Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

40,937 results · page 319 of 819

Jul 1, 2025Custom Login And Signup Widget: Improper Control of Generation of Code ('Code Injection')CVE-2025-49029 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through <= 1.0.
Product
Custom Login And Signup Widget
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Login And Signup Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 1, 2025Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: DOM-Based Reflected Cross-Site ScriptingCVE-2025-5314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
Affected
up to 2.3.65
What to do
Affects up to 2.3.65. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2025Ultra Addons for Contact Form 7: Stored Cross-Site ScriptingCVE-2025-6756 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultra Addons for Contact Form 7
Affected
up to 3.5.21
What to do
Affects up to 3.5.21. Update Ultra Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2025The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to CVE-2025-6934 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 30, 2025Contact Form: Does not sanitise and escape some of its settingsCVE-2025-5730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
Product
Contact Form
Fixed in
1.1.29
What to do
Update Contact Form to 1.1.29 or newer.
Full record and what to do →NVD record wpscan.com
Jun 30, 2025WP Lightbox 2: Does not correctly sanitize the value of the title attribute of links before using themCVE-2025-3745 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
Product
WP Lightbox 2
Fixed in
3.0.6.8
What to do
Update WP Lightbox 2 to 3.0.6.8 or newer.
Full record and what to do →NVD record wpscan.com
Jun 29, 2025EZ SQL Reports Shortcode Widget and DB Backup: Stored Cross-Site ScriptingCVE-2025-6462 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
EZ SQL Reports Shortcode Widget and DB Backup
Affected
up to 5.25.11
What to do
Affects up to 5.25.11. Update EZ SQL Reports Shortcode Widget and DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 28, 2025MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet: Cross-Site Request ForgeryCVE-2025-5937 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 28, 2025Game Users Share Buttons: Arbitrary file deletionCVE-2025-6755 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() function in all versions up to, and including, 1.3.0. This makes it possible for Subscriber-level attackers to add arbitrary file paths (such as ../../../../wp-config.php) to the themeNameId parameter of the AJAX request, which can lead to remote code execution.
Product
Game Users Share Buttons
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Game Users Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 28, 2025PT Project Notebooks: Privilege EscalationCVE-2025-5304 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
Product
PT Project Notebooks
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update PT Project Notebooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 28, 2025Qi Addons For Elementor: Stored Cross-Site ScriptingCVE-2025-6252 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Qi Addons For Elementor
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Qi Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 28, 2025BeeTeam368 Extensions: Directory TraversalCVE-2025-6381 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_remove_temp_file() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.
Product
BeeTeam368 Extensions
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update BeeTeam368 Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 28, 2025BeeTeam368 Extensions Pro: Directory TraversalCVE-2025-6379 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_live_fn() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.
Product
BeeTeam368 Extensions Pro
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update BeeTeam368 Extensions Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jun 28, 2025WP VR – 360 Panorama and Free Virtual Tour Builder For: Stored Cross-Site ScriptingCVE-2025-6350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP VR – 360 Panorama and Free Virtual Tour Builder For
Affected
up to 8.5.32
What to do
Affects up to 8.5.32. Update WP VR – 360 Panorama and Free Virtual Tour Builder For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2025Devnex Addons For Elementor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53339 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in devnex Devnex Addons For Elementor devnex-addons-for-elementor allows PHP Local File Inclusion.This issue affects Devnex Addons For Elementor: from n/a through <= 1.0.9.
Product
Devnex Addons For Elementor
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Devnex Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025re.place: Cross-Site Request Forgery (CSRF)CVE-2025-53338 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dor re.place replace allows Stored XSS.This issue affects re.place: from n/a through <= 0.2.1.
Product
re.place
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update re.place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025My Resume Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53336 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in abditsori My Resume Builder my-resume-builder allows Stored XSS.This issue affects My Resume Builder: from n/a through <= 1.0.3.
Product
My Resume Builder
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update My Resume Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Track Everything: Cross-Site Request Forgery (CSRF)CVE-2025-53332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ethoseo Track Everything track-everything allows Stored XSS.This issue affects Track Everything: from n/a through <= 2.0.1.
Product
Track Everything
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Track Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025RSS Digest: Cross-Site Request Forgery (CSRF)CVE-2025-53331 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in samcharrington RSS Digest rss-digest allows Stored XSS.This issue affects RSS Digest: from n/a through <= 1.5.
