Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,076 results · page 335 of 822
Jun 6, 2025Powie's Uptime Robot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30638 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's Uptime Robot powies-uptime-robot allows Stored XSS.This issue affects Powie's Uptime Robot: from n/a through <= 0.9.7.
- Product
- Powie's Uptime Robot
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Powie's Uptime Robot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Booking Ultra Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30637 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.20.
- Product
- Booking Ultra Pro
- Affected
- up to 1.1.20
- What to do
- Affects up to 1.1.20. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Accessibility Suite: Missing AuthorizationCVE-2025-30636 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.19.
- Product
- Accessibility Suite
- Affected
- up to 4.19
- What to do
- Affects up to 4.19. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Featured Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30634 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IWEBIX WP Featured Content Slider wp-featured-content-slider allows Stored XSS.This issue affects WP Featured Content Slider: from n/a through <= 2.6.
- Product
- WP Featured Content Slider
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update WP Featured Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Global Translator: Cross-Site Request Forgery (CSRF)CVE-2025-30632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pozzad Global Translator global-translator allows Cross Site Request Forgery.This issue affects Global Translator: from n/a through <= 2.0.2.
- Product
- Global Translator
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Global Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Global Translator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30630 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pozzad Global Translator global-translator allows Stored XSS.This issue affects Global Translator: from n/a through <= 2.0.2.
- Product
- Global Translator
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Global Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Bitly URL Shortener: Cross-Site Request Forgery (CSRF)CVE-2025-30629 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Codehaveli Bitly URL Shortener codehaveli-bitly-url-shortener allows Cross Site Request Forgery.This issue affects Bitly URL Shortener: from n/a through <= 1.4.1.
- Product
- Bitly URL Shortener
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Bitly URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Elegant Visitor Counter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30627 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regolithsjk Elegant Visitor Counter elegant-visitor-counter allows Stored XSS.This issue affects Elegant Visitor Counter: from n/a through <= 3.1.
- Product
- Elegant Visitor Counter
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Elegant Visitor Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025AppBanners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30625 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Pramschufer AppBanners appbanners allows Stored XSS.This issue affects AppBanners: from n/a through <= 1.5.14.
- Product
- AppBanners
- Affected
- up to 1.5.14
- What to do
- Affects up to 1.5.14. Update AppBanners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WordLift: Missing AuthorizationCVE-2025-30624 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WordLift WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through <= 3.54.4.
- Product
- WordLift
- Affected
- up to 3.54.4
- What to do
- Affects up to 3.54.4. Update WordLift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Custom Category/Post Type Post order: Missing AuthorizationCVE-2025-29013 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in faaiq Custom Category/Post Type Post order custom-post-order-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Category/Post Type Post order: from n/a through <= 1.6.0.
- Product
- Custom Category/Post Type Post order
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Custom Category/Post Type Post order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025YouTube Simple Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-29011 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer YouTube Simple Gallery youtube-simple-gallery allows Stored XSS.This issue affects YouTube Simple Gallery: from n/a through <= 2.2.0.
- Product
- YouTube Simple Gallery
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update YouTube Simple Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Behance Portfolio Manager: Missing AuthorizationCVE-2025-29010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025SocialMark: Server-Side Request Forgery (SSRF)CVE-2025-29008 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in ShawonPro SocialMark socialmark allows Server Side Request Forgery.This issue affects SocialMark: from n/a through <= 2.0.7.
- Product
- SocialMark
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update SocialMark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Direct Checkout for WooCommerce Lite: Missing AuthorizationCVE-2025-29006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in centangle Direct Checkout for WooCommerce Lite woo-direct-checkout-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Direct Checkout for WooCommerce Lite: from n/a through <= 1.0.3.
- Product
- Direct Checkout for WooCommerce Lite
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Direct Checkout for WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025HR Management Lite: Cross-Site Request Forgery (CSRF)CVE-2025-29005 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Cross Site Request Forgery.This issue affects HR Management Lite: from n/a through <= 3.6.
