Vulnerability database

40,937 results · page 324 of 819

• Jun 20, 2025WP-FB-AutoConnect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50022 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JK WP-FB-AutoConnect wp-fb-autoconnect allows Stored XSS.This issue affects WP-FB-AutoConnect: from n/a through <= 4.6.4.

  Product

  WP-FB-AutoConnect

  Affected

  up to 4.6.4

  What to do

  Affects up to 4.6.4. Update WP-FB-AutoConnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Better Random Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50021 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Better Random Redirect better-random-redirect allows Stored XSS.This issue affects Better Random Redirect: from n/a through <= 1.3.20.

  Product

  Better Random Redirect

  Affected

  up to 1.3.20

  What to do

  Affects up to 1.3.20. Update Better Random Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025RDFa Breadcrumb: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50020 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitin Yawalkar RDFa Breadcrumb rdfa-breadcrumb allows Stored XSS.This issue affects RDFa Breadcrumb: from n/a through <= 2.3.

  Product

  RDFa Breadcrumb

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update RDFa Breadcrumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Simple Sticky Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50019 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandor Kovacs Simple Sticky Footer simple-sticky-footer allows Stored XSS.This issue affects Simple Sticky Footer : from n/a through <= 1.3.5.

  Product

  Simple Sticky Footer

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Simple Sticky Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Tealium: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50018 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tealium Tealium tealium allows Stored XSS.This issue affects Tealium: from n/a through <= 2.1.20.

  Product

  Tealium

  Affected

  up to 2.1.20

  What to do

  Affects up to 2.1.20. Update Tealium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Voting Contest: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50017 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt WP Voting Contest wp-voting-contest allows Stored XSS.This issue affects WP Voting Contest: from n/a through <= 5.8.

  Product

  WP Voting Contest

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update WP Voting Contest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025IP Based Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50016 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through <= 2.4.2.

  Product

  IP Based Login

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update IP Based Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Hand Talk: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50015 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodrigo Bastos Hand Talk handtalk allows Stored XSS.This issue affects Hand Talk: from n/a through <= 6.1.

  Product

  Hand Talk

  Affected

  up to 6.1

  What to do

  Affects up to 6.1. Update Hand Talk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025PDPA Consent for Thailand: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50014 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan PDPA Consent for Thailand pdpa-consent allows Stored XSS.This issue affects PDPA Consent for Thailand: from n/a through <= 1.1.1.

  Product

  PDPA Consent for Thailand

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update PDPA Consent for Thailand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025CSV Importer Improved: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50013 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Judge CSV Importer Improved csv-importer-improved allows Stored XSS.This issue affects CSV Importer Improved: from n/a through <= 0.6.1.

  Product

  CSV Importer Improved

  Affected

  up to 0.6.1

  What to do

  Affects up to 0.6.1. Update CSV Importer Improved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Inventory Presser: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50012 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows Stored XSS.This issue affects Inventory Presser: from n/a through <= 15.2.6.

  Product

  Inventory Presser

  Affected

  up to 15.2.6

  What to do

  Affects up to 15.2.6. Update Inventory Presser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Recipes manager - WPH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50011 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. This issue affects Recipes manager - WPH: from n/a through 1.0.4.

  Product

  Recipes manager - WPH

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Recipes manager - WPH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Zapier for: Missing AuthorizationCVE-2025-50010 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through <= 1.5.2.

  Product

  Zapier for

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Zapier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Kata Plus: Missing AuthorizationCVE-2025-50009 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kata Plus: from n/a through <= 1.5.3.

  Product

  Kata Plus

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Kata Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: Missing AuthorizationCVE-2025-50008 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: from n/a through <= 1.2.4.5.

  Product

  WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily

  Affected

  up to 1.2.4.5

  What to do

  Affects up to 1.2.4.5. Update WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WooCommerce Fortnox Integration: Missing AuthorizationCVE-2025-49998 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Fortnox Integration: from n/a through <= 4.5.5.

