Vulnerability database

41,188 results · page 374 of 824

• Apr 9, 2025Flags Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32479 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through <= 1.0.7.

  Product

  Flags Widget

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Flags Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP SexyLightBox: Cross-Site Request Forgery (CSRF)CVE-2025-32478 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through <= 0.5.3.

  Product

  WP SexyLightBox

  Affected

  up to 0.5.3

  What to do

  Affects up to 0.5.3. Update WP SexyLightBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP-Easy Menu: Cross-Site Request Forgery (CSRF)CVE-2025-32477 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jordi Salord WP-Easy Menu wp-easy-menu allows Stored XSS.This issue affects WP-Easy Menu: from n/a through <= 0.41.

  Product

  WP-Easy Menu

  Affected

  up to 0.41

  What to do

  Affects up to 0.41. Update WP-Easy Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Advanced Tag Lists: Cross-Site Request Forgery (CSRF)CVE-2025-32476 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in blueinstyle Advanced Tag Lists advanced-tag-list allows Stored XSS.This issue affects Advanced Tag Lists: from n/a through <= 1.2.

  Product

  Advanced Tag Lists

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Advanced Tag Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025AF Tell a Friend: Cross-Site Request Forgery (CSRF)CVE-2025-31404 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Wladyslaw Madejczyk AF Tell a Friend af-tell-a-friend allows Stored XSS.This issue affects AF Tell a Friend: from n/a through <= 1.4.

  Product

  AF Tell a Friend

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update AF Tell a Friend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025NewsBoard Post and RSS Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-31402 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in NewsBoard Plugin NewsBoard Post and RSS Scroller newsboard allows Stored XSS.This issue affects NewsBoard Post and RSS Scroller: from n/a through <= 1.2.12.

  Product

  NewsBoard Post and RSS Scroller

  Affected

  up to 1.2.12

  What to do

  Affects up to 1.2.12. Update NewsBoard Post and RSS Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025MMX – Make Me Christmas: Cross-Site Request Forgery (CSRF)CVE-2025-31401 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Christmas: from n/a through <= 1.0.0.

  Product

  MMX – Make Me Christmas

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update MMX – Make Me Christmas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WS Audio Player: Cross-Site Request Forgery (CSRF)CVE-2025-31400 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through <= 1.1.8.

  Product

  WS Audio Player

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update WS Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025CG Scroll To Top: Cross-Site Request Forgery (CSRF)CVE-2025-31399 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n/a through <= 3.5.

  Product

  CG Scroll To Top

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update CG Scroll To Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Easy Custom CSS: Cross-Site Request Forgery (CSRF)CVE-2025-31395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Easy Custom CSS easy-custom-css allows Stored XSS.This issue affects Easy Custom CSS: from n/a through <= 1.0.

  Product

  Easy Custom CSS

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Easy Custom CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025More Mime Type Filters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey (trepmal) More Mime Type Filters more-mime-type-filters allows Stored XSS.This issue affects More Mime Type Filters: from n/a through <= 0.3.

  Product

  More Mime Type Filters

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update More Mime Type Filters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Social Bookmarking RELOADED: Cross-Site Request Forgery (CSRF)CVE-2025-31393 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED social-bookmarking-reloaded allows Stored XSS.This issue affects Social Bookmarking RELOADED: from n/a through <= 3.18.

  Product

  Social Bookmarking RELOADED

  Affected

  up to 3.18

  What to do

  Affects up to 3.18. Update Social Bookmarking RELOADED to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Smart Product Gallery Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31392 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.This issue affects Smart Product Gallery Slider: from n/a through <= 1.0.4.

  Product

  Smart Product Gallery Slider

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Smart Product Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Script Compressor: Cross-Site Request Forgery (CSRF)CVE-2025-31391 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a through <= 1.7.1.

  Product

  Script Compressor

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Script Compressor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Social Crowd: Cross-Site Request Forgery (CSRF)CVE-2025-31390 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bdoga Social Crowd social-crowd allows Stored XSS.This issue affects Social Crowd: from n/a through <= 0.9.6.1.

  Product

  Social Crowd

  Affected

  up to 0.9.6.1

  What to do

  Affects up to 0.9.6.1. Update Social Crowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025The World: Cross-Site Request Forgery (CSRF)CVE-2025-31388 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in doa The World the-world allows Stored XSS.This issue affects The World: from n/a through <= 0.4.

  Product

  The World

  Affected

  up to 0.4

  What to do

  Affects up to 0.4. Update The World to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Site Table of Contents: Cross-Site Request Forgery (CSRF)CVE-2025-31385 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in intelcaprep Site Table of Contents site-table-of-contents allows Stored XSS.This issue affects Site Table of Contents: from n/a through <= 0.3.

