Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,076 results · page 327 of 822
Jun 20, 2025Recipes manager - WPH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50011 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. This issue affects Recipes manager - WPH: from n/a through 1.0.4.
- Product
- Recipes manager - WPH
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Recipes manager - WPH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Zapier for: Missing AuthorizationCVE-2025-50010 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through <= 1.5.2.
- Product
- Zapier for
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Zapier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Kata Plus: Missing AuthorizationCVE-2025-50009 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kata Plus: from n/a through <= 1.5.3.
- Product
- Kata Plus
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Kata Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: Missing AuthorizationCVE-2025-50008 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: from n/a through <= 1.2.4.5.
- Product
- WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily
- Affected
- up to 1.2.4.5
- What to do
- Affects up to 1.2.4.5. Update WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WooCommerce Fortnox Integration: Missing AuthorizationCVE-2025-49998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Fortnox Integration: from n/a through <= 4.5.5.
- Product
- WooCommerce Fortnox Integration
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update WooCommerce Fortnox Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Giveaways and Contests by RafflePress: Missing AuthorizationCVE-2025-49997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.18.
- Product
- Giveaways and Contests by RafflePress
- Affected
- up to 1.12.18
- What to do
- Affects up to 1.12.18. Update Giveaways and Contests by RafflePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-49996 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 8.4.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 8.4
- What to do
- Affects up to 8.4. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Download Attachments: Authorization Bypass Through User-Controlled KeyCVE-2025-49995 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.3.1.
- Product
- Download Attachments
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Download Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Cookie-Script.com: Missing AuthorizationCVE-2025-49993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in csarturas Cookie-Script.com cookie-script-com allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookie-Script.com: from n/a through <= 1.2.1.
- Product
- Cookie-Script.com
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Cookie-Script.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP-Recall: Missing AuthorizationCVE-2025-49991 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/a through 16.26.14.
- Product
- WP-Recall
- Affected
- up to 16.26.14
- What to do
- Affects up to 16.26.14. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Contentstudio: Missing AuthorizationCVE-2025-49990 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contentstudio: from n/a through <= 1.3.7.
- Product
- Contentstudio
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025App Builder: Missing AuthorizationCVE-2025-49989 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in App Cheap App Builder app-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Builder: from n/a through <= 5.5.6.
- Product
- App Builder
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Contact Form 7 AWeber Extension: Missing AuthorizationCVE-2025-49988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through <= 0.1.40.
- Product
- Contact Form 7 AWeber Extension
- Affected
- up to 0.1.40
- What to do
- Affects up to 0.1.40. Update Contact Form 7 AWeber Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025CRM ERP Business Solution: Missing AuthorizationCVE-2025-49987 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CRM ERP Business Solution: from n/a through <= 1.13.
- Product
- CRM ERP Business Solution
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update CRM ERP Business Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Video List Manager: Missing AuthorizationCVE-2025-49986 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in thanhtungtnt Video List Manager video-list-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Video List Manager: from n/a through <= 1.7.
- Product
- Video List Manager
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Auto Upload Images: Server-Side Request Forgery (SSRF)CVE-2025-49985 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto Upload Images: from n/a through <= 3.3.2.
- Product
- Auto Upload Images
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Auto Upload Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025PowerPress Podcasting: Server-Side Request Forgery (SSRF)CVE-2025-49984 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress Podcasting: from n/a through <= 11.13.11.
- Product
- PowerPress Podcasting
- Affected
- up to 11.13.11
- What to do
- Affects up to 11.13.11. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WPThumb: Server-Side Request Forgery (SSRF)CVE-2025-49983 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Joe Hoyle WPThumb wp-thumb allows Server Side Request Forgery.This issue affects WPThumb: from n/a through <= 0.10.
- Product
- WPThumb
- Affected
- up to 0.10
- What to do
- Affects up to 0.10. Update WPThumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP Customer Area: Missing AuthorizationCVE-2025-49982 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through <= 8.3.4.
- Product
- WP Customer Area
- Affected
- up to 8.3.4
- What to do
- Affects up to 8.3.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025User Roles and Capabilities: Missing AuthorizationCVE-2025-49981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through <= 1.2.6.
- Product
- User Roles and Capabilities
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update User Roles and Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP User Profile Avatar: Missing AuthorizationCVE-2025-49980 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.
- Product
- WP User Profile Avatar
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Media Hygiene: Missing AuthorizationCVE-2025-49979 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through <= 4.0.1.
- Product
- Media Hygiene
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Media Hygiene to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025JobSearch: Authorization Bypass Through User-Controlled KeyCVE-2025-49978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.
- Product
- JobSearch
- What to do
- Update JobSearch to the newest version.
Jun 20, 2025WP Inventory Manager: Cross-Site Request Forgery (CSRF)CVE-2025-49977 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through <= 2.3.4.
- Product
- WP Inventory Manager
- Affected
- up to 2.3.4
- What to do
- Affects up to 2.3.4. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Notifier: Missing AuthorizationCVE-2025-49976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.12.
- Product
- Notifier
- Affected
- up to 2.7.12
- What to do
- Affects up to 2.7.12. Update Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025JobWP: Cross-Site Request Forgery (CSRF)CVE-2025-49975 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.0.
