Updated 55 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

4,221 results · page 36 of 85

Feb 16, 2025Content Snippet Manager: Cross-Site Request Forgery (CSRF)CVE-2025-26759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager content-snippet-manager allows Stored XSS.This issue affects Content Snippet Manager: from n/a through <= 1.1.5.
Product
Content Snippet Manager
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Content Snippet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 15, 2025Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive: Server-Side Request ForgeryCVE-2024-13834 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.4 via the 'remote_request' function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 15, 2025DirectoryPress Frontend: Cross-Site Request ForgeryCVE-2024-10581 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfl_listingStatusChange() function. This makes it possible for unauthenticated attackers to update listing statuses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
DirectoryPress Frontend
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update DirectoryPress Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2025WP Coder: Cross-Site Request Forgery (CSRF)CVE-2025-24699 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company WP Coder wp-coder allows Cross-Site Scripting (XSS).This issue affects WP Coder: from n/a through <= 3.6.
Product
WP Coder
Affected
up to 3.6
What to do
Affects up to 3.6. Update WP Coder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Disqus Popular Posts: Cross-Site Request Forgery (CSRF)CVE-2025-22705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts disqus-popular-posts allows Reflected XSS.This issue affects Disqus Popular Posts: from n/a through <= 2.1.1.
Product
Disqus Popular Posts
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Disqus Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025TinyMCE Advanced qTranslate fix editor problems: Cross-Site Request Forgery (CSRF)CVE-2025-26582 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems allows Stored XSS.This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through <= 1.0.0.
Product
TinyMCE Advanced qTranslate fix editor problems
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update TinyMCE Advanced qTranslate fix editor problems to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Page/Post Specific Social Share Buttons: Cross-Site Request Forgery (CSRF)CVE-2025-26580 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Complete SEO Page/Post Specific Social Share Buttons pagepost-specific-social-share-buttons allows Stored XSS.This issue affects Page/Post Specific Social Share Buttons: from n/a through <= 2.1.
Product
Page/Post Specific Social Share Buttons
Affected
up to 2.1
What to do
Affects up to 2.1. Update Page/Post Specific Social Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Simple Documentation: Cross-Site Request Forgery (CSRF)CVE-2025-26578 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mathieuhays Simple Documentation client-documentation allows Stored XSS.This issue affects Simple Documentation: from n/a through <= 1.2.8.
Product
Simple Documentation
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Simple Documentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025DX-auto-publish: Cross-Site Request Forgery (CSRF)CVE-2025-26577 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in daxiawp DX-auto-publish dx-auto-publish allows Stored XSS.This issue affects DX-auto-publish: from n/a through <= 1.2.
Product
DX-auto-publish
Affected
up to 1.2
What to do
Affects up to 1.2. Update DX-auto-publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025WP PHPList: Cross-Site Request Forgery (CSRF)CVE-2025-26572 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jesseheap WP PHPList phplist-form-integration allows Cross Site Request Forgery.This issue affects WP PHPList: from n/a through <= 1.7.
Product
WP PHPList
Affected
up to 1.7
What to do
Affects up to 1.7. Update WP PHPList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Wibiya Toolbar: Cross-Site Request Forgery (CSRF)CVE-2025-26571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wibiya Wibiya Toolbar wibiya allows Cross Site Request Forgery.This issue affects Wibiya Toolbar: from n/a through <= 2.0.
Product
Wibiya Toolbar
Affected
up to 2.0
What to do
Affects up to 2.0. Update Wibiya Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Glance That: Cross-Site Request Forgery (CSRF)CVE-2025-26570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in uamv Glance That allows Cross Site Request Forgery. This issue affects Glance That: from n/a through 4.9.
Product
Glance That
Affected
up to 4.9
What to do
Affects up to 4.9. Update Glance That to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Post Thumbs: Cross-Site Request Forgery (CSRF)CVE-2025-26569 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5.
Product
Post Thumbs
Affected
up to 1.5
What to do
Affects up to 1.5. Update Post Thumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Easy Amazon Product Information: Cross-Site Request Forgery (CSRF)CVE-2025-26568 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jensmueller Easy Amazon Product Information easy-amazon-product-information allows Stored XSS.This issue affects Easy Amazon Product Information: from n/a through <= 4.0.1.
Product
Easy Amazon Product Information
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Easy Amazon Product Information to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025RSS Filter: Cross-Site Request Forgery (CSRF)CVE-2025-26562 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik RSS Filter rss-filter allows Stored XSS.This issue affects RSS Filter: from n/a through <= 1.2.
Product
RSS Filter
Affected
up to 1.2
What to do
Affects up to 1.2. Update RSS Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Global Meta Keyword & Description: Cross-Site Request Forgery (CSRF)CVE-2025-26550 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kunal Shivale Global Meta Keyword & Description global-meta-keyword-and-description allows Stored XSS.This issue affects Global Meta Keyword & Description: from n/a through <= 2.3.