  Product

  Site Table of Contents

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Site Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025FrescoChat Live Chat: Cross-Site Request Forgery (CSRF)CVE-2025-31383 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in sodena FrescoChat Live Chat flexytalk-widget allows Stored XSS.This issue affects FrescoChat Live Chat: from n/a through <= 3.2.6.

  Product

  FrescoChat Live Chat

  Affected

  up to 3.2.6

  What to do

  Affects up to 3.2.6. Update FrescoChat Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Language Field: Cross-Site Request Forgery (CSRF)CVE-2025-31382 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in theode Language Field language-field allows Stored XSS.This issue affects Language Field: from n/a through <= 0.9.

  Product

  Language Field

  Affected

  up to 0.9

  What to do

  Affects up to 0.9. Update Language Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Woo Product Feed For Marketing Channels: Missing AuthorizationCVE-2025-31377 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Product Feed For Marketing Channels: from n/a through <= 1.9.0.

  Product

  Woo Product Feed For Marketing Channels

  Affected

  up to 1.9.0

  What to do

  Affects up to 1.9.0. Update Woo Product Feed For Marketing Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Scheduled: Cross-Site Request Forgery (CSRF)CVE-2025-31375 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled scheduled allows Stored XSS.This issue affects Scheduled: from n/a through <= 1.0.

  Product

  Scheduled

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Scheduled to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Sandwich Adsense: Missing AuthorizationCVE-2025-31042 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in rtakao Sandwich Adsense firsth3tagadsense allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sandwich Adsense: from n/a through <= 4.0.2.

  Product

  Sandwich Adsense

  Affected

  up to 4.0.2

  What to do

  Affects up to 4.0.2. Update Sandwich Adsense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Essential Breadcrumbs: Cross-Site Request Forgery (CSRF)CVE-2025-31038 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Privilege Escalation.This issue affects Essential Breadcrumbs: from n/a through <= 1.1.1.

  Product

  Essential Breadcrumbs

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Essential Breadcrumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WPSolr: Cross-Site Request Forgery (CSRF)CVE-2025-31036 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in WPSOLR WPSolr wpsolr-free allows Privilege Escalation.This issue affects WPSolr: from n/a through <= 24.0.

  Product

  WPSolr

  Affected

  up to 24.0

  What to do

  Affects up to 24.0. Update WPSolr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WP Editor.md – The Perfect WordPress Markdown Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31035 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markdown Editor wp-editormd allows Stored XSS.This issue affects WP Editor.md – The Perfect WordPress Markdown Editor: from n/a through <= 10.2.1.

  Product

  WP Editor.md – The Perfect WordPress Markdown Editor

  Affected

  up to 10.2.1

  What to do

  Affects up to 10.2.1. Update WP Editor.md – The Perfect WordPress Markdown Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Customize Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-31034 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in AboZain Albanna Customize Login Page customize-login-page allows Cross Site Request Forgery.This issue affects Customize Login Page: from n/a through <= 1.1.

  Product

  Customize Login Page

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Buddypress Humanity: Cross-Site Request Forgery (CSRF)CVE-2025-31033 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity buddypress-humanity allows Cross Site Request Forgery.This issue affects Buddypress Humanity: from n/a through <= 1.2.

  Product

  Buddypress Humanity

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Buddypress Humanity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Pagopar – WooCommerce Gateway: Cross-Site Request Forgery (CSRF)CVE-2025-31032 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway pagopar-woocommerce-gateway allows Stored XSS.This issue affects Pagopar – WooCommerce Gateway: from n/a through <= 2.7.1.

  Product

  Pagopar – WooCommerce Gateway

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update Pagopar – WooCommerce Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Comment Validation Reloaded: Cross-Site Request Forgery (CSRF)CVE-2025-31026 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through <= 0.5.

  Product

  Comment Validation Reloaded

  Affected

  up to 0.5

  What to do

  Affects up to 0.5. Update Comment Validation Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Seo Meta Tags: Cross-Site Request Forgery (CSRF)CVE-2025-31023 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) vulnerability in Purab Seo Meta Tags seo-meta-tags allows Cross Site Request Forgery.This issue affects Seo Meta Tags: from n/a through <= 1.4.

  Product

  Seo Meta Tags

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Seo Meta Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Simple Spoiler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31020 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through <= 1.4.

  Product

  Simple Spoiler

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Simple Spoiler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Nav Menu Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31017 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Noakes Nav Menu Manager noakes-menu-manager allows Stored XSS.This issue affects Nav Menu Manager: from n/a through <= 3.2.5.