- Product
- JobWP
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025UpStream: a Project Management Plugin for: Missing AuthorizationCVE-2025-49974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through <= 2.1.1.
- Product
- UpStream: a Project Management Plugin for
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update UpStream: a Project Management Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: Missing AuthorizationCVE-2025-49973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: from n/a through <= 1.0.10.
- Product
- Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025TM Replace Howdy: Cross-Site Request Forgery (CSRF)CVE-2025-49972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace Howdy: from n/a through <= 1.4.2.
- Product
- TM Replace Howdy
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update TM Replace Howdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025eDS Responsive Menu: Missing AuthorizationCVE-2025-49971 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
- Product
- eDS Responsive Menu
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Hello FSE Blog: Missing AuthorizationCVE-2025-49970 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through <= 1.0.6.
- Product
- Hello FSE Blog
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Hello FSE Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Zara 4 Image Compression: Missing AuthorizationCVE-2025-49969 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through <= 1.2.17.2.
- Product
- Zara 4 Image Compression
- Affected
- up to 1.2.17.2
- What to do
- Affects up to 1.2.17.2. Update Zara 4 Image Compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025XML Travel Portal Widget: Cross-Site Request Forgery (CSRF)CVE-2025-49968 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro XML Travel Portal Widget oganro-reservation-widget allows Cross Site Request Forgery.This issue affects XML Travel Portal Widget: from n/a through <= 2.0.
- Product
- XML Travel Portal Widget
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update XML Travel Portal Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Live Sports Streamthunder: Cross-Site Request Forgery (CSRF)CVE-2025-49967 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issue affects Live Sports Streamthunder: from n/a through <= 2.1.
- Product
- Live Sports Streamthunder
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Live Sports Streamthunder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Oganro Travel Portal Search Widget for HotelBeds APITUDE API: Cross-Site Request Forgery (CSRF)CVE-2025-49966 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for HotelBeds APITUDE API: from n/a through <= 1.0.
- Product
- Oganro Travel Portal Search Widget for HotelBeds APITUDE API
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Oganro Travel Portal Search Widget for HotelBeds APITUDE API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025PixelBeds Channel Manager and Hotel Booking Engine: Cross-Site Request Forgery (CSRF)CVE-2025-49965 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through <= 1.0.
- Product
- PixelBeds Channel Manager and Hotel Booking Engine
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update PixelBeds Channel Manager and Hotel Booking Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025ClipLink: Cross-Site Request Forgery (CSRF)CVE-2025-49964 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in indgeek ClipLink cliplink allows Cross Site Request Forgery.This issue affects ClipLink: from n/a through <= 1.1.
- Product
- ClipLink
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update ClipLink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Elessi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49873 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Elessi elessi-theme allows Reflected XSS.This issue affects Elessi: from n/a through <= 6.3.9.
- Product
- Elessi
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update Elessi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Beaver Builder Plugin (Starter Version): Arbitrary file uploadsCVE-2025-4102 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.
- Product
- Beaver Builder Plugin (Starter Version)
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Beaver Builder Plugin (Starter Version) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwpbeaverbuilder.com
Jun 20, 2025Euro FxRef Currency Converter: Stored Cross-Site ScriptingCVE-2025-6257 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Euro FxRef Currency Converter
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Euro FxRef Currency Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jun 20, 2025Custom Post Carousels with Owl: Uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using itCVE-2025-5125 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.
- Product
- Custom Post Carousels with Owl
- Fixed in
- 1.4.12
- What to do
- Update Custom Post Carousels with Owl to 1.4.12 or newer.
Jun 19, 2025Gutenverse News: Stored Cross-Site ScriptingCVE-2025-5234 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Gutenverse News
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Gutenverse News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025AI Engine: Unauthorized modification of data and loss of dataCVE-2025-5071 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.
- Product
- AI Engine
- Affected
- 2.8.0 to 2.8.3
- What to do
- Affects 2.8.0 to 2.8.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025WPBakery Page Builder for: Stored Cross-Site ScriptingCVE-2025-4965 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPBakery Page Builder for
- Affected
- up to 8.4.1
- What to do
- Affects up to 8.4.1. Update WPBakery Page Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordkb.wpbakery.comwordfence.com
Jun 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized view and modification of dataCVE-2025-4571 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025Football Pool: Stored Cross-Site ScriptingCVE-2025-5490 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Football Pool
- Affected
- up to 2.12.4
- What to do
- Affects up to 2.12.4. Update Football Pool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 19, 2025OceanWP: Stored Cross-Site ScriptingCVE-2025-5524 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- OceanWP
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update OceanWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemes.trac.wordpress.orgthemes.trac.wordpress.org
Jun 19, 2025ElementsKit Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2025-4479 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ElementsKit Elementor Addons and Templates
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update ElementsKit Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025Download Manager: Stored Cross-Site ScriptingCVE-2025-4367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Download Manager
- Affected
- up to 3.3.18
- What to do
- Affects up to 3.3.18. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 18, 2025Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more: Stored Cross-Site ScriptingCVE-2025-6201 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's conversion-pixel in all versions up to, and including, 1.49.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more
- Affected
- up to 1.49.0
- What to do
- Affects up to 1.49.0. Update Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.