Product
Global Meta Keyword & Description
Affected
up to 2.3
What to do
Affects up to 2.3. Update Global Meta Keyword & Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025WP Html Page Sitemap: Cross-Site Request Forgery (CSRF)CVE-2025-26549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in pa1 WP Html Page Sitemap wp-html-page-sitemap allows Stored XSS.This issue affects WP Html Page Sitemap: from n/a through <= 2.2.
Product
WP Html Page Sitemap
Affected
up to 2.2
What to do
Affects up to 2.2. Update WP Html Page Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025My Login Logout: Cross-Site Request Forgery (CSRF)CVE-2025-26547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nagarjunsonti My Login Logout Plugin my-loginlogout allows Stored XSS.This issue affects My Login Logout Plugin: from n/a through <= 2.4.
Product
My Login Logout
Affected
up to 2.4
What to do
Affects up to 2.4. Update My Login Logout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Related Posts Line-up-Exactly by Milliard: Cross-Site Request Forgery (CSRF)CVE-2025-26545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in shisuh Related Posts Line-up-Exactly by Milliard related-posts-line-up-exactry-by-milliard allows Stored XSS.This issue affects Related Posts Line-up-Exactly by Milliard: from n/a through <= 0.0.22.
Product
Related Posts Line-up-Exactly by Milliard
Affected
up to 0.0.22
What to do
Affects up to 0.0.22. Update Related Posts Line-up-Exactly by Milliard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Simple Responsive Menu: Cross-Site Request Forgery (CSRF)CVE-2025-26543 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pukhraj Suthar Simple Responsive Menu simple-responsive-menu allows Stored XSS.This issue affects Simple Responsive Menu: from n/a through <= 2.1.
Product
Simple Responsive Menu
Affected
up to 2.1
What to do
Affects up to 2.1. Update Simple Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 12, 2025WP Abstracts: Cross-Site Request ForgeryCVE-2024-12386 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Abstracts
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 12, 2025Book a Room: Cross-Site Request ForgeryCVE-2024-13437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroom_Settings' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Book a Room
Affected
up to 2.9
What to do
Affects up to 2.9. Update Book a Room to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 11, 2025Houzez Property Feed: Cross-Site Request ForgeryCVE-2025-0808 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed exports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Houzez Property Feed
Affected
up to 2.4.21
What to do
Affects up to 2.4.21. Update Houzez Property Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 11, 2025StaffList: Cross-Site Request ForgeryCVE-2024-13749 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation on the 'stafflist' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
StaffList
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update StaffList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2025WP All Import Pro: Cross-Site Request ForgeryCVE-2024-9661 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP All Import Pro
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpallimport.com
Feb 7, 2025BookPress – For Book Authors: Cross-Site Request Forgery (CSRF)CVE-2025-25168 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Black and White BookPress – For Book Authors book-press allows Cross-Site Scripting (XSS).This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.
Product
BookPress – For Book Authors
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update BookPress – For Book Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025InLocation: Cross-Site Request Forgery (CSRF)CVE-2025-25166 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation inlocation allows Stored XSS.This issue affects InLocation: from n/a through <= 1.8.
Product
InLocation
Affected
up to 1.8
What to do
Affects up to 1.8. Update InLocation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Style Tweaker: Cross-Site Request Forgery (CSRF)CVE-2025-25160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through <= 0.11.
Product
Style Tweaker
Affected
up to 0.11
What to do
Affects up to 0.11. Update Style Tweaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Quote Comments: Cross-Site Request Forgery (CSRF)CVE-2025-25156 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments quote-comments allows Stored XSS.This issue affects Quote Comments: from n/a through <= 3.0.0.
Product
Quote Comments
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Quote Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Custom Comment Notifications: Cross-Site Request Forgery (CSRF)CVE-2025-25154 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications custom-comment-notifications allows Stored XSS.This issue affects Custom Comment Notifications: from n/a through <= 1.0.8.
Product
Custom Comment Notifications
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Custom Comment Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Simple Auto Tag: Cross-Site Request Forgery (CSRF)CVE-2025-25153 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.
Product
Simple Auto Tag
Affected
up to 1.1
What to do
Affects up to 1.1. Update Simple Auto Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Smart DoFollow: Cross-Site Request Forgery (CSRF)CVE-2025-25152 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a through <= 1.0.2.
Product
Smart DoFollow
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Smart DoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Login-box: Cross-Site Request Forgery (CSRF)CVE-2025-25149 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4.
Product
Login-box
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Login-box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Read More Copy Link: Cross-Site Request Forgery (CSRF)CVE-2025-25148 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link read-more-copy-link allows Stored XSS.This issue affects Read More Copy Link: from n/a through <= 1.0.2.
