Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

4,656 results · page 34 of 94

Apr 9, 2025Mergado Pack: Cross-Site Request Forgery (CSRF)CVE-2025-32669 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Stored XSS.This issue affects Mergado Pack: from n/a through <= 4.2.1.
Product
Mergado Pack
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Mergado Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Doppler Forms: Cross-Site Request Forgery (CSRF)CVE-2025-32667 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in fromdoppler Doppler Forms doppler-form allows Stored XSS.This issue affects Doppler Forms: from n/a through <= 2.5.1.
Product
Doppler Forms
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Nepali Date Utilities: Cross-Site Request Forgery (CSRF)CVE-2025-32664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ashokbasnet Nepali Date Utilities nepali-date-utilities allows Stored XSS.This issue affects Nepali Date Utilities: from n/a through <= 1.0.15.
Product
Nepali Date Utilities
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Nepali Date Utilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Interactive US Map: Cross-Site Request Forgery (CSRF)CVE-2025-32661 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive US Map interactive-us-map allows Stored XSS.This issue affects Interactive US Map: from n/a through <= 2.7.
Product
Interactive US Map
Affected
up to 2.7
What to do
Affects up to 2.7. Update Interactive US Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025FraudLabs Pro for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-32659 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Stored XSS.This issue affects FraudLabs Pro for WooCommerce: from n/a through <= 2.22.8.
Product
FraudLabs Pro for WooCommerce
Affected
up to 2.22.8
What to do
Affects up to 2.22.8. Update FraudLabs Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Custom Posts Order: Cross-Site Request Forgery (CSRF)CVE-2025-32645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Hiren Patel Custom Posts Order custom-posts-order allows Stored XSS.This issue affects Custom Posts Order: from n/a through <= 4.4.
Product
Custom Posts Order
Affected
up to 4.4
What to do
Affects up to 4.4. Update Custom Posts Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025IP2Location World Clock: Cross-Site Request Forgery (CSRF)CVE-2025-32644 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location World Clock ip2location-world-clock allows Stored XSS.This issue affects IP2Location World Clock: from n/a through <= 1.1.9.
Product
IP2Location World Clock
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update IP2Location World Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Vite Coupon: Cross-Site Request Forgery (CSRF)CVE-2025-32642 · WordPress plugins & themes · reported by PatchstackCritical 10
Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through <= 1.0.9.
Product
Vite Coupon
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Vite Coupon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Anant Addons for Elementor: Cross-Site Request Forgery (CSRF)CVE-2025-32641 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor allows Cross Site Request Forgery.This issue affects Anant Addons for Elementor: from n/a through <= 1.1.8.
Product
Anant Addons for Elementor
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Anant Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025PlainInventory: Cross-Site Request Forgery (CSRF)CVE-2025-32623 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in plainware PlainInventory z-inventory-manager allows Stored XSS.This issue affects PlainInventory: from n/a through <= 3.1.9.
Product
PlainInventory
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP Map Route Planner: Cross-Site Request Forgery (CSRF)CVE-2025-32621 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital WP Map Route Planner wp-map-route-planner allows Cross Site Request Forgery.This issue affects WP Map Route Planner: from n/a through <= 1.0.0.
Product
WP Map Route Planner
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Map Route Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025KeyCAPTCHA: Cross-Site Request Forgery (CSRF)CVE-2025-32619 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in KeyCAPTCHA KeyCAPTCHA keycaptcha allows Stored XSS.This issue affects KeyCAPTCHA: from n/a through <= 2.5.1.
Product
KeyCAPTCHA
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update KeyCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Multiple Location Google Map: Cross-Site Request Forgery (CSRF)CVE-2025-32617 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ydesignservices Multiple Location Google Map multiple-location-google-map allows Stored XSS.This issue affects Multiple Location Google Map: from n/a through <= 1.1.
Product
Multiple Location Google Map
Affected
up to 1.1
What to do
Affects up to 1.1. Update Multiple Location Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Nimbata Call Tracking: Cross-Site Request Forgery (CSRF)CVE-2025-32616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nimbata Nimbata Call Tracking nimbata-call-tracking allows Stored XSS.This issue affects Nimbata Call Tracking: from n/a through <= 1.7.4.
Product
Nimbata Call Tracking
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Nimbata Call Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025User Session Synchronizer: Cross-Site Request Forgery (CSRF)CVE-2025-32612 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through <= 1.4.0.
Product
User Session Synchronizer
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update User Session Synchronizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Foliopress WYSIWYG: Cross-Site Request Forgery (CSRF)CVE-2025-32610 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in FolioVision Foliopress WYSIWYG foliopress-wysiwyg allows Cross Site Request Forgery.This issue affects Foliopress WYSIWYG: from n/a through <= 2.6.18.
Product
Foliopress WYSIWYG
Affected
up to 2.6.18
What to do
Affects up to 2.6.18. Update Foliopress WYSIWYG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WordPress Events Calendar Plugin – connectDaily: Cross-Site Request Forgery (CSRF)CVE-2025-32597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily connect-daily-web-calendar allows Cross-Site Scripting (XSS).This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through <= 1.5.4.