Product
RSS Digest
Affected
up to 1.5
What to do
Affects up to 1.5. Update RSS Digest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Społecznościowa 6 PL 2013: Cross-Site Request Forgery (CSRF)CVE-2025-53329 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in szajenw Społecznościowa 6 PL 2013 spolecznosciowa-6-pl-2013 allows Stored XSS.This issue affects Społecznościowa 6 PL 2013: from n/a through <= 2.0.6.
Product
Społecznościowa 6 PL 2013
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Społecznościowa 6 PL 2013 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Aioseo Multibyte Descriptions: Cross-Site Request Forgery (CSRF)CVE-2025-53327 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in rui_mashita Aioseo Multibyte Descriptions aioseo-multibyte-descriptions allows Cross Site Request Forgery.This issue affects Aioseo Multibyte Descriptions: from n/a through <= 0.0.6.
Product
Aioseo Multibyte Descriptions
Affected
up to 0.0.6
What to do
Affects up to 0.0.6. Update Aioseo Multibyte Descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Beauty Contact Popup Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53325 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dilip kumar Beauty Contact Popup Form beauty-contact-popup-form allows Stored XSS.This issue affects Beauty Contact Popup Form: from n/a through <= 6.0.
Product
Beauty Contact Popup Form
Affected
up to 6.0
What to do
Affects up to 6.0. Update Beauty Contact Popup Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Pre-Publish Post Checklist: Missing AuthorizationCVE-2025-53323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pre-Publish Post Checklist: from n/a through <= 3.1.
Product
Pre-Publish Post Checklist
Affected
up to 3.1
What to do
Affects up to 3.1. Update Pre-Publish Post Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Accept Authorize.NET Payments Using Contact Form 7: Insertion of Sensitive Information Into Sent DataCVE-2025-53322 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 accept-authorize-net-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Authorize.NET Payments Using Contact Form 7: from n/a through <= 2.5.
Product
Accept Authorize.NET Payments Using Contact Form 7
Affected
up to 2.5
What to do
Affects up to 2.5. Update Accept Authorize.NET Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Raise The Money: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53321 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raise The Money Raise The Money raise-the-money allows DOM-Based XSS.This issue affects Raise The Money: from n/a through <= 5.2.
Product
Raise The Money
Affected
up to 5.2
What to do
Affects up to 5.2. Update Raise The Money to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Free Downloads EDD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53320 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This issue affects Free Downloads EDD: from n/a through 1.0.4.
Product
Free Downloads EDD
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Free Downloads EDD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WP DB Booster: Missing AuthorizationCVE-2025-53318 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPManiax WP DB Booster wp-db-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP DB Booster: from n/a through <= 1.0.1.
Product
WP DB Booster
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP DB Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WPShapere - WordPress admin: Cross-Site Request Forgery (CSRF)CVE-2025-53317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in AcmeeDesign WPShapere - WordPress admin theme wpshapere-lite allows Stored XSS.This issue affects WPShapere - WordPress admin theme: from n/a through <= 1.4.1.
Product
WPShapere - WordPress admin
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update WPShapere - WordPress admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Relocate Upload: Cross-Site Request Forgery (CSRF)CVE-2025-53315 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alanft Relocate Upload relocate-upload allows Stored XSS.This issue affects Relocate Upload: from n/a through <= 0.24.1.
Product
Relocate Upload
Affected
up to 0.24.1
What to do
Affects up to 0.24.1. Update Relocate Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WP Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-53314 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2.5.0.
Product
WP Optimizer
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Twitch TV Embed Suite: Cross-Site Request Forgery (CSRF)CVE-2025-53313 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Twitch TV Embed Suite twitch-tv-embed-suite allows Stored XSS.This issue affects Twitch TV Embed Suite: from n/a through <= 2.1.0.
Product
Twitch TV Embed Suite
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Twitch TV Embed Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025OnionBuzz: Cross-Site Request Forgery (CSRF)CVE-2025-53312 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Looks Awesome OnionBuzz onionbuzz-viral-quiz allows Stored XSS.This issue affects OnionBuzz: from n/a through <= 1.0.7.
Product
OnionBuzz
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update OnionBuzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Navayan Subscribe: Cross-Site Request Forgery (CSRF)CVE-2025-53311 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Amol Nirmala Waman Navayan Subscribe navayan-subscribe allows Stored XSS.This issue affects Navayan Subscribe: from n/a through <= 1.13.
Product
Navayan Subscribe
Affected
up to 1.13
What to do
Affects up to 1.13. Update Navayan Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025HidePost: Cross-Site Request Forgery (CSRF)CVE-2025-53310 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Funnnny HidePost hidepost allows Reflected XSS.This issue affects HidePost: from n/a through <= 2.3.8.