Product
Read More Copy Link
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Read More Copy Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Auto SEO: Cross-Site Request Forgery (CSRF)CVE-2025-25147 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through <= 2.5.6.
Product
Auto SEO
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Auto SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Songkick Concerts and Festivals: Cross-Site Request Forgery (CSRF)CVE-2025-25146 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery.This issue affects Songkick Concerts and Festivals: from n/a through <= 0.9.7.
Product
Songkick Concerts and Festivals
Affected
up to 0.9.7
What to do
Affects up to 0.9.7. Update Songkick Concerts and Festivals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Infusionsoft Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-25145 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics infusionsoft-web-tracker allows Cross Site Request Forgery.This issue affects Infusionsoft Analytics: from n/a through <= 2.0.
Product
Infusionsoft Analytics
Affected
up to 2.0
What to do
Affects up to 2.0. Update Infusionsoft Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025GlobalQuran: Cross-Site Request Forgery (CSRF)CVE-2025-25143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ibasit GlobalQuran globalquran allows Cross Site Request Forgery.This issue affects GlobalQuran: from n/a through <= 1.0.
Product
GlobalQuran
Affected
up to 1.0
What to do
Affects up to 1.0. Update GlobalQuran to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Simple User Profile: Cross-Site Request Forgery (CSRF)CVE-2025-25140 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through <= 1.9.
Product
Simple User Profile
Affected
up to 1.9
What to do
Affects up to 1.9. Update Simple User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025WP Custom Post RSS Feed: Cross-Site Request Forgery (CSRF)CVE-2025-25139 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Cynob IT Consultancy WP Custom Post RSS Feed wp-custom-post-rss-feed allows Stored XSS.This issue affects WP Custom Post RSS Feed: from n/a through <= 1.0.0.
Product
WP Custom Post RSS Feed
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP Custom Post RSS Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025On Page SEO + Whatsapp Chat Button: Cross-Site Request Forgery (CSRF)CVE-2025-25138 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through <= 2.0.0.
Product
On Page SEO + Whatsapp Chat Button
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update On Page SEO + Whatsapp Chat Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Custom Links On Admin Dashboard Toolbar: Cross-Site Request Forgery (CSRF)CVE-2025-25135 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar customize-wpadmin allows Stored XSS.This issue affects Custom Links On Admin Dashboard Toolbar: from n/a through <= 3.3.
Product
Custom Links On Admin Dashboard Toolbar
Affected
up to 3.3
What to do
Affects up to 3.3. Update Custom Links On Admin Dashboard Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Facilita Form Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-25128 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker facilita-form-tracker allows Stored XSS.This issue affects Facilita Form Tracker: from n/a through <= 1.0.
Product
Facilita Form Tracker
Affected
up to 1.0
What to do
Affects up to 1.0. Update Facilita Form Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025ZMSEO: Cross-Site Request Forgery (CSRF)CVE-2025-25126 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in zmseo ZMSEO zmseo allows Stored XSS.This issue affects ZMSEO: from n/a through <= 1.14.1.
Product
ZMSEO
Affected
up to 1.14.1
What to do
Affects up to 1.14.1. Update ZMSEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Fyrebox Quizzes: Cross-Site Request Forgery (CSRF)CVE-2025-25125 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.
Product
Fyrebox Quizzes
Affected
up to 3.1
What to do
Affects up to 3.1. Update Fyrebox Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Easy Related Posts: Cross-Site Request Forgery (CSRF)CVE-2025-25123 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in xdark Easy Related Posts easy-related-posts allows Stored XSS.This issue affects Easy Related Posts: from n/a through <= 2.0.2.
Product
Easy Related Posts
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Easy Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025WP Spell Check: Cross-Site Request Forgery (CSRF)CVE-2025-25111 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell Check: from n/a through <= 9.21.
Product
WP Spell Check
Affected
up to 9.21
What to do
Affects up to 9.21. Update WP Spell Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025OneStore Sites: Cross-Site Request Forgery (CSRF)CVE-2025-25107 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites onestore-sites allows Cross Site Request Forgery.This issue affects OneStore Sites: from n/a through <= 0.1.1.
Product
OneStore Sites
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update OneStore Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025Starter Templates by FancyWP: Cross-Site Request Forgery (CSRF)CVE-2025-25106 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP starter-templates allows Cross Site Request Forgery.This issue affects Starter Templates by FancyWP: from n/a through <= 2.0.0.
Product
Starter Templates by FancyWP
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Starter Templates by FancyWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 7, 2025URL-Preview-Box: Cross-Site Request Forgery (CSRF)CVE-2025-25104 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box good-url-preview-box allows Cross Site Request Forgery.This issue affects URL-Preview-Box: from n/a through <= 1.20.
Product
URL-Preview-Box
Affected
up to 1.20
What to do
Affects up to 1.20. Update URL-Preview-Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.