Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

471 results · page 4 of 10

Jun 14, 2025Easy Flashcards: Cross-Site Request ForgeryCVE-2025-6040 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Flashcards plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the 'ef_settings_submenu' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Flashcards
Affected
up to 0.1
What to do
Affects up to 0.1. Update Easy Flashcards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 12, 2025WP Sliding Login/Dashboard Panel: Cross-Site Request ForgeryCVE-2025-5928 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Sliding Login/Dashboard Panel
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WP Sliding Login/Dashboard Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 10, 2025Smash Balloon Social Post Feed – Simple Social Feeds for: Stored Cross-Site ScriptingCVE-2025-4577 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-color attribute in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smash Balloon Social Post Feed – Simple Social Feeds for
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Smash Balloon Social Post Feed – Simple Social Feeds for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2025The Fashion - Model Agency One Page Beauty: Deserialization of Untrusted DataCVE-2025-31052 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton The Fashion - Model Agency One Page Beauty Theme nrgfashion allows Object Injection.This issue affects The Fashion - Model Agency One Page Beauty Theme: from n/a through <= 1.4.4.
Product
The Fashion - Model Agency One Page Beauty
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update The Fashion - Model Agency One Page Beauty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025Valen - Sport, Fashion WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28945 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Valen - Sport, Fashion WooCommerce WordPress Theme valen allows PHP Local File Inclusion.This issue affects Valen - Sport, Fashion WooCommerce WordPress Theme: from n/a through <= 2.4.
Product
Valen - Sport, Fashion WooCommerce
Affected
up to 2.4
What to do
Affects up to 2.4. Update Valen - Sport, Fashion WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 6, 2025Frontend Dashboard: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through <= 2.2.8.
Product
Frontend Dashboard
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 30, 2025Featured Image Plus – Quick & Bulk Edit with Unsplash: Unauthorized modification of dataCVE-2025-4431 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fip_save_attach_featured function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update featured image of any post.
Product
Featured Image Plus – Quick & Bulk Edit with Unsplash
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Featured Image Plus – Quick & Bulk Edit with Unsplash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2025Gearside Developer Dashboard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-4429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Gearside Developer Dashboard
Affected
up to 1.0.72
What to do
Affects up to 1.0.72. Update Gearside Developer Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 29, 2025Smash Balloon Social Photo Feed – Easy Social Feeds: Stored Cross-Site ScriptingCVE-2025-4583 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribute in all versions up to, and including, 6.9.0 (Free) and 6.8.0 (Pro) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smash Balloon Social Photo Feed – Easy Social Feeds
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Smash Balloon Social Photo Feed – Easy Social Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2025Dash: Deserialization of Untrusted DataCVE-2025-31049 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.
Product
Dash
Affected
up to 1.3
What to do
Affects up to 1.3. Update Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025CiyaShop: Deserialization of Untrusted DataCVE-2025-39349 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Potenzaglobalsolutions CiyaShop ciyashop allows Object Injection.This issue affects CiyaShop: from n/a through <= 4.18.0.
Product
CiyaShop
Affected
up to 4.18.0
What to do
Affects up to 4.18.0. Update CiyaShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Flashy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23979 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duwasai Flashy allows Reflected XSS.This issue affects Flashy: from n/a through 1.2.1.
Product
Flashy
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Flashy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.2.
Product
Uncanny Toolkit for LearnDash
Affected
up to 3.7.0.2
What to do
Affects up to 3.7.0.2. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025WP Dashboard Notes: Does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX actionCVE-2023-7239 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.
Product
WP Dashboard Notes
Fixed in
1.0.11
What to do
Update WP Dashboard Notes to 1.0.11 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025LogDash Activity Log: Hooks the wp_login_failed function (from src/Hooks/UsersCVE-2023-6030 · WordPress plugins & themes · reported by WPScanMedium 5.4
The LogDash Activity Log WordPress plugin before 1.1.4 hooks the wp_login_failed function (from src/Hooks/Users.php) in order to log failed login attempts to the database but it doesn't escape the username when it perform some SQL request leading to a SQL injection vulnerability which can be exploited using time-based technique by unauthenticated attacker
Product
LogDash Activity Log
Fixed in
1.1.4
What to do
Update LogDash Activity Log to 1.1.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Remote Code ExecutionCVE-2025-3053 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.07 via the uip_process_form_input() function. This is due to the function taking user supplied inputs to execute arbitrary functions with arbitrary data, and does not have any sort of capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.07
What to do
Affects up to 3.5.07. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 13, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4474 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin’s 'register' role setting to make new user registrations default to the administrator role, leading to an elevation of privileges to that of an administrator.
Product
Frontend Dashboard
Affected
1.0 to 2.2.7
What to do
Affects 1.0 to 2.2.7. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4473 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions 1.0 to 2.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to control where the plugin sends outgoing emails. By pointing SMTP to their own server, attackers could capture password reset emails intended for administrators, and elevate their privileges for full site takeover.
Product
Frontend Dashboard
Affected
1.0 to 2.2.7
What to do
Affects 1.0 to 2.2.7. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 7, 2025N360 | Splash Screen: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47665 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bistromatic N360 | Splash Screen n360-splash-screen allows Stored XSS.This issue affects N360 | Splash Screen: from n/a through <= 1.0.6.
Product
N360 | Splash Screen
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update N360 | Splash Screen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Hash Form: Cross-Site Request Forgery (CSRF)CVE-2025-47468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in hashthemes Hash Form hash-form allows Cross Site Request Forgery.This issue affects Hash Form: from n/a through <= 1.2.8.
Product
Hash Form
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Hash Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Frontend Dashboard: Privilege EscalationCVE-2025-4104 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_wp_ajax_fed_login_form_post() function in versions 1.0 to 2.2.6. This makes it possible for unauthenticated attackers to reset the administrator’s email and password, and elevate their privileges to that of an administrator.
