Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,221 results · page 32 of 85
Mar 27, 20253DPrint Lite: Cross-Site Request Forgery (CSRF)CVE-2025-30865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in fuzzoid 3DPrint Lite 3dprint-lite allows Cross Site Request Forgery.This issue affects 3DPrint Lite: from n/a through <= 2.1.3.5.
- Product
- 3DPrint Lite
- Affected
- up to 2.1.3.5
- What to do
- Affects up to 2.1.3.5. Update 3DPrint Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2025-30863 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-contact-form-7-and-google-sheets allows Cross Site Request Forgery.This issue affects Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.0.9.
- Product
- Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025reCAPTCHA for all: Cross-Site Request Forgery (CSRF)CVE-2025-30862 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA for all: from n/a through <= 2.22.
- Product
- reCAPTCHA for all
- Affected
- up to 2.22
- What to do
- Affects up to 2.22. Update reCAPTCHA for all to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Currency Switcher for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-30857 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in PressMaximum Currency Switcher for WooCommerce currency-switcher-for-woocommerce allows Stored XSS.This issue affects Currency Switcher for WooCommerce: from n/a through <= 0.0.7.
- Product
- Currency Switcher for WooCommerce
- Affected
- up to 0.0.7
- What to do
- Affects up to 0.0.7. Update Currency Switcher for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Custom Field For WP Job Manager: Cross-Site Request Forgery (CSRF)CVE-2025-30856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Cross Site Request Forgery.This issue affects Custom Field For WP Job Manager: from n/a through <= 1.4.
- Product
- Custom Field For WP Job Manager
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Custom Field For WP Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Serial Codes Generator and Validator with WooCommerce Support: Cross-Site Request Forgery (CSRF)CVE-2025-30854 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Cross Site Request Forgery.This issue affects Serial Codes Generator and Validator with WooCommerce Support: from n/a through <= 2.7.7.
- Product
- Serial Codes Generator and Validator with WooCommerce Support
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update Serial Codes Generator and Validator with WooCommerce Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Christmas Panda: Cross-Site Request Forgery (CSRF)CVE-2025-30842 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in pixolette Christmas Panda christmas-panda allows Cross Site Request Forgery.This issue affects Christmas Panda: from n/a through <= 1.0.4.
- Product
- Christmas Panda
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Christmas Panda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Verge3D: Cross-Site Request Forgery (CSRF)CVE-2025-30833 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.8.2.
- Product
- Verge3D
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Anthologize: Cross-Site Request Forgery (CSRF)CVE-2025-30823 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from n/a through <= 0.8.2.
- Product
- Anthologize
- Affected
- up to 0.8.2
- What to do
- Affects up to 0.8.2. Update Anthologize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Custom Login Logo: Cross-Site Request Forgery (CSRF)CVE-2025-30822 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hakik Zaman Custom Login Logo ideal-wp-login-logo-changer allows Cross Site Request Forgery.This issue affects Custom Login Logo: from n/a through <= 1.1.7.
- Product
- Custom Login Logo
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Custom Login Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025publish post email notification: Cross-Site Request Forgery (CSRF)CVE-2025-30816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This issue affects publish post email notification: from n/a through <= 1.0.2.3.
- Product
- publish post email notification
- Affected
- up to 1.0.2.3
- What to do
- Affects up to 1.0.2.3. Update publish post email notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Hesabfa Accounting: Cross-Site Request Forgery (CSRF)CVE-2025-30815 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affects Hesabfa Accounting: from n/a through <= 2.1.8.
- Product
- Hesabfa Accounting
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Hesabfa Accounting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025ValidateCertify: Cross-Site Request Forgery (CSRF)CVE-2025-30811 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.1.
- Product
- ValidateCertify
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update ValidateCertify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Flexible Cookies: Cross-Site Request Forgery (CSRF)CVE-2025-30805 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cookies: from n/a through <= 1.1.8.
- Product
- Flexible Cookies
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Flexible Cookies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025wpShopGermany IT-RECHT KANZLEI: Cross-Site Request Forgery (CSRF)CVE-2025-30804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in maennchen1.de wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei allows Cross Site Request Forgery.This issue affects wpShopGermany IT-RECHT KANZLEI: from n/a through <= 2.0.
- Product
- wpShopGermany IT-RECHT KANZLEI
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update wpShopGermany IT-RECHT KANZLEI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025TWB Woocommerce Reviews: Cross-Site Request Forgery (CSRF)CVE-2025-30801 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews twb-woocommerce-reviews allows Cross Site Request Forgery.This issue affects TWB Woocommerce Reviews: from n/a through <= 1.7.7.