Product
HidePost
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update HidePost to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Accept Stripe Payments Using Contact Form 7: Insertion of Sensitive Information Into Sent DataCVE-2025-53309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Stripe Payments Using Contact Form 7 accept-stripe-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Stripe Payments Using Contact Form 7: from n/a through <= 3.0.
Product
Accept Stripe Payments Using Contact Form 7
Affected
up to 3.0
What to do
Affects up to 3.0. Update Accept Stripe Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Image Slider With Description: Cross-Site Request Forgery (CSRF)CVE-2025-53308 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in gopi_plus Image Slider With Description image-slider-with-description allows Stored XSS.This issue affects Image Slider With Description: from n/a through <= 9.2.
Product
Image Slider With Description
Affected
up to 9.2
What to do
Affects up to 9.2. Update Image Slider With Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WP Forum Server: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-53306 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in lucidcrew WP Forum Server forum-server allows SQL Injection.This issue affects WP Forum Server: from n/a through <= 1.8.2.
Product
WP Forum Server
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update WP Forum Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WP Forum Server: Cross-Site Request Forgery (CSRF)CVE-2025-53305 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in lucidcrew WP Forum Server forum-server allows Stored XSS.This issue affects WP Forum Server: from n/a through <= 1.8.2.
Product
WP Forum Server
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update WP Forum Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Contact Form – 7 : Hide Success Message: Missing AuthorizationCVE-2025-53304 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form – 7 : Hide Success Message: from n/a through <= 1.1.4.
Product
Contact Form – 7 : Hide Success Message
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Contact Form – 7 : Hide Success Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Theme Junkie Team Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53301 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Junkie Theme Junkie Team Content theme-junkie-team-content allows DOM-Based XSS.This issue affects Theme Junkie Team Content: from n/a through <= 0.1.1.
Product
Theme Junkie Team Content
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Theme Junkie Team Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Podcast Feed Player Widget and Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53300 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr Podcast Feed Player Widget and Shortcode podcast-feed-player-widget allows Stored XSS.This issue affects Podcast Feed Player Widget and Shortcode: from n/a through <= 2.2.0.
Product
Podcast Feed Player Widget and Shortcode
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Podcast Feed Player Widget and Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Plugin Inspector: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-53298 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gioni Plugin Inspector plugin-inspector allows Path Traversal.This issue affects Plugin Inspector: from n/a through <= 1.5.
Product
Plugin Inspector
Affected
up to 1.5
What to do
Affects up to 1.5. Update Plugin Inspector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025EC Stars Rating: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53296 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ecoal95 EC Stars Rating ec-stars-rating allows Stored XSS.This issue affects EC Stars Rating: from n/a through <= 1.0.11.
Product
EC Stars Rating
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update EC Stars Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025iCount Payment Gateway: Missing AuthorizationCVE-2025-53295 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through <= 2.0.7.
Product
iCount Payment Gateway
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update iCount Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Smart Agenda: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53294 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vous-en-ligne allows Stored XSS.This issue affects Smart Agenda: from n/a through <= 4.9.
Product
Smart Agenda
Affected
up to 4.9
What to do
Affects up to 4.9. Update Smart Agenda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Dashboard Widget Sidebar: Missing AuthorizationCVE-2025-53293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through <= 1.2.3.
Product
Dashboard Widget Sidebar
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Dashboard Widget Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WP DataTable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53292 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk WP DataTable wp-datatable allows DOM-Based XSS.This issue affects WP DataTable: from n/a through <= 0.2.7.
Product
WP DataTable
Affected
up to 0.2.7
What to do
Affects up to 0.2.7. Update WP DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025WP Visual Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53290 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MS WP Visual Sitemap wp-visual-sitemap allows Stored XSS.This issue affects WP Visual Sitemap: from n/a through <= 1.0.2.
Product
WP Visual Sitemap
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Visual Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025PlatiOnline Payments: Missing AuthorizationCVE-2025-53288 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlatiOnline Payments: from n/a through <= 7.0.0.
Product
PlatiOnline Payments
Affected
up to 7.0.0
What to do
Affects up to 7.0.0. Update PlatiOnline Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Quick Favicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53287 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored XSS.This issue affects Quick Favicon: from n/a through <= 0.22.8.
Product
Quick Favicon
Affected
up to 0.22.8
What to do
Affects up to 0.22.8. Update Quick Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.