Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

4,221 results · page 33 of 85

Mar 24, 2025CAS Maestro: Cross-Site Request Forgery (CSRF)CVE-2025-30561 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through <= 1.1.3.
Product
CAS Maestro
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update CAS Maestro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025jQuery Dropdown Menu: Cross-Site Request Forgery (CSRF)CVE-2025-30560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.
Product
jQuery Dropdown Menu
Affected
up to 3.0
What to do
Affects up to 3.0. Update jQuery Dropdown Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025ANAC XML Render: Cross-Site Request Forgery (CSRF)CVE-2025-30558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in EnzoCostantini55 ANAC XML Render anac-xml-render allows Stored XSS.This issue affects ANAC XML Render: from n/a through <= 1.5.7.
Product
ANAC XML Render
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update ANAC XML Render to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Easy 301 Redirects: Cross-Site Request Forgery (CSRF)CVE-2025-30557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects odihost-easy-redirect-301 allows Cross Site Request Forgery.This issue affects Easy 301 Redirects: from n/a through <= 1.33.
Product
Easy 301 Redirects
Affected
up to 1.33
What to do
Affects up to 1.33. Update Easy 301 Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Fix Rss Feeds: Cross-Site Request Forgery (CSRF)CVE-2025-30556 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds fix-rss-feed allows Cross Site Request Forgery.This issue affects Fix Rss Feeds: from n/a through <= 3.1.
Product
Fix Rss Feeds
Affected
up to 3.1
What to do
Affects up to 3.1. Update Fix Rss Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025WordPres 同步微博: Cross-Site Request Forgery (CSRF)CVE-2025-30555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in iiiryan WordPres 同步微博 wp2wb allows Stored XSS.This issue affects WordPres 同步微博: from n/a through <= 1.1.0.
Product
WordPres 同步微博
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WordPres 同步微博 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025WordPress Admin Bar Improved: Cross-Site Request Forgery (CSRF)CVE-2025-30552 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Donald Gilbert WordPress Admin Bar Improved wordpress-admin-bar-improved allows Stored XSS.This issue affects WordPress Admin Bar Improved: from n/a through <= 3.3.5.
Product
WordPress Admin Bar Improved
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update WordPress Admin Bar Improved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025CallPhone'r: Cross-Site Request Forgery (CSRF)CVE-2025-30550 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WPShop.ru CallPhone'r callphoner allows Stored XSS.This issue affects CallPhone'r: from n/a through <= 1.1.1.
Product
CallPhone'r
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update CallPhone'r to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Yummly Rich Recipes: Cross-Site Request Forgery (CSRF)CVE-2025-30549 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes yummly-rich-recipes allows Cross Site Request Forgery.This issue affects Yummly Rich Recipes: from n/a through <= 4.2.
Product
Yummly Rich Recipes
Affected
up to 4.2
What to do
Affects up to 4.2. Update Yummly Rich Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Cackle: Cross-Site Request Forgery (CSRF)CVE-2025-30546 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in boroV Cackle cackle allows Cross Site Request Forgery.This issue affects Cackle: from n/a through <= 4.33.
Product
Cackle
Affected
up to 4.33
What to do
Affects up to 4.33. Update Cackle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025SoundCloud Ultimate: Cross-Site Request Forgery (CSRF)CVE-2025-30542 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpsolutions SoundCloud Ultimate soundcloud-ultimate allows Cross Site Request Forgery.This issue affects SoundCloud Ultimate: from n/a through <= 1.5.
Product
SoundCloud Ultimate
Affected
up to 1.5
What to do
Affects up to 1.5. Update SoundCloud Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Info Boxes Shortcode and Widget: Cross-Site Request Forgery (CSRF)CVE-2025-30541 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Info Boxes Shortcode and Widget info-boxes-shortcode-and-widget allows Cross Site Request Forgery.This issue affects Info Boxes Shortcode and Widget: from n/a through <= 1.15.
Product
Info Boxes Shortcode and Widget
Affected
up to 1.15
What to do
Affects up to 1.15. Update Info Boxes Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Simple Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-30538 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Simple Optimizer simple-optimizer allows Cross Site Request Forgery.This issue affects Simple Optimizer: from n/a through <= 1.2.7.
Product
Simple Optimizer
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Simple Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025External image replace: Cross-Site Request Forgery (CSRF)CVE-2025-30535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in muro External image replace external-image-replace allows Cross Site Request Forgery.This issue affects External image replace: from n/a through <= 1.0.8.
Product
External image replace
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update External image replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Image Captcha: Cross-Site Request Forgery (CSRF)CVE-2025-30534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through <= 1.2.
Product
Image Captcha
Affected
up to 1.2
What to do
Affects up to 1.2. Update Image Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025WP Ride Booking: Cross-Site Request Forgery (CSRF)CVE-2025-30531 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in GBS Developer WP Ride Booking wp-ride-booking allows Cross Site Request Forgery.This issue affects WP Ride Booking: from n/a through <= 2.4.