  Product

  Nav Menu Manager

  Affected

  up to 3.2.5

  What to do

  Affects up to 3.2.5. Update Nav Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Age Gate: Missing AuthorizationCVE-2025-31012 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Phil Age Gate age-gate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Age Gate: from n/a through <= 3.5.4.

  Product

  Age Gate

  Affected

  up to 3.5.4

  What to do

  Affects up to 3.5.4. Update Age Gate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025IndieBlocks: Server-Side Request Forgery (SSRF)CVE-2025-31009 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from n/a through <= 0.13.1.

  Product

  IndieBlocks

  Affected

  up to 0.13.1

  What to do

  Affects up to 0.13.1. Update IndieBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025YouTube Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31008 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through <= 5.3.1.

  Product

  YouTube Embed

  Affected

  up to 5.3.1

  What to do

  Affects up to 5.3.1. Update YouTube Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Easyfonts: Cross-Site Request Forgery (CSRF)CVE-2025-31005 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Uzair Easyfonts easyfonts allows Cross Site Request Forgery.This issue affects Easyfonts: from n/a through <= 1.1.2.

  Product

  Easyfonts

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Easyfonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Rich Table of Contents: Missing AuthorizationCVE-2025-31004 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Croover.inc Rich Table of Contents rich-table-of-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rich Table of Contents: from n/a through <= 1.4.0.

  Product

  Rich Table of Contents

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Rich Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Squeeze: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31003 · WordPress plugins & themes · reported by PatchstackLow 2.7

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitive Data.This issue affects Squeeze: from n/a through <= 1.6.

  Product

  Squeeze

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025Squeeze: Unrestricted Upload of File with Dangerous TypeCVE-2025-31002 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: from n/a through <= 1.6.

  Product

  Squeeze

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2025WordPress/Plugin Upgrade Time Out: Does not have CSRF check in some placesCVE-2024-8243 · WordPress plugins & themes · reported by WPScanMedium 6.3

  The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

  Product

  WordPress/Plugin Upgrade Time Out

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WordPress/Plugin Upgrade Time Out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Apr 9, 2025WP MultiTasking: Does not have CSRF checkCVE-2024-6860 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack

  Product

  WP MultiTasking

  Affected

  up to 0.1.12

  What to do

  Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Apr 9, 2025WP MultiTasking: Does not have CSRF checkCVE-2024-6857 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack

  Product

  WP MultiTasking

  Affected

  up to 0.1.12

  What to do

  Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Apr 9, 2025WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts: Stored Cross-Site ScriptingCVE-2025-3100 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

  Product

  WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts

  Affected

  up to 2.6.22

  What to do

  Affects up to 2.6.22. Update WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 8, 2025Live Forms: Missing AuthorizationCVE-2025-32279 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <= 4.8.5.

  Product

  Live Forms

  Affected

  up to 4.8.5

  What to do

  Affects up to 4.8.5. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2025Broadstreet Ads: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32211 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.

  Product

  Broadstreet Ads

  Affected

  up to 1.52.1

  What to do

  Affects up to 1.52.1. Update Broadstreet Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2025m1.DownloadList: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32164 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows Retrieve Embedded Sensitive Data.This issue affects m1.DownloadList: from n/a through <= 0.24.

  Product

  m1.DownloadList

  Affected

  up to 0.24

  What to do

  Affects up to 0.24. Update m1.DownloadList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2025Widgetize Pages Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32117 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.

  Product

  Widgetize Pages Light

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Widgetize Pages Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2025MelaPress Login Security and MelaPress Login Security Premium: Unauthorized loss of dataCVE-2025-2876 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor_admin_actions' function in version 2.1.0. This makes it possible for unauthenticated attackers to delete any user.

  Product

  MelaPress Login Security and MelaPress Login Security Premium

  What to do

  Update MelaPress Login Security and MelaPress Login Security Premium to the newest version.

  Full record and what to do →NVD recordmelapress.complugins.trac.wordpress.org

• Apr 8, 2025Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Unauthorized access and modification of dataCVE-2025-2568 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayu_blocks_get_toggle_switch_values_callback' and 'vayu_blocks_save_toggle_switch_callback' function in versions 1.0.4 to 1.2.1. This makes it possible for unauthenticated attackers to read plugin options and update any option with a key name ending in '_value'.

  Product

  Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce

  Affected

  1.0.4 to 1.2.1

  What to do

  Affects 1.0.4 to 1.2.1. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 8, 2025Motors – Car Dealership & Classified Listings: Unauthorized modification of dataCVE-2025-3437 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in the ajax_actions.php file in all versions up to, and including, 1.4.66. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute several initial set-up actions.

  Product

  Motors – Car Dealership & Classified Listings

  Affected

  up to 1.4.66

  What to do

  Affects up to 1.4.66. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.