Updated 20 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

439new WordPress flaws this week

394,398entries in the database

41,159 results · page 342 of 824

May 23, 2025Butcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32285 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Butcher butcher allows Reflected XSS.This issue affects Butcher: from n/a through < 2.54.
Product
Butcher
What to do
Update Butcher to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025Pet World: Deserialization of Untrusted DataCVE-2025-32284 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Pet World petsworld allows Object Injection.This issue affects Pet World: from n/a through <= 2.8.
Product
Pet World
Affected
up to 2.8
What to do
Affects up to 2.8. Update Pet World to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Acerola: Deserialization of Untrusted DataCVE-2025-31927 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.
Product
Acerola
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Acerola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Crafts & Arts: Deserialization of Untrusted DataCVE-2025-31924 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Crafts & Arts crafts-and-arts allows Object Injection.This issue affects Crafts & Arts: from n/a through <= 2.5.
Product
Crafts & Arts
Affected
up to 2.5
What to do
Affects up to 2.5. Update Crafts & Arts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Simple Business Directory Pro: Incorrect Privilege AssignmentCVE-2025-31918 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue affects Simple Business Directory Pro: from n/a through < 15.6.9.
Product
Simple Business Directory Pro
What to do
Update Simple Business Directory Pro to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025JP Students Result Management System Premium: Unrestricted Upload of File with Dangerous TypeCVE-2025-31916 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in joy2012bd JP Students Result Management System Premium allows Upload a Web Shell to a Web Server. This issue affects JP Students Result Management System Premium: from 1.1.7 through n/a.
Product
JP Students Result Management System Premium
What to do
Update JP Students Result Management System Premium to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025Pixel WordPress Form BuilderPlugin & Autoresponder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31914 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Blind SQL Injection.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1.0.2.
Product
Pixel WordPress Form BuilderPlugin & Autoresponder
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Pixel WordPress Form BuilderPlugin & Autoresponder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Ogami: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31913 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Ogami ogami allows PHP Local File Inclusion.This issue affects Ogami: from n/a through <= 1.53.
Product
Ogami
Affected
up to 1.53
What to do
Affects up to 1.53. Update Ogami to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Enzio - Responsive Business: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31912 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Enzio - Responsive Business WordPress Theme enzio allows PHP Local File Inclusion.This issue affects Enzio - Responsive Business WordPress Theme: from n/a through < 1.2.6.
Product
Enzio - Responsive Business
What to do
Update Enzio - Responsive Business to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025WP Post Modules for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31636 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaurabhSharma WP Post Modules for Elementor wp-post-modules-el allows Reflected XSS.This issue affects WP Post Modules for Elementor: from n/a through <= 2.5.0.
Product
WP Post Modules for Elementor
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update WP Post Modules for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Kiamo - Responsive Business Service: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31633 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kiamo - Responsive Business Service WordPress Theme allows PHP Local File Inclusion. This issue affects Kiamo - Responsive Business Service WordPress Theme: from n/a through 1.3.3.
Product
Kiamo - Responsive Business Service
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Kiamo - Responsive Business Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025La Boom: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31632 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SpyroPress La Boom allows PHP Local File Inclusion. This issue affects La Boom: from n/a through 2.7.
Product
La Boom
Affected
up to 2.7
What to do
Affects up to 2.7. Update La Boom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Fish House: Deserialization of Untrusted DataCVE-2025-31631 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Fish House fish-house allows Object Injection.This issue affects Fish House: from n/a through <= 1.2.7.
Product
Fish House
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Fish House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025The Business: Deserialization of Untrusted DataCVE-2025-31430 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton The Business allows Object Injection. This issue affects The Business: from n/a through 1.6.1.
Product
The Business
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update The Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Umberto: Deserialization of Untrusted DataCVE-2025-31423 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Umberto umberto allows Object Injection.This issue affects Umberto: from n/a through <= 1.2.8.