Product
WP Ride Booking
Affected
up to 2.4
What to do
Affects up to 2.4. Update WP Ride Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Auto Load Next Post: Cross-Site Request Forgery (CSRF)CVE-2025-30529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through <= 1.5.14.
Product
Auto Load Next Post
Affected
up to 1.5.14
What to do
Affects up to 1.5.14. Update Auto Load Next Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Awesome Logos: Cross-Site Request Forgery (CSRF)CVE-2025-30528 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Cross-Site Request Forgery (CSRF) vulnerability in wpshopee Awesome Logos awesome-logos allows SQL Injection.This issue affects Awesome Logos: from n/a through <= 1.2.
Product
Awesome Logos
Affected
up to 1.2
What to do
Affects up to 1.2. Update Awesome Logos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Typekit plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-30526 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in lucksy Typekit plugin for WordPress typekit allows Cross Site Request Forgery.This issue affects Typekit plugin for WordPress: from n/a through <= 1.2.3.
Product
Typekit plugin for
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Typekit plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Contact Form 7 Material Design: Cross-Site Request Forgery (CSRF)CVE-2025-30522 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This issue affects Contact Form 7 Material Design: from n/a through <= 1.0.0.
Product
Contact Form 7 Material Design
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Contact Form 7 Material Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025GP Back To Top: Cross-Site Request Forgery (CSRF)CVE-2025-30521 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in giangmd93 GP Back To Top gp-back-to-top allows Cross Site Request Forgery.This issue affects GP Back To Top: from n/a through <= 3.0.
Product
GP Back To Top
Affected
up to 3.0
What to do
Affects up to 3.0. Update GP Back To Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 22, 2025Export and Import Users and Customers: Server-Side Request ForgeryCVE-2025-1970 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Export and Import Users and Customers
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts: Cross-Site Request ForgeryCVE-2025-0807 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation on the cits_settings_tab() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts
Affected
up to 4.2
What to do
Affects up to 4.2. Update CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 22, 2025Your Friendly Drag and Drop Page Builder — Make Builder: Server-Side Request ForgeryCVE-2024-13856 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.10 via the make_builder_ajax_subscribe() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Your Friendly Drag and Drop Page Builder — Make Builder
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Your Friendly Drag and Drop Page Builder — Make Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts: Cross-Site Request ForgeryCVE-2024-13768 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation on the cits_assign_fonts_tab() function. This makes it possible for unauthenticated attackers to delete font assignments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts
Affected
up to 4.2
What to do
Affects up to 4.2. Update CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 20, 2025Order Export & Order Import for WooCommerce: Server-Side Request ForgeryCVE-2024-13923 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 via the validate_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Custom Twitter Feeds – A Tweets Widget or X Feed Widget: Cross-Site Request ForgeryCVE-2025-1314 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Custom Twitter Feeds – A Tweets Widget or X Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2025FoodBakery | Delivery Restaurant Directory: Cross-Site Request ForgeryCVE-2024-13933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7. This is due to missing or incorrect nonce validation on the foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, export_widget_settings, ajax_import_widget_data, foodbakery_var_settings_backup_generate, foodbakery_var_backup_file_restore, and theme_option_rest_all functions. This makes it possible for unauthenticated attackers to delete arbitrary files, update theme options, export widget options, import widget options, generate backups, restore backups, and reset theme options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
FoodBakery | Delivery Restaurant Directory
Affected
up to 4.7
What to do
Affects up to 4.7. Update FoodBakery | Delivery Restaurant Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 15, 2025Recapture for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-26899 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Recapture Cart Recovery and Email Marketing Recapture for WooCommerce recapture-for-woocommerce allows Cross Site Request Forgery.This issue affects Recapture for WooCommerce: from n/a through <= 1.0.43.
Product
Recapture for WooCommerce
Affected
up to 1.0.43
What to do
Affects up to 1.0.43. Update Recapture for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 15, 2025Tripetto: Cross-Site Request ForgeryCVE-2025-1530 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Tripetto
Affected
up to 8.0.9
What to do
Affects up to 8.0.9. Update Tripetto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 15, 2025Zoorum Comments: Cross-Site Request ForgeryCVE-2025-2163 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorum_set_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Zoorum Comments
Affected
up to 0.9
What to do
Affects up to 0.9. Update Zoorum Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025LoginPress | wp-login Custom Login Page Customizer: Cross-Site Request ForgeryCVE-2025-1764 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.
Product
LoginPress | wp-login Custom Login Page Customizer
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update LoginPress | wp-login Custom Login Page Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Mar 14, 2025InstaWP Connect – 1-click WP Staging & Migration: Cross-Site Request ForgeryCVE-2024-13913 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.0.83
What to do
Affects up to 0.1.0.83. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2025Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Server-Side Request ForgeryCVE-2024-13838 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.2 via the 'call_webhook' method of the Automator_Send_Webhook class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
Affected
up to 6.2
What to do
Affects up to 6.2. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2025Spam Byebye: Cross-Site Request Forgery (CSRF)CVE-2025-28941 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ohtan Spam Byebye spam-byebye allows Cross Site Request Forgery.This issue affects Spam Byebye: from n/a through <= 2.2.4.