Product
Frontend Dashboard
Affected
1.0 to 2.2.6
What to do
Affects 1.0 to 2.2.6. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2025Smart Hashtags [#hashtagger]: Missing AuthorizationCVE-2025-46470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Peter Raschendorfer Smart Hashtags [#hashtagger] hashtagger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Hashtags [#hashtagger]: from n/a through <= 7.2.3.
Product
Smart Hashtags [#hashtagger]
Affected
up to 7.2.3
What to do
Affects up to 7.2.3. Update Smart Hashtags [#hashtagger] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Frontend Dashboard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-46248 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5.
Product
Frontend Dashboard
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Frontend Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Dashi: Missing AuthorizationCVE-2025-39580 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in jidaikobo Dashi dashi allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dashi: from n/a through <= 3.1.8.
Product
Dashi
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Dashi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Dashboard Notepads: Cross-Site Request Forgery (CSRF)CVE-2025-39441 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Dashboard Notepads dashboard-notepads allows Stored XSS.This issue affects Dashboard Notepads: from n/a through <= 1.2.1.
Product
Dashboard Notepads
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Dashboard Notepads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025WordPress Dashboard Tweeter: Missing AuthorizationCVE-2025-23906 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wpseek WordPress Dashboard Tweeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Dashboard Tweeter: from n/a through 1.3.2.
Product
WordPress Dashboard Tweeter
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update WordPress Dashboard Tweeter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Data Dash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22340 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Stored XSS.This issue affects Data Dash: from n/a through <= 1.2.3.
Product
Data Dash
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Data Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1525 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ultimate Dashboard
Fixed in
3.8.6
What to do
Update Ultimate Dashboard to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1524 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ultimate Dashboard
Fixed in
3.8.6
What to do
Update Ultimate Dashboard to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com
Apr 17, 2025Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2025-1523 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Ultimate Dashboard
Fixed in
3.8.6
What to do
Update Ultimate Dashboard to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com
Apr 15, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22268 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.1.
Product
Uncanny Toolkit for LearnDash
Affected
up to 3.7.0.1
What to do
Affects up to 3.7.0.1. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31014 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025ShareThis Dashboard for Google Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-32282 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ShareThis ShareThis Dashboard for Google Analytics googleanalytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through <= 3.2.3.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2025Chamber Dashboard Business Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32162 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Morgan Kay Chamber Dashboard Business Directory allows DOM-Based XSS. This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.11.
Product
Chamber Dashboard Business Directory
Affected
up to 3.3.11
What to do
Affects up to 3.3.11. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31097 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Material Dashboard: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31095 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Hossein Material Dashboard material-dashboard allows Authentication Bypass.This issue affects Material Dashboard: from n/a through <= 1.4.5.
Product
Material Dashboard
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025PostMash: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30622 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in torsteino PostMash postmash-custom allows SQL Injection.This issue affects PostMash: from n/a through <= 1.0.3.
Product
PostMash
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update PostMash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2025Ayyash Studio — The kick-start kit: Stored Cross-Site ScriptingCVE-2025-2576 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Ayyash Studio — The kick-start kit
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Ayyash Studio — The kick-start kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025Ultimate Dashboard – Custom WordPress Dashboard: Unauthorized modification of dataCVE-2025-2276 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_module_actions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules.
Product
Ultimate Dashboard – Custom WordPress Dashboard
Affected
up to 3.8.7
What to do
Affects up to 3.8.7. Update Ultimate Dashboard – Custom WordPress Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 19, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Unauthenticated Post TrashingCVE-2025-2290 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Affected
up to 8.0.1
What to do
Affects up to 8.0.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025ShareThis Dashboard for Google Analytics: Unauthorized modification of dataCVE-2025-1507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_actions() function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all features.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025CiyaShop - Multipurpose WooCommerce: PHP Object InjectionCVE-2024-13824 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deserialization of untrusted input in the 'add_ciyashop_wishlist' and 'ciyashop_get_compare' functions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
CiyaShop - Multipurpose WooCommerce
Affected
up to 4.19.0
What to do
Affects up to 4.19.0. Update CiyaShop - Multipurpose WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 11, 2025Hashtags: Cross-Site Request Forgery (CSRF)CVE-2025-28931 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DevriX Hashtags wp-hashtags allows Stored XSS.This issue affects Hashtags: from n/a through <= 0.3.2.
Product
Hashtags
Affected
up to 0.3.2
What to do
Affects up to 0.3.2. Update Hashtags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Custom Dashboard Page: Cross-Site Request Forgery (CSRF)CVE-2025-28912 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through <= 1.0.
Product
Custom Dashboard Page
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Dashboard Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 7, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of data that can lead to privilege escalationCVE-2025-1309 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the uip_save_form_as_option() function in all versions up to, and including, 3.5.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.04
What to do
Affects up to 3.5.04. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2025Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction: Unauthorized access to functionalityCVE-2024-13724 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their own wallet balance, transfer balances between arbitrary users and initiate transfer requests from other users' wallets.
Product
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2025Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction: Cross-Site Request ForgeryCVE-2024-13682 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in class-wallet-user-table.php. This makes it possible for unauthenticated attackers to modify wallet balances via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 3, 2025Flashfader: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27279 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lynk Flashfader flashfader allows Reflected XSS.This issue affects Flashfader: from n/a through <= 1.1.1.
Product
Flashfader
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Flashfader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025System Dashboard: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26911 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.
Product
System Dashboard
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2025C9 Admin Dashboard: Stored Cross-Site ScriptingCVE-2024-13379 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The C9 Admin Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
C9 Admin Dashboard
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update C9 Admin Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.