Vulnerability database

4,657 results · page 38 of 94

• Mar 26, 2025Zapier for: Server-Side Request ForgeryCVE-2024-13411 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

  Product

  Zapier for

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Zapier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 25, 2025WP Compress – Instant Performance & Speed Optimization: Server-Side Request ForgeryCVE-2025-2109 · WordPress plugins & themes · reported by WordfenceMedium 5.8

  The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.

  Product

  WP Compress – Instant Performance & Speed Optimization

  Affected

  up to 6.30.15

  What to do

  Affects up to 6.30.15. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 25, 2025EZ SQL Reports Shortcode Widget and DB Backup: Cross-Site Request ForgeryCVE-2025-2319 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due to missing or incorrect nonce validation on the 'ELISQLREPORTS_menu' function. This makes it possible for unauthenticated attackers to execute code on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Version 5.25.10 adds a nonce check, which makes this vulnerability exploitable by admins only.

  Product

  EZ SQL Reports Shortcode Widget and DB Backup

  Affected

  4.11.13 to 5.25.08

  What to do

  Affects 4.11.13 to 5.25.08. Update EZ SQL Reports Shortcode Widget and DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Mar 25, 2025Estatebud – Properties & Listings: Cross-Site Request ForgeryCVE-2024-13710 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due to missing or incorrect nonce validation on the 'estatebud_settings' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Estatebud – Properties & Listings

  Affected

  up to 5.5.0

  What to do

  Affects up to 5.5.0. Update Estatebud – Properties & Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• Mar 25, 2025teachPress: Cross-Site Request ForgeryCVE-2025-1320 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.9. This is due to missing or incorrect nonce validation on the import.php page. This makes it possible for unauthenticated attackers to delete imports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  teachPress

  Affected

  up to 9.0.9

  What to do

  Affects up to 9.0.9. Update teachPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Mar 25, 2025aoa-downloadable: Lacks authorization and authentication for requests to its downloadCVE-2024-13618 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.

  Product

  aoa-downloadable

  Affected

  up to 0.1.0

  What to do

  Affects up to 0.1.0. Update aoa-downloadable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Mar 24, 2025Translator: Cross-Site Request Forgery (CSRF)CVE-2025-30621 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in kornelly Translator translator allows Stored XSS.This issue affects Translator: from n/a through <= 0.3.

  Product

  Translator

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Translator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Odoo Form Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-30620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in coderscom WP Odoo Form Integrator wp-odoo-form-integrator allows Stored XSS.This issue affects WP Odoo Form Integrator: from n/a through <= 1.1.0.

  Product

  WP Odoo Form Integrator

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WP Odoo Form Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025SpeakPipe: Cross-Site Request Forgery (CSRF)CVE-2025-30619 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in SpeakPipe SpeakPipe speakpipe-voicemail-for-websites allows Cross Site Request Forgery.This issue affects SpeakPipe: from n/a through <= 0.2.

  Product

  SpeakPipe

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update SpeakPipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Rewrite: Cross-Site Request Forgery (CSRF)CVE-2025-30617 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in takien Rewrite rewrite allows Cross Site Request Forgery.This issue affects Rewrite: from n/a through <= 0.2.1.

  Product

  Rewrite

  Affected

  up to 0.2.1

  What to do

  Affects up to 0.2.1. Update Rewrite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP e-Commerce Style Email: Cross-Site Request Forgery (CSRF)CVE-2025-30615 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Code Injection.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.

  Product

  WP e-Commerce Style Email

  Affected

  up to 0.6.2

  What to do

  Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Replace Default Words: Cross-Site Request Forgery (CSRF)CVE-2025-30612 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mandegarweb Replace Default Words replace-default-words allows Stored XSS.This issue affects Replace Default Words: from n/a through <= 1.3.

  Product

  Replace Default Words

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Replace Default Words to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WordPress SQL Backup: Cross-Site Request Forgery (CSRF)CVE-2025-30608 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Anthony WordPress SQL Backup wordpress-sql-backup allows Stored XSS.This issue affects WordPress SQL Backup: from n/a through <= 3.5.2.

  Product

  WordPress SQL Backup

  Affected

  up to 3.5.2

  What to do

  Affects up to 3.5.2. Update WordPress SQL Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025CopyLink: Cross-Site Request Forgery (CSRF)CVE-2025-30603 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in DEJAN CopyLink copy-link allows Stored XSS.This issue affects CopyLink: from n/a through <= 1.1.

  Product

  CopyLink

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update CopyLink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Flipdish Ordering System: Cross-Site Request Forgery (CSRF)CVE-2025-30601 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in flipdish Flipdish Ordering System flipdish-ordering-system allows Cross Site Request Forgery.This issue affects Flipdish Ordering System: from n/a through <= 1.5.2.