Product
Umberto
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Umberto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Bus Ticket Booking with Seat Reservation for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31397 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Bus Ticket Booking with Seat Reservation for WooCommerce scw-bus-seat-reservation allows SQL Injection.This issue affects Bus Ticket Booking with Seat Reservation for WooCommerce: from n/a through <= 1.7.
Product
Bus Ticket Booking with Seat Reservation for WooCommerce
Affected
up to 1.7
What to do
Affects up to 1.7. Update Bus Ticket Booking with Seat Reservation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025HotStar – Multi-Purpose Business: Deserialization of Untrusted DataCVE-2025-31069 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
Product
HotStar – Multi-Purpose Business
Affected
up to 1.4
What to do
Affects up to 1.4. Update HotStar – Multi-Purpose Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Vizeon - Business Consulting: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31064 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Vizeon - Business Consulting vizeon allows PHP Local File Inclusion.This issue affects Vizeon - Business Consulting: from n/a through < 1.2.1.
Product
Vizeon - Business Consulting
What to do
Update Vizeon - Business Consulting to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025Capie: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31060 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Capie capie allows PHP Local File Inclusion.This issue affects Capie: from n/a through <= 1.0.40.
Product
Capie
Affected
up to 1.0.40
What to do
Affects up to 1.0.40. Update Capie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31056 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce WhatsCart-for-WooCommerce allows SQL Injection.This issue affects WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce: from n/a through <= 1.1.0.
Product
WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025KBx Pro Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31053 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Path Traversal.This issue affects KBx Pro Ultimate: from n/a through < 8.0.5.
Product
KBx Pro Ultimate
What to do
Update KBx Pro Ultimate to the newest version.
Full record and what to do →NVD record patchstack.com
May 23, 2025Dash: Deserialization of Untrusted DataCVE-2025-31049 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.
Product
Dash
Affected
up to 1.3
What to do
Affects up to 1.3. Update Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Solid Mail – SMTP email and logging made by SolidWP: Stored Cross-Site ScriptingCVE-2025-1123 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Solid Mail – SMTP email and logging made by SolidWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email Name, Subject, and Body in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Solid Mail – SMTP email and logging made by SolidWP
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Solid Mail – SMTP email and logging made by SolidWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2025TablePress: DOM-Based Stored Cross-Site ScriptingCVE-2025-5096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data-s-content-padding', 'data-s-title', and 'data-footer' data-attributes in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TablePress
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update TablePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record datatables.net github.com
May 23, 2025Tournamatch: Stored Cross-Site ScriptingCVE-2025-4594 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tournamatch
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Tournamatch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2025Hot Random Image: Path TraversalCVE-2025-4419 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to access arbitrary images with allowed extensions, outside of the originally intended directory.
Product
Hot Random Image
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2025Hot Random Image: Stored Cross-Site ScriptingCVE-2025-4405 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Hot Random Image
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2025MapSVG: Stored Cross-Site ScriptingCVE-2024-9544 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 8.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
MapSVG
Affected
up to 8.6.4
What to do
Affects up to 8.6.4. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record simplepx.com wordfence.com
May 22, 2025Blog2Social: Social Media Auto Post & Scheduler: Does not escape the title of postsCVE-2025-4133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks.
Product
Blog2Social: Social Media Auto Post & Scheduler
Fixed in
8.4.0
What to do
Update Blog2Social: Social Media Auto Post & Scheduler to 8.4.0 or newer.