  Product

  WooCommerce Fortnox Integration

  Affected

  up to 4.5.5

  What to do

  Affects up to 4.5.5. Update WooCommerce Fortnox Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Giveaways and Contests by RafflePress: Missing AuthorizationCVE-2025-49997 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.18.

  Product

  Giveaways and Contests by RafflePress

  Affected

  up to 1.12.18

  What to do

  Affects up to 1.12.18. Update Giveaways and Contests by RafflePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-49996 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 8.4.

  Product

  WP Visitor Statistics (Real Time Traffic)

  Affected

  up to 8.4

  What to do

  Affects up to 8.4. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Download Attachments: Authorization Bypass Through User-Controlled KeyCVE-2025-49995 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.3.1.

  Product

  Download Attachments

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update Download Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Cookie-Script.com: Missing AuthorizationCVE-2025-49993 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in csarturas Cookie-Script.com cookie-script-com allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookie-Script.com: from n/a through <= 1.2.1.

  Product

  Cookie-Script.com

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update Cookie-Script.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP-Recall: Missing AuthorizationCVE-2025-49991 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/a through 16.26.14.

  Product

  WP-Recall

  Affected

  up to 16.26.14

  What to do

  Affects up to 16.26.14. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Contentstudio: Missing AuthorizationCVE-2025-49990 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contentstudio: from n/a through <= 1.3.7.

  Product

  Contentstudio

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025App Builder: Missing AuthorizationCVE-2025-49989 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in App Cheap App Builder app-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Builder: from n/a through <= 5.5.6.

  Product

  App Builder

  Affected

  up to 5.5.6

  What to do

  Affects up to 5.5.6. Update App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Contact Form 7 AWeber Extension: Missing AuthorizationCVE-2025-49988 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through <= 0.1.40.

  Product

  Contact Form 7 AWeber Extension

  Affected

  up to 0.1.40

  What to do

  Affects up to 0.1.40. Update Contact Form 7 AWeber Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025CRM ERP Business Solution: Missing AuthorizationCVE-2025-49987 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CRM ERP Business Solution: from n/a through <= 1.13.

  Product

  CRM ERP Business Solution

  Affected

  up to 1.13

  What to do

  Affects up to 1.13. Update CRM ERP Business Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Video List Manager: Missing AuthorizationCVE-2025-49986 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in thanhtungtnt Video List Manager video-list-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Video List Manager: from n/a through <= 1.7.

  Product

  Video List Manager

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Auto Upload Images: Server-Side Request Forgery (SSRF)CVE-2025-49985 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto Upload Images: from n/a through <= 3.3.2.

  Product

  Auto Upload Images

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Auto Upload Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025PowerPress Podcasting: Server-Side Request Forgery (SSRF)CVE-2025-49984 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress Podcasting: from n/a through <= 11.13.11.

  Product

  PowerPress Podcasting

  Affected

  up to 11.13.11

  What to do

  Affects up to 11.13.11. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WPThumb: Server-Side Request Forgery (SSRF)CVE-2025-49983 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Joe Hoyle WPThumb wp-thumb allows Server Side Request Forgery.This issue affects WPThumb: from n/a through <= 0.10.

  Product

  WPThumb

  Affected

  up to 0.10

  What to do

  Affects up to 0.10. Update WPThumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Customer Area: Missing AuthorizationCVE-2025-49982 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through <= 8.3.4.

  Product

  WP Customer Area

  Affected

  up to 8.3.4

  What to do

  Affects up to 8.3.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025User Roles and Capabilities: Missing AuthorizationCVE-2025-49981 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through <= 1.2.6.

  Product

  User Roles and Capabilities

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update User Roles and Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP User Profile Avatar: Missing AuthorizationCVE-2025-49980 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.

  Product

  WP User Profile Avatar

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Media Hygiene: Missing AuthorizationCVE-2025-49979 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through <= 4.0.1.