Product
WordPress Events Calendar Plugin – connectDaily
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update WordPress Events Calendar Plugin – connectDaily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP Abstracts: Cross-Site Request Forgery (CSRF)CVE-2025-32591 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Cross Site Request Forgery.This issue affects WP Abstracts: from n/a through <= 2.7.5.
Product
WP Abstracts
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Chat2: Cross-Site Request Forgery (CSRF)CVE-2025-32584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Chat2 Chat2 chat2 allows Cross Site Request Forgery.This issue affects Chat2: from n/a through <= 4.0.
Product
Chat2
Affected
up to 4.0
What to do
Affects up to 4.0. Update Chat2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP shop: Cross-Site Request Forgery (CSRF)CVE-2025-32576 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Agence web Eoxia - Montpellier WP shop wpshop allows Upload a Web Shell to a Web Server.This issue affects WP shop: from n/a through <= 2.6.1.
Product
WP shop
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update WP shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP w3all phpBB: Cross-Site Request Forgery (CSRF)CVE-2025-32575 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from n/a through <= 2.9.9.
Product
WP w3all phpBB
Affected
up to 2.9.9
What to do
Affects up to 2.9.9. Update WP w3all phpBB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP Calais Auto Tagger: Cross-Site Request Forgery (CSRF)CVE-2025-32563 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dangrossman WP Calais Auto Tagger calais-auto-tagger allows Cross Site Request Forgery.This issue affects WP Calais Auto Tagger: from n/a through <= 2.0.
Product
WP Calais Auto Tagger
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP Calais Auto Tagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025REVE Chat: Cross-Site Request Forgery (CSRF)CVE-2025-32559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in REVE Chat REVE Chat revechat allows Stored XSS.This issue affects REVE Chat: from n/a through <= 6.4.4.
Product
REVE Chat
Affected
up to 6.4.4
What to do
Affects up to 6.4.4. Update REVE Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Simple Post Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through <= 1.0.9.
Product
Simple Post Meta Manager
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Simple Post Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025SEO, Nutrition and Print for Recipes by Edamam: Cross-Site Request Forgery (CSRF)CVE-2025-32555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Edamam SEO, Nutrition and Print for Recipes by Edamam seo-nutrition-and-print-for-recipes-by-edamam allows Stored XSS.This issue affects SEO, Nutrition and Print for Recipes by Edamam: from n/a through <= 3.3.
Product
SEO, Nutrition and Print for Recipes by Edamam
Affected
up to 3.3
What to do
Affects up to 3.3. Update SEO, Nutrition and Print for Recipes by Edamam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025All push notification for WP: Cross-Site Request Forgery (CSRF)CVE-2025-32547 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects All push notification for WP: from n/a through <= 1.5.3.
Product
All push notification for WP
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update All push notification for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025ALD Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-32518 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hossainawlad ALD Login Page ald-login-page allows Stored XSS.This issue affects ALD Login Page: from n/a through <= 1.1.
Product
ALD Login Page
Affected
up to 1.1
What to do
Affects up to 1.1. Update ALD Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025MultiMailer: Cross-Site Request Forgery (CSRF)CVE-2025-32505 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in SCAND MultiMailer scand-multi-mailer allows Stored XSS.This issue affects MultiMailer: from n/a through <= 1.0.3.
Product
MultiMailer
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update MultiMailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025ePaper Lister for Yumpu: Cross-Site Request Forgery (CSRF)CVE-2025-32502 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in lemmentwickler ePaper Lister for Yumpu magazine-lister-for-yumpu allows Stored XSS.This issue affects ePaper Lister for Yumpu: from n/a through <= 1.4.0.
Product
ePaper Lister for Yumpu
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update ePaper Lister for Yumpu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Rentsyst: Cross-Site Request Forgery (CSRF)CVE-2025-32501 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dimafreund Rentsyst rentsyst allows Stored XSS.This issue affects Rentsyst: from n/a through <= 2.0.92.
Product
Rentsyst
Affected
up to 2.0.92
What to do
Affects up to 2.0.92. Update Rentsyst to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Codescar Radio Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32500 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sudavar Codescar Radio Widget codescar-radio-widget allows Stored XSS.This issue affects Codescar Radio Widget: from n/a through <= 0.4.2.
Product
Codescar Radio Widget
Affected
up to 0.4.2
What to do
Affects up to 0.4.2. Update Codescar Radio Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025VKontakte Cross-Post: Cross-Site Request Forgery (CSRF)CVE-2025-32498 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in oleglark VKontakte Cross-Post vkontakte-cross-post allows Stored XSS.This issue affects VKontakte Cross-Post: from n/a through <= 0.3.2.