- Product
- HR Management Lite
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update HR Management Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025The Holiday Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-29003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mva7 The Holiday Calendar the-holiday-calendar allows Stored XSS.This issue affects The Holiday Calendar: from n/a through <= 1.18.2.1.
- Product
- The Holiday Calendar
- Affected
- up to 1.18.2.1
- What to do
- Affects up to 1.18.2.1. Update The Holiday Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP AutoKeyword: Missing AuthorizationCVE-2025-28997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP AutoKeyword: from n/a through <= 1.0.
- Product
- WP AutoKeyword
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP AutoKeyword to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025GPP Slideshow: Missing AuthorizationCVE-2025-28996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Thad Allender GPP Slideshow gpp-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GPP Slideshow: from n/a through <= 1.3.5.
- Product
- GPP Slideshow
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update GPP Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Viral Loops WP Integration: Missing AuthorizationCVE-2025-28995 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Loops WP Integration: from n/a through <= 3.8.1.
- Product
- Viral Loops WP Integration
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Viral Loops WP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Viral Loops WP Integration: Missing AuthorizationCVE-2025-28994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Loops WP Integration: from n/a through <= 3.8.1.
- Product
- Viral Loops WP Integration
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Viral Loops WP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Read More Login: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28989 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arildur Read More Login read-more-login allows Stored XSS.This issue affects Read More Login: from n/a through <= 2.0.3.
- Product
- Read More Login
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Read More Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Epicwin: Cross-Site Request Forgery (CSRF)CVE-2025-28986 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from n/a through <= 1.5.
- Product
- Epicwin
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Epicwin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Elastic Email Subscribe Form: Missing AuthorizationCVE-2025-28985 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Elastic Email Elastic Email Subscribe Form elastic-email-subscribe-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Subscribe Form: from n/a through <= 1.2.2.
- Product
- Elastic Email Subscribe Form
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Elastic Email Subscribe Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Subscription Renewal Reminders for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-28984 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in storepro Subscription Renewal Reminders for WooCommerce subscriptions-renewal-reminders allows Cross Site Request Forgery.This issue affects Subscription Renewal Reminders for WooCommerce: from n/a through <= 1.4.1.
- Product
- Subscription Renewal Reminders for WooCommerce
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Subscription Renewal Reminders for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Mail Options: Cross-Site Request Forgery (CSRF)CVE-2025-28981 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through <= 0.2.3.
- Product
- WP Mail Options
- Affected
- up to 0.2.3
- What to do
- Affects up to 0.2.3. Update WP Mail Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Free WP Mail SMTP: Cross-Site Request Forgery (CSRF)CVE-2025-28974 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mail250 Free WP Mail SMTP free-wp-mail-smtp allows Stored XSS.This issue affects Free WP Mail SMTP: from n/a through <= 1.0.
- Product
- Free WP Mail SMTP
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Free WP Mail SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Recent Posts Slider Responsive: Cross-Site Request Forgery (CSRF)CVE-2025-28966 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through <= 1.0.1.
- Product
- Recent Posts Slider Responsive
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Recent Posts Slider Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Personal Favicon: Cross-Site Request Forgery (CSRF)CVE-2025-28964 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through <= 2.0.
- Product
- Personal Favicon
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Personal Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Bg Orthodox Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-28958 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar bg-orthodox-calendar allows Stored XSS.This issue affects Bg Orthodox Calendar: from n/a through <= 0.13.10.
- Product
- Bg Orthodox Calendar
- Affected
- up to 0.13.10
- What to do
- Affects up to 0.13.10. Update Bg Orthodox Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Backwp: Cross-Site Request Forgery (CSRF)CVE-2025-28954 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in wphobby Backwp backwp allows Path Traversal.This issue affects Backwp: from n/a through <= 2.0.2.