Full record and what to do →NVD record wpscan.com
May 22, 2025WooCommerce: PostMessage-Based Cross-Site ScriptingCVE-2025-5062 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WooCommerce
Affected
up to 9.4.2
What to do
Affects up to 9.4.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.woocommerce.com github.com
May 21, 2025Glossary by WPPedia – Best Glossary plugin for: PHP Object InjectionCVE-2025-4803 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.0 via deserialization of untrusted input from the 'posttypes' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Glossary by WPPedia – Best Glossary plugin for
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Glossary by WPPedia – Best Glossary plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 21, 2025Slim SEO – Fast & Automated WordPress SEO: Stored Cross-Site ScriptingCVE-2025-4611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs shortcode in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Slim SEO – Fast & Automated WordPress SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Slim SEO – Fast & Automated WordPress SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 21, 2025Animated Buttons: Stored Cross-Site ScriptingCVE-2025-4221 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Animated Buttons
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Animated Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025DPEPress: Stored Cross-Site ScriptingCVE-2025-4219 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DPEPress
Affected
up to 0.3
What to do
Affects up to 0.3. Update DPEPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025WP YouTube Video Optimizer: Stored Cross-Site ScriptingCVE-2025-4217 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP YouTube Video Optimizer
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP YouTube Video Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2025Splitit: Unauthorized modification of dataCVE-2025-4105 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin settings, including changing the environment from sandbox to production and vice versa.
Product
Splitit
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update Splitit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2025Raisely Donation Form: Stored Cross-Site ScriptingCVE-2025-3781 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Raisely Donation Form
Affected
up to 1.1
What to do
Affects up to 1.1. Update Raisely Donation Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2025Network Posts Extended: Stored Cross-Site ScriptingCVE-2025-3750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Network Posts Extended
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Network Posts Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
May 21, 2025Affiliate Sales in Google Analytics and other tools: Open RedirectCVE-2024-12561 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This is due to insufficient validation on the redirect url supplied via the 'afflink' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Product
Affiliate Sales in Google Analytics and other tools
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Affiliate Sales in Google Analytics and other tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2025Madara – Responsive and modern WordPress theme for manga sites: Local File InclusionCVE-2025-4524 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Madara – Responsive and modern WordPress theme for manga sites
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Madara – Responsive and modern WordPress theme for manga sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mangabooth.com wordfence.com
May 21, 2025DIGITS: WordPress Mobile Number Signup and Login: Does not rate limit OTP validation attemptsCVE-2025-4094 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
Product
DIGITS: WordPress Mobile Number Signup and Login
Fixed in
8.4.6.1
What to do
Update DIGITS: WordPress Mobile Number Signup and Login to 8.4.6.1 or newer.
Full record and what to do →NVD record wpscan.com
May 20, 2025Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in varioCVE-2024-5878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 20, 2025Motors: Privilege escalationCVE-2025-4322 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account.
Product
Motors
Affected
up to 5.6.67
What to do
Affects up to 5.6.67. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
May 20, 2025Order Delivery Date: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-2929 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Order Delivery Date
Fixed in
12.4.0
What to do
Update Order Delivery Date to 12.4.0 or newer.
Full record and what to do →NVD record wpscan.com
May 19, 2025User Profile Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-48340 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows Privilege Escalation.This issue affects User Profile Meta Manager: from n/a through <= 1.02.
Product
User Profile Meta Manager
Affected
up to 1.02
What to do
Affects up to 1.02. Update User Profile Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Section Widget: Path Traversal: '.../...//'CVE-2025-46441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Path Traversal: '.../...//' vulnerability in ctltwp Section Widget section-widget allows Path Traversal.This issue affects Section Widget: from n/a through <= 3.3.1.
Product
Section Widget
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Section Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39402 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
Product
WPAMS
Affected
up to 44.0
What to do
Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPAMS: Unrestricted Upload of File with Dangerous TypeCVE-2025-39401 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS apartment-management allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
Product
WPAMS
Affected
up to 44.0
What to do
Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WPAMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39395 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
Product
WPAMS
Affected
up to 44.0
What to do
Affects up to 44.0. Update WPAMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Hospital Management System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-39393 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management allows Reflected XSS.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-2023).
Product
Hospital Management System
Affected
up to 47.0
What to do
Affects up to 47.0. Update Hospital Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.