  Product

  Flipdish Ordering System

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Flipdish Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025OSS Upload: Cross-Site Request Forgery (CSRF)CVE-2025-30598 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Link OSS Upload oss-upload allows Cross Site Request Forgery.This issue affects OSS Upload: from n/a through <= 4.8.9.

  Product

  OSS Upload

  Affected

  up to 4.8.9

  What to do

  Affects up to 4.8.9. Update OSS Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Map Contact: Cross-Site Request Forgery (CSRF)CVE-2025-30588 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through <= 3.0.4.

  Product

  Map Contact

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update Map Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025LH OGP Meta: Cross-Site Request Forgery (CSRF)CVE-2025-30587 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <= 1.73.

  Product

  LH OGP Meta

  Affected

  up to 1.73

  What to do

  Affects up to 1.73. Update LH OGP Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025cTabs: Cross-Site Request Forgery (CSRF)CVE-2025-30586 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through <= 1.3.

  Product

  cTabs

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update cTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Generate Post Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-30585 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue affects Generate Post Thumbnails: from n/a through <= 0.8.

  Product

  Generate Post Thumbnails

  Affected

  up to 0.8

  What to do

  Affects up to 0.8. Update Generate Post Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AlphaOmega Captcha & Anti-Spam Filter: Cross-Site Request Forgery (CSRF)CVE-2025-30584 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.

  Product

  AlphaOmega Captcha & Anti-Spam Filter

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update AlphaOmega Captcha & Anti-Spam Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Pro Rank Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-30583 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n/a through <= 1.0.0.

  Product

  Pro Rank Tracker

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Pro Rank Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025AdSense Privacy Policy: Cross-Site Request Forgery (CSRF)CVE-2025-30578 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy Policy: from n/a through <= 1.1.1.

  Product

  AdSense Privacy Policy

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update AdSense Privacy Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Browser Address Bar Color: Cross-Site Request Forgery (CSRF)CVE-2025-30577 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color browser-address-bar-color allows Stored XSS.This issue affects Browser Address Bar Color: from n/a through <= 3.3.

  Product

  Browser Address Bar Color

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Browser Address Bar Color to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Hacklog Remote Image Autosave: Cross-Site Request Forgery (CSRF)CVE-2025-30576 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery.This issue affects Hacklog Remote Image Autosave: from n/a through <= 2.1.0.

  Product

  Hacklog Remote Image Autosave

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Hacklog Remote Image Autosave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Simple Rating: Cross-Site Request Forgery (CSRF)CVE-2025-30572 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating simple-rating allows Stored XSS.This issue affects Simple Rating: from n/a through <= 1.4.

  Product

  Simple Rating

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Simple Rating to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Super Static Cache: Cross-Site Request Forgery (CSRF)CVE-2025-30568 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache super-static-cache allows Cross Site Request Forgery.This issue affects Super Static Cache: from n/a through <= 3.3.5.

  Product

  Super Static Cache

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update Super Static Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025banner-manager: Cross-Site Request Forgery (CSRF)CVE-2025-30565 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager banner-manager allows Stored XSS.This issue affects banner-manager: from n/a through <= 16.04.19.

  Product

  banner-manager

  Affected

  up to 16.04.19

  What to do

  Affects up to 16.04.19. Update banner-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Custom Script Integration: Cross-Site Request Forgery (CSRF)CVE-2025-30564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script Integration: from n/a through <= 2.1.

  Product

  Custom Script Integration

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update Custom Script Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025CAS Maestro: Cross-Site Request Forgery (CSRF)CVE-2025-30561 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through <= 1.1.3.

  Product

  CAS Maestro

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update CAS Maestro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025jQuery Dropdown Menu: Cross-Site Request Forgery (CSRF)CVE-2025-30560 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.

  Product

  jQuery Dropdown Menu

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update jQuery Dropdown Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025ANAC XML Render: Cross-Site Request Forgery (CSRF)CVE-2025-30558 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in EnzoCostantini55 ANAC XML Render anac-xml-render allows Stored XSS.This issue affects ANAC XML Render: from n/a through <= 1.5.7.

  Product

  ANAC XML Render

  Affected

  up to 1.5.7

  What to do

  Affects up to 1.5.7. Update ANAC XML Render to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Easy 301 Redirects: Cross-Site Request Forgery (CSRF)CVE-2025-30557 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects odihost-easy-redirect-301 allows Cross Site Request Forgery.This issue affects Easy 301 Redirects: from n/a through <= 1.33.

  Product

  Easy 301 Redirects

  Affected

  up to 1.33

  What to do

  Affects up to 1.33. Update Easy 301 Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Fix Rss Feeds: Cross-Site Request Forgery (CSRF)CVE-2025-30556 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds fix-rss-feed allows Cross Site Request Forgery.This issue affects Fix Rss Feeds: from n/a through <= 3.1.