Product
Spam Byebye
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Spam Byebye to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Back To Top: Cross-Site Request Forgery (CSRF)CVE-2025-28940 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in arkapravamajumder Back To Top backtotop allows Cross Site Request Forgery.This issue affects Back To Top: from n/a through <= 2.0.
Product
Back To Top
Affected
up to 2.0
What to do
Affects up to 2.0. Update Back To Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025MaxA/B: Cross-Site Request Forgery (CSRF)CVE-2025-28933 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in maxfoundry MaxA/B maxab allows Stored XSS.This issue affects MaxA/B: from n/a through <= 2.2.2.
Product
MaxA/B
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update MaxA/B to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Insert Code: Cross-Site Request Forgery (CSRF)CVE-2025-28932 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in BCS Website Solutions Insert Code insert-code allows Stored XSS.This issue affects Insert Code: from n/a through <= 2.4.
Product
Insert Code
Affected
up to 2.4
What to do
Affects up to 2.4. Update Insert Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Hashtags: Cross-Site Request Forgery (CSRF)CVE-2025-28931 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DevriX Hashtags wp-hashtags allows Stored XSS.This issue affects Hashtags: from n/a through <= 0.3.2.
Product
Hashtags
Affected
up to 0.3.2
What to do
Affects up to 0.3.2. Update Hashtags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Display Template Name: Cross-Site Request Forgery (CSRF)CVE-2025-28927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in A. Chappard Display Template Name display-template-name allows Cross Site Request Forgery.This issue affects Display Template Name: from n/a through <= 1.7.1.
Product
Display Template Name
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Display Template Name to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WATI Chat and Notification: Cross-Site Request Forgery (CSRF)CVE-2025-28925 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Hieu Nguyen WATI Chat and Notification wati-chat-and-notification allows Stored XSS.This issue affects WATI Chat and Notification: from n/a through <= 1.1.2.
Product
WATI Chat and Notification
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WATI Chat and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025No Disposable Email: Cross-Site Request Forgery (CSRF)CVE-2025-28923 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in philippe No Disposable Email no-disposable-email allows Stored XSS.This issue affects No Disposable Email: from n/a through <= 2.5.1.
Product
No Disposable Email
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update No Disposable Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Go To Top: Cross-Site Request Forgery (CSRF)CVE-2025-28922 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Terence D. Go To Top go-to-top allows Stored XSS.This issue affects Go To Top: from n/a through <= 0.0.8.
Product
Go To Top
Affected
up to 0.0.8
What to do
Affects up to 0.0.8. Update Go To Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WP Add Active Class To Menu Item: Cross-Site Request Forgery (CSRF)CVE-2025-28913 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Aftab Ali Muni WP Add Active Class To Menu Item wp-add-active-class-to-menu-item allows Cross Site Request Forgery.This issue affects WP Add Active Class To Menu Item: from n/a through <= 1.0.
Product
WP Add Active Class To Menu Item
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Add Active Class To Menu Item to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Custom Dashboard Page: Cross-Site Request Forgery (CSRF)CVE-2025-28912 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through <= 1.0.
Product
Custom Dashboard Page
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Dashboard Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WP Hide Admin Bar: Cross-Site Request Forgery (CSRF)CVE-2025-28910 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ravinder Khurana WP Hide Admin Bar wp-hide-admin-bar allows Cross Site Request Forgery.This issue affects WP Hide Admin Bar: from n/a through <= 2.0.
Product
WP Hide Admin Bar
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP Hide Admin Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WP No-Bot Question: Cross-Site Request Forgery (CSRF)CVE-2025-28909 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in edwardw WP No-Bot Question wp-no-bot-question allows Cross Site Request Forgery.This issue affects WP No-Bot Question: from n/a through <= 0.1.7.
Product
WP No-Bot Question
Affected
up to 0.1.7
What to do
Affects up to 0.1.7. Update WP No-Bot Question to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Contact Form 7 Select Box Editor Button: Cross-Site Request Forgery (CSRF)CVE-2025-28902 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button contact-form-7-select-box-editor-button allows Cross Site Request Forgery.This issue affects Contact Form 7 Select Box Editor Button: from n/a through <= 0.6.
Product
Contact Form 7 Select Box Editor Button
Affected
up to 0.6
What to do
Affects up to 0.6. Update Contact Form 7 Select Box Editor Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Members page only for logged in users: Cross-Site Request Forgery (CSRF)CVE-2025-28901 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Naren Members page only for logged in users members-page-only-for-logged-in-users allows Stored XSS.This issue affects Members page only for logged in users: from n/a through <= 1.4.2.
Product
Members page only for logged in users
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Members page only for logged in users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025TabGarb Pro: Cross-Site Request Forgery (CSRF)CVE-2025-28900 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in webgarb TabGarb Pro tabgarb allows Stored XSS.This issue affects TabGarb Pro: from n/a through <= 2.6.
Product
TabGarb Pro
Affected
up to 2.6
What to do
Affects up to 2.6. Update TabGarb Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.