Product
VKontakte Cross-Post
Affected
up to 0.3.2
What to do
Affects up to 0.3.2. Update VKontakte Cross-Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Spoiler Block: Cross-Site Request Forgery (CSRF)CVE-2025-32497 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in squiter Spoiler Block spoiler-block allows Stored XSS.This issue affects Spoiler Block: from n/a through <= 1.7.
Product
Spoiler Block
Affected
up to 1.7
What to do
Affects up to 1.7. Update Spoiler Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Ultra Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2025-32496 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web Shell to a Web Server.This issue affects Ultra Demo Importer: from n/a through <= 1.0.5.
Product
Ultra Demo Importer
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Ultra Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025reCAPTCHA Jetpack: Cross-Site Request Forgery (CSRF)CVE-2025-32494 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bozdoz reCAPTCHA Jetpack recaptcha-jetpack allows Cross Site Request Forgery.This issue affects reCAPTCHA Jetpack: from n/a through <= 0.2.2.
Product
reCAPTCHA Jetpack
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Waymark: Server-Side Request Forgery (SSRF)CVE-2025-32487 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Joe Waymark waymark allows Server Side Request Forgery.This issue affects Waymark: from n/a through <= 1.5.2.
Product
Waymark
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Waymark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP Performance Pack: Cross-Site Request Forgery (CSRF)CVE-2025-32485 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Cross Site Request Forgery.This issue affects WP Performance Pack: from n/a through <= 2.5.4.
Product
WP Performance Pack
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update WP Performance Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP-Planification: Cross-Site Request Forgery (CSRF)CVE-2025-32484 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WP-Planification wp-planification allows Stored XSS.This issue affects WP-Planification: from n/a through <= 2.3.1.
Product
WP-Planification
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WP-Planification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Request Call Back: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32483 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Salisbury Request Call Back request-call-back allows Stored XSS.This issue affects Request Call Back: from n/a through <= 1.4.1.
Product
Request Call Back
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Request Call Back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Custom Smilies: Cross-Site Request Forgery (CSRF)CVE-2025-32482 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in quanganhdo Custom Smilies custom-smilies allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 1.2.
Product
Custom Smilies
Affected
up to 1.2
What to do
Affects up to 1.2. Update Custom Smilies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Nino Social Connect: Cross-Site Request Forgery (CSRF)CVE-2025-32481 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect: from n/a through <= 2.0.
Product
Nino Social Connect
Affected
up to 2.0
What to do
Affects up to 2.0. Update Nino Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Windows Live Writer: Cross-Site Request Forgery (CSRF)CVE-2025-32480 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dalziel Windows Live Writer windows-live-writer allows Stored XSS.This issue affects Windows Live Writer: from n/a through <= 0.1.
Product
Windows Live Writer
Affected
up to 0.1
What to do
Affects up to 0.1. Update Windows Live Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Flags Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32479 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through <= 1.0.7.
Product
Flags Widget
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Flags Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP SexyLightBox: Cross-Site Request Forgery (CSRF)CVE-2025-32478 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through <= 0.5.3.
Product
WP SexyLightBox
Affected
up to 0.5.3
What to do
Affects up to 0.5.3. Update WP SexyLightBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WP-Easy Menu: Cross-Site Request Forgery (CSRF)CVE-2025-32477 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jordi Salord WP-Easy Menu wp-easy-menu allows Stored XSS.This issue affects WP-Easy Menu: from n/a through <= 0.41.
Product
WP-Easy Menu
Affected
up to 0.41
What to do
Affects up to 0.41. Update WP-Easy Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025Advanced Tag Lists: Cross-Site Request Forgery (CSRF)CVE-2025-32476 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in blueinstyle Advanced Tag Lists advanced-tag-list allows Stored XSS.This issue affects Advanced Tag Lists: from n/a through <= 1.2.
Product
Advanced Tag Lists
Affected
up to 1.2
What to do
Affects up to 1.2. Update Advanced Tag Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025AF Tell a Friend: Cross-Site Request Forgery (CSRF)CVE-2025-31404 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Wladyslaw Madejczyk AF Tell a Friend af-tell-a-friend allows Stored XSS.This issue affects AF Tell a Friend: from n/a through <= 1.4.
Product
AF Tell a Friend
Affected
up to 1.4
What to do
Affects up to 1.4. Update AF Tell a Friend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025NewsBoard Post and RSS Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-31402 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in NewsBoard Plugin NewsBoard Post and RSS Scroller newsboard allows Stored XSS.This issue affects NewsBoard Post and RSS Scroller: from n/a through <= 1.2.12.
Product
NewsBoard Post and RSS Scroller
Affected
up to 1.2.12
What to do
Affects up to 1.2.12. Update NewsBoard Post and RSS Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025MMX – Make Me Christmas: Cross-Site Request Forgery (CSRF)CVE-2025-31401 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Christmas: from n/a through <= 1.0.0.
Product
MMX – Make Me Christmas
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update MMX – Make Me Christmas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 9, 2025WS Audio Player: Cross-Site Request Forgery (CSRF)CVE-2025-31400 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through <= 1.1.8.
Product
WS Audio Player
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update WS Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.