- Product
- TWB Woocommerce Reviews
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update TWB Woocommerce Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025EZ SQL Reports Shortcode Widget and DB Backup: Cross-Site Request Forgery (CSRF)CVE-2025-30788 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows SQL Injection.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.25.08.
- Product
- EZ SQL Reports Shortcode Widget and DB Backup
- Affected
- up to 5.25.08
- What to do
- Affects up to 5.25.08. Update EZ SQL Reports Shortcode Widget and DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025EZ SQL Reports Shortcode Widget and DB Backup: Cross-Site Request Forgery (CSRF)CVE-2025-30787 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.25.08.
- Product
- EZ SQL Reports Shortcode Widget and DB Backup
- Affected
- up to 5.25.08
- What to do
- Affects up to 5.25.08. Update EZ SQL Reports Shortcode Widget and DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WP Google Review Slider: Cross-Site Request Forgery (CSRF)CVE-2025-30783 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through <= 16.0.
- Product
- WP Google Review Slider
- Affected
- up to 16.0
- What to do
- Affects up to 16.0. Update WP Google Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WIP WooCarousel Lite: Cross-Site Request Forgery (CSRF)CVE-2025-30769 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alexvtn WIP WooCarousel Lite wip-woocarousel-lite allows Stored XSS.This issue affects WIP WooCarousel Lite: from n/a through <= 1.1.7.
- Product
- WIP WooCarousel Lite
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update WIP WooCarousel Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Football Pool: Cross-Site Request Forgery (CSRF)CVE-2025-30764 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool football-pool allows Cross Site Request Forgery.This issue affects Football Pool: from n/a through <= 2.12.2.
- Product
- Football Pool
- Affected
- up to 2.12.2
- What to do
- Affects up to 2.12.2. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Product Import Export for WooCommerce – Import Export Product CSV Suite: Server-Side Request ForgeryCVE-2025-1912 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Product Import Export for WooCommerce – Import Export Product CSV Suite
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Product Import Export for WooCommerce – Import Export Product CSV Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2025Zapier for: Server-Side Request ForgeryCVE-2024-13411 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
- Product
- Zapier for
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Zapier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2025WP Compress – Instant Performance & Speed Optimization: Server-Side Request ForgeryCVE-2025-2109 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
- Product
- WP Compress – Instant Performance & Speed Optimization
- Affected
- up to 6.30.15
- What to do
- Affects up to 6.30.15. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2025EZ SQL Reports Shortcode Widget and DB Backup: Cross-Site Request ForgeryCVE-2025-2319 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due to missing or incorrect nonce validation on the 'ELISQLREPORTS_menu' function. This makes it possible for unauthenticated attackers to execute code on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Version 5.25.10 adds a nonce check, which makes this vulnerability exploitable by admins only.
- Product
- EZ SQL Reports Shortcode Widget and DB Backup
- Affected
- 4.11.13 to 5.25.08
- What to do
- Affects 4.11.13 to 5.25.08. Update EZ SQL Reports Shortcode Widget and DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2025Estatebud – Properties & Listings: Cross-Site Request ForgeryCVE-2024-13710 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due to missing or incorrect nonce validation on the 'estatebud_settings' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Estatebud – Properties & Listings
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update Estatebud – Properties & Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Mar 25, 2025teachPress: Cross-Site Request ForgeryCVE-2025-1320 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrect nonce validation on the import.php page. This makes it possible for unauthenticated attackers to delete imports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- teachPress
- Affected
- up to 9.0.9
- What to do
- Affects up to 9.0.9. Update teachPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 24, 2025Translator: Cross-Site Request Forgery (CSRF)CVE-2025-30621 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in kornelly Translator translator allows Stored XSS.This issue affects Translator: from n/a through <= 0.3.
- Product
- Translator
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025WP Odoo Form Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-30620 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator wp-odoo-form-integrator allows Stored XSS.This issue affects WP Odoo Form Integrator: from n/a through <= 1.1.0.
- Product
- WP Odoo Form Integrator
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WP Odoo Form Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025SpeakPipe: Cross-Site Request Forgery (CSRF)CVE-2025-30619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SpeakPipe SpeakPipe speakpipe-voicemail-for-websites allows Cross Site Request Forgery.This issue affects SpeakPipe: from n/a through <= 0.2.
- Product
- SpeakPipe
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update SpeakPipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Rewrite: Cross-Site Request Forgery (CSRF)CVE-2025-30617 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in takien Rewrite rewrite allows Cross Site Request Forgery.This issue affects Rewrite: from n/a through <= 0.2.1.