  Product

  Media Hygiene

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Media Hygiene to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025JobSearch: Authorization Bypass Through User-Controlled KeyCVE-2025-49978 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.

  Product

  JobSearch

  What to do

  Update JobSearch to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025WP Inventory Manager: Cross-Site Request Forgery (CSRF)CVE-2025-49977 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through <= 2.3.4.

  Product

  WP Inventory Manager

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Notifier: Missing AuthorizationCVE-2025-49976 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.12.

  Product

  Notifier

  Affected

  up to 2.7.12

  What to do

  Affects up to 2.7.12. Update Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025JobWP: Cross-Site Request Forgery (CSRF)CVE-2025-49975 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.0.

  Product

  JobWP

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025UpStream: a Project Management Plugin for: Missing AuthorizationCVE-2025-49974 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through <= 2.1.1.

  Product

  UpStream: a Project Management Plugin for

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update UpStream: a Project Management Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: Missing AuthorizationCVE-2025-49973 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: from n/a through <= 1.0.10.

  Product

  Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025TM Replace Howdy: Cross-Site Request Forgery (CSRF)CVE-2025-49972 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace Howdy: from n/a through <= 1.4.2.

  Product

  TM Replace Howdy

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update TM Replace Howdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025eDS Responsive Menu: Missing AuthorizationCVE-2025-49971 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eDS Responsive Menu: from n/a through <= 1.2.

  Product

  eDS Responsive Menu

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Hello FSE Blog: Missing AuthorizationCVE-2025-49970 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through <= 1.0.6.

  Product

  Hello FSE Blog

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Hello FSE Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Zara 4 Image Compression: Missing AuthorizationCVE-2025-49969 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through <= 1.2.17.2.

  Product

  Zara 4 Image Compression

  Affected

  up to 1.2.17.2

  What to do

  Affects up to 1.2.17.2. Update Zara 4 Image Compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025XML Travel Portal Widget: Cross-Site Request Forgery (CSRF)CVE-2025-49968 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Oganro XML Travel Portal Widget oganro-reservation-widget allows Cross Site Request Forgery.This issue affects XML Travel Portal Widget: from n/a through <= 2.0.

  Product

  XML Travel Portal Widget

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update XML Travel Portal Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Live Sports Streamthunder: Cross-Site Request Forgery (CSRF)CVE-2025-49967 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issue affects Live Sports Streamthunder: from n/a through <= 2.1.

  Product

  Live Sports Streamthunder

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Live Sports Streamthunder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Oganro Travel Portal Search Widget for HotelBeds APITUDE API: Cross-Site Request Forgery (CSRF)CVE-2025-49966 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through <= 1.0.

  Product

  Oganro Travel Portal Search Widget for HotelBeds APITUDE API

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Oganro Travel Portal Search Widget for HotelBeds APITUDE API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025PixelBeds Channel Manager and Hotel Booking Engine: Cross-Site Request Forgery (CSRF)CVE-2025-49965 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through <= 1.0.

  Product

  PixelBeds Channel Manager and Hotel Booking Engine

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update PixelBeds Channel Manager and Hotel Booking Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025ClipLink: Cross-Site Request Forgery (CSRF)CVE-2025-49964 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in indgeek ClipLink cliplink allows Cross Site Request Forgery.This issue affects ClipLink: from n/a through <= 1.1.

  Product

  ClipLink

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update ClipLink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Elessi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49873 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Elessi elessi-theme allows Reflected XSS.This issue affects Elessi: from n/a through <= 6.3.9.

  Product

  Elessi

  Affected

  up to 6.3.9

  What to do

  Affects up to 6.3.9. Update Elessi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 20, 2025Beaver Builder Plugin (Starter Version): Arbitrary file uploadsCVE-2025-4102 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.

  Product

  Beaver Builder Plugin (Starter Version)

  Affected

  up to 2.9.1

  What to do

  Affects up to 2.9.1. Update Beaver Builder Plugin (Starter Version) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordfence.comwpbeaverbuilder.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.