This issue affects Easy Flash Embed: from n/a through <= 1.0.
- Product
- Easy Flash Embed
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Flash Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Get Cash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58823 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The African Boss Get Cash get-cash allows Stored XSS.This issue affects Get Cash: from n/a through <= 3.2.3.
- Product
- Get Cash
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Get Cash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ultimate Client Dash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58811 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows Stored XSS.This issue affects Ultimate Client Dash: from n/a through <= 4.7.
- Product
- Ultimate Client Dash
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update Ultimate Client Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025Risk Free Cash On Delivery (COD) – WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48358 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommerce risk-free-cash-on-delivery-cod-woocommerce allows Stored XSS.This issue affects Risk Free Cash On Delivery (COD) – WooCommerce: from n/a through <= 1.0.4.
- Product
- Risk Free Cash On Delivery (COD) – WooCommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Risk Free Cash On Delivery (COD) – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025Kento Splash Screen: Cross-Site Request Forgery (CSRF)CVE-2025-48351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in PluginsPoint Kento Splash Screen kento-splash-screen allows Stored XSS.This issue affects Kento Splash Screen: from n/a through <= 1.4.
- Product
- Kento Splash Screen
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Kento Splash Screen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025SureDash: Incorrect Privilege AssignmentCVE-2025-48164 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <= 1.0.3.
- Product
- SureDash
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025SureDash: Insertion of Sensitive Information Into Sent DataCVE-2025-54685 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash suredash allows Retrieve Embedded Sensitive Data.This issue affects SureDash: from n/a through <= 1.1.0.
- Product
- SureDash
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Geo Mashup: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48293 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows PHP Local File Inclusion.This issue affects Geo Mashup: from n/a through <= 1.13.16.
- Product
- Geo Mashup
- Affected
- up to 1.13.16
- What to do
- Affects up to 1.13.16. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2025Qwizcards | online quizzes and flashcards: Does not sanitise and escape the "_stylesheet" parameter before outputting it back in the pageCVE-2025-6174 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.
- Product
- Qwizcards | online quizzes and flashcards
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update Qwizcards | online quizzes and flashcards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 22, 2025YANewsflash: Cross-Site Request ForgeryCVE-2025-6054 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The YANewsflash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the 'yanewsflash/yanewsflash.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- YANewsflash
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update YANewsflash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 22, 2025Featured Image Plus – Quick & Bulk Edit with Unsplash: Server-Side Request ForgeryCVE-2025-5818 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fip_get_image_options() function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Featured Image Plus – Quick & Bulk Edit with Unsplash
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Featured Image Plus – Quick & Bulk Edit with Unsplash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2025Dashboard Widget Sidebar: Missing AuthorizationCVE-2025-53293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through <= 1.2.3.
- Product
- Dashboard Widget Sidebar
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Dashboard Widget Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2025Namasha By Mdesign: Stored Cross-Site ScriptingCVE-2025-6537 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions up to, and including, 1.2.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Namasha By Mdesign
- Affected
- up to 1.2.00
- What to do
- Affects up to 1.2.00. Update Namasha By Mdesign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.