- Product
- Rewrite
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update Rewrite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025WP e-Commerce Style Email: Cross-Site Request Forgery (CSRF)CVE-2025-30615 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
- Product
- WP e-Commerce Style Email
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Replace Default Words: Cross-Site Request Forgery (CSRF)CVE-2025-30612 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words replace-default-words allows Stored XSS.This issue affects Replace Default Words: from n/a through <= 1.3.
- Product
- Replace Default Words
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Replace Default Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025WordPress SQL Backup: Cross-Site Request Forgery (CSRF)CVE-2025-30608 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Anthony WordPress SQL Backup wordpress-sql-backup allows Stored XSS.This issue affects WordPress SQL Backup: from n/a through <= 3.5.2.
- Product
- WordPress SQL Backup
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update WordPress SQL Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025CopyLink: Cross-Site Request Forgery (CSRF)CVE-2025-30603 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink copy-link allows Stored XSS.This issue affects CopyLink: from n/a through <= 1.1.
- Product
- CopyLink
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CopyLink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Flipdish Ordering System: Cross-Site Request Forgery (CSRF)CVE-2025-30601 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System flipdish-ordering-system allows Cross Site Request Forgery.This issue affects Flipdish Ordering System: from n/a through <= 1.5.2.
- Product
- Flipdish Ordering System
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Flipdish Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025OSS Upload: Cross-Site Request Forgery (CSRF)CVE-2025-30598 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Link OSS Upload oss-upload allows Cross Site Request Forgery.This issue affects OSS Upload: from n/a through <= 4.8.9.
- Product
- OSS Upload
- Affected
- up to 4.8.9
- What to do
- Affects up to 4.8.9. Update OSS Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Map Contact: Cross-Site Request Forgery (CSRF)CVE-2025-30588 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through <= 3.0.4.
- Product
- Map Contact
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Map Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025LH OGP Meta: Cross-Site Request Forgery (CSRF)CVE-2025-30587 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <= 1.73.
- Product
- LH OGP Meta
- Affected
- up to 1.73
- What to do
- Affects up to 1.73. Update LH OGP Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025cTabs: Cross-Site Request Forgery (CSRF)CVE-2025-30586 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through <= 1.3.
- Product
- cTabs
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update cTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Generate Post Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-30585 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue affects Generate Post Thumbnails: from n/a through <= 0.8.
- Product
- Generate Post Thumbnails
- Affected
- up to 0.8
- What to do
- Affects up to 0.8. Update Generate Post Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025AlphaOmega Captcha & Anti-Spam Filter: Cross-Site Request Forgery (CSRF)CVE-2025-30584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.
- Product
- AlphaOmega Captcha & Anti-Spam Filter
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update AlphaOmega Captcha & Anti-Spam Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Pro Rank Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-30583 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n/a through <= 1.0.0.
- Product
- Pro Rank Tracker
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Pro Rank Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025AdSense Privacy Policy: Cross-Site Request Forgery (CSRF)CVE-2025-30578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy Policy: from n/a through <= 1.1.1.
- Product
- AdSense Privacy Policy
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update AdSense Privacy Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Browser Address Bar Color: Cross-Site Request Forgery (CSRF)CVE-2025-30577 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color browser-address-bar-color allows Stored XSS.This issue affects Browser Address Bar Color: from n/a through <= 3.3.
- Product
- Browser Address Bar Color
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Browser Address Bar Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Hacklog Remote Image Autosave: Cross-Site Request Forgery (CSRF)CVE-2025-30576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery.This issue affects Hacklog Remote Image Autosave: from n/a through <= 2.1.0.
- Product
- Hacklog Remote Image Autosave
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Hacklog Remote Image Autosave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Simple Rating: Cross-Site Request Forgery (CSRF)CVE-2025-30572 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating simple-rating allows Stored XSS.This issue affects Simple Rating: from n/a through <= 1.4.
- Product
- Simple Rating
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Simple Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Super Static Cache: Cross-Site Request Forgery (CSRF)CVE-2025-30568 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache super-static-cache allows Cross Site Request Forgery.This issue affects Super Static Cache: from n/a through <= 3.3.5.
- Product
- Super Static Cache
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Super Static Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025banner-manager: Cross-Site Request Forgery (CSRF)CVE-2025-30565 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager banner-manager allows Stored XSS.This issue affects banner-manager: from n/a through <= 16.04.19.
- Product
- banner-manager
- Affected
- up to 16.04.19
- What to do
- Affects up to 16.04.19. Update banner-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Custom Script Integration: Cross-Site Request Forgery (CSRF)CVE-2025-30564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script Integration: from n/a through <= 2.1.
- Product
- Custom Script Integration
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Custom Script Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.