- Product
- Backwp
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Backwp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025CubePoints: Cross-Site Request Forgery (CSRF)CVE-2025-28952 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Lau CubePoints cubepoints allows Cross Site Request Forgery.This issue affects CubePoints: from n/a through <= 3.2.1.
- Product
- CubePoints
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update CubePoints to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Post Author: Cross-Site Request Forgery (CSRF)CVE-2025-28950 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through <= 1.1.1.
- Product
- Post Author
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Mediabay - WordPress Media Library Folders: Cross-Site Request Forgery (CSRF)CVE-2025-28948 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.
- Product
- Mediabay - WordPress Media Library Folders
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Quick Event Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-27360 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Cross Site Request Forgery.This issue affects Quick Event Calendar: from n/a through <= 1.4.9.
- Product
- Quick Event Calendar
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Quick Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Media File Type Manager: Cross-Site Request Forgery (CSRF)CVE-2025-27359 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Media File Type Manager wp-media-file-type-manager allows Cross Site Request Forgery.This issue affects WP Media File Type Manager: from n/a through <= 2.3.1.
- Product
- WP Media File Type Manager
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update WP Media File Type Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Simple Google Static Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ángel C. Simple Google Static Map simple-google-static-map allows DOM-Based XSS.This issue affects Simple Google Static Map: from n/a through <= 1.0.1.
- Product
- Simple Google Static Map
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Simple Google Static Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025FastBook: Cross-Site Request Forgery (CSRF)CVE-2025-26593 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Cross Site Request Forgery.This issue affects FastBook: from n/a through <= 1.1.
- Product
- FastBook
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update FastBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Complete Google Seo Scan: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26590 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nir Complete Google Seo Scan complete-google-seo-scan allows SQL Injection.This issue affects Complete Google Seo Scan: from n/a through <= 3.5.1.
- Product
- Complete Google Seo Scan
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Complete Google Seo Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025No Spam At All: Missing AuthorizationCVE-2025-24778 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in De paragon No Spam At All no-spam-at-all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects No Spam At All: from n/a through <= 1.3.
- Product
- No Spam At All
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update No Spam At All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Responsive Flipbooks: Missing AuthorizationCVE-2025-24776 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codelobster Responsive Flipbooks responsive-flipbooks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Flipbooks: from n/a through <= 1.0.
- Product
- Responsive Flipbooks
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Responsive Flipbooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Pay with Contact Form 7: Cross-Site Request Forgery (CSRF)CVE-2025-24772 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.
- Product
- Pay with Contact Form 7
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Pay with Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025bbPress API: Missing AuthorizationCVE-2025-24763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pascal Casier bbPress API bbp-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects bbPress API: from n/a through <= 1.0.14.
- Product
- bbPress API
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update bbPress API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025TicketBAI Facturas para WooCommerce: Missing AuthorizationCVE-2025-24762 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TicketBAI Facturas para WooCommerce: from n/a through <= 3.45.
- Product
- TicketBAI Facturas para WooCommerce
- Affected
- up to 3.45
- What to do
- Affects up to 3.45. Update TicketBAI Facturas para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025KI Live Video Conferences: Missing AuthorizationCVE-2025-23971 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
- Product
- KI Live Video Conferences
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025KI Live Video Conferences: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-23969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Retrieve Embedded Sensitive Data.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
- Product
- KI Live Video Conferences
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Post Corrector: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-26003 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vipul Jariwala WP Post Corrector allows SQL Injection. This issue affects WP Post Corrector: from n/a through 1.0.2.
- Product
- WP Post Corrector
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Post Corrector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 20256Storage Rentals: Missing AuthorizationCVE-2023-26002 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5.
- Product
- 6Storage Rentals
- Affected
- up to 2.19.5
- What to do
- Affects up to 2.19.5. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Next Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-26001 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.
- Product
- Next Event Calendar
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Next Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Bang tinh vay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-26000 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.
- Product
- Bang tinh vay
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Bang tinh vay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.