  Product

  Fix Rss Feeds

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Fix Rss Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WordPres 同步微博: Cross-Site Request Forgery (CSRF)CVE-2025-30555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in iiiryan WordPres 同步微博 wp2wb allows Stored XSS.This issue affects WordPres 同步微博: from n/a through <= 1.1.0.

  Product

  WordPres 同步微博

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update WordPres 同步微博 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WordPress Admin Bar Improved: Cross-Site Request Forgery (CSRF)CVE-2025-30552 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Donald Gilbert WordPress Admin Bar Improved wordpress-admin-bar-improved allows Stored XSS.This issue affects WordPress Admin Bar Improved: from n/a through <= 3.3.5.

  Product

  WordPress Admin Bar Improved

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update WordPress Admin Bar Improved to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025CallPhone'r: Cross-Site Request Forgery (CSRF)CVE-2025-30550 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in WPShop.ru CallPhone'r callphoner allows Stored XSS.This issue affects CallPhone'r: from n/a through <= 1.1.1.

  Product

  CallPhone'r

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update CallPhone'r to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Yummly Rich Recipes: Cross-Site Request Forgery (CSRF)CVE-2025-30549 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes yummly-rich-recipes allows Cross Site Request Forgery.This issue affects Yummly Rich Recipes: from n/a through <= 4.2.

  Product

  Yummly Rich Recipes

  Affected

  up to 4.2

  What to do

  Affects up to 4.2. Update Yummly Rich Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Cackle: Cross-Site Request Forgery (CSRF)CVE-2025-30546 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in boroV Cackle cackle allows Cross Site Request Forgery.This issue affects Cackle: from n/a through <= 4.33.

  Product

  Cackle

  Affected

  up to 4.33

  What to do

  Affects up to 4.33. Update Cackle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025SoundCloud Ultimate: Cross-Site Request Forgery (CSRF)CVE-2025-30542 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in wpsolutions SoundCloud Ultimate soundcloud-ultimate allows Cross Site Request Forgery.This issue affects SoundCloud Ultimate: from n/a through <= 1.5.

  Product

  SoundCloud Ultimate

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update SoundCloud Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Info Boxes Shortcode and Widget: Cross-Site Request Forgery (CSRF)CVE-2025-30541 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Info Boxes Shortcode and Widget info-boxes-shortcode-and-widget allows Cross Site Request Forgery.This issue affects Info Boxes Shortcode and Widget: from n/a through <= 1.15.

  Product

  Info Boxes Shortcode and Widget

  Affected

  up to 1.15

  What to do

  Affects up to 1.15. Update Info Boxes Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Simple Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-30538 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Simple Optimizer simple-optimizer allows Cross Site Request Forgery.This issue affects Simple Optimizer: from n/a through <= 1.2.7.

  Product

  Simple Optimizer

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update Simple Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025External image replace: Cross-Site Request Forgery (CSRF)CVE-2025-30535 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in muro External image replace external-image-replace allows Cross Site Request Forgery.This issue affects External image replace: from n/a through <= 1.0.8.

  Product

  External image replace

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update External image replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Image Captcha: Cross-Site Request Forgery (CSRF)CVE-2025-30534 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through <= 1.2.

  Product

  Image Captcha

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Image Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025WP Ride Booking: Cross-Site Request Forgery (CSRF)CVE-2025-30531 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in GBS Developer WP Ride Booking wp-ride-booking allows Cross Site Request Forgery.This issue affects WP Ride Booking: from n/a through <= 2.4.

  Product

  WP Ride Booking

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update WP Ride Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Auto Load Next Post: Cross-Site Request Forgery (CSRF)CVE-2025-30529 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through <= 1.5.14.

  Product

  Auto Load Next Post

  Affected

  up to 1.5.14

  What to do

  Affects up to 1.5.14. Update Auto Load Next Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Awesome Logos: Cross-Site Request Forgery (CSRF)CVE-2025-30528 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Cross-Site Request Forgery (CSRF) vulnerability in wpshopee Awesome Logos awesome-logos allows SQL Injection.This issue affects Awesome Logos: from n/a through <= 1.2.

  Product

  Awesome Logos

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Awesome Logos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Typekit plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-30526 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in lucksy Typekit plugin for WordPress typekit allows Cross Site Request Forgery.This issue affects Typekit plugin for WordPress: from n/a through <= 1.2.3.

  Product

  Typekit plugin for

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Typekit plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025Contact Form 7 Material Design: Cross-Site Request Forgery (CSRF)CVE-2025-30522 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This issue affects Contact Form 7 Material Design: from n/a through <= 1.0.0.

  Product

  Contact Form 7 Material Design

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Contact Form 7 Material Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 24, 2025GP Back To Top: Cross-Site Request Forgery (CSRF)CVE-2025-30521 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in giangmd93 GP Back To Top gp-back-to-top allows Cross Site Request Forgery.This issue affects GP Back To Top: from n/a through <= 3.0.

  Product

  GP Back To Top

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update GP Back To Top to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.