Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,221 results · page 40 of 85
Jan 16, 2025WP Background Tile: Cross-Site Request Forgery (CSRF)CVE-2025-23573 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sammyb WP Background Tile wp-background-tile allows Stored XSS.This issue affects WP Background Tile: from n/a through <= 1.0.
- Product
- WP Background Tile
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Background Tile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025UpDownUpDown: Cross-Site Request Forgery (CSRF)CVE-2025-23572 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Dave Konopka UpDownUpDown updownupdown-postcomment-voting allows Stored XSS.This issue affects UpDownUpDown: from n/a through <= 1.1.
- Product
- UpDownUpDown
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update UpDownUpDown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Shortcode in Comment: Cross-Site Request Forgery (CSRF)CVE-2025-23569 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kelvin Ng Shortcode in Comment shortcode-in-comment allows Stored XSS.This issue affects Shortcode in Comment: from n/a through <= 1.1.1.
- Product
- Shortcode in Comment
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Shortcode in Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025GDReseller: Cross-Site Request Forgery (CSRF)CVE-2025-23567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Tamer Ziady GDReseller gdreseller allows Stored XSS.This issue affects GDReseller: from n/a through <= 1.6.
- Product
- GDReseller
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update GDReseller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Custom Post: Cross-Site Request Forgery (CSRF)CVE-2025-23566 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in syedamirhussain91 Custom Post custom-post-type-gui allows Stored XSS.This issue affects Custom Post: from n/a through <= 1.0.
- Product
- Custom Post
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Custom Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Web Testimonials: Cross-Site Request Forgery (CSRF)CVE-2025-23560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in plumwd Web Testimonials web-testimonials allows Stored XSS.This issue affects Web Testimonials: from n/a through <= 1.2.
- Product
- Web Testimonials
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Web Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025MemeOne: Cross-Site Request Forgery (CSRF)CVE-2025-23559 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stepan Stepasyuk MemeOne allows Stored XSS.This issue affects MemeOne: from n/a through 2.0.5.
- Product
- MemeOne
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update MemeOne to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Geotagged Media: Cross-Site Request Forgery (CSRF)CVE-2025-23558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in digitalfisherman Geotagged Media geotagged-media allows Stored XSS.This issue affects Geotagged Media: from n/a through <= 0.3.0.
- Product
- Geotagged Media
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Geotagged Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Find Your Reps: Cross-Site Request Forgery (CSRF)CVE-2025-23557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Kathleen Malone Find Your Reps find-your-reps allows Stored XSS.This issue affects Find Your Reps: from n/a through <= 1.2.
- Product
- Find Your Reps
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Find Your Reps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025add custom google tag manager: Cross-Site Request Forgery (CSRF)CVE-2025-23537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in קידום ובניית אתרים add custom google tag manager add-custom-google-tag-manager allows Stored XSS.This issue affects add custom google tag manager: from n/a through <= 1.0.3.
- Product
- add custom google tag manager
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update add custom google tag manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WP Lyrics: Cross-Site Request Forgery (CSRF)CVE-2025-23533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in zetxek WP Lyrics wplyrics allows Stored XSS.This issue affects WP Lyrics: from n/a through <= 0.4.1.
- Product
- WP Lyrics
- Affected
- up to 0.4.1
- What to do
- Affects up to 0.4.1. Update WP Lyrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025MyAnime Widget: Cross-Site Request Forgery (CSRF)CVE-2025-23532 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a through <= 1.0.
- Product
- MyAnime Widget
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update MyAnime Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Custom Post Type Lockdown: Cross-Site Request Forgery (CSRF)CVE-2025-23530 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Lockdown custom-post-type-lockdown allows Privilege Escalation.This issue affects Custom Post Type Lockdown: from n/a through <= 1.11.
- Product
- Custom Post Type Lockdown
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update Custom Post Type Lockdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Bible Embed: Cross-Site Request Forgery (CSRF)CVE-2025-23513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jd7777 Bible Embed bible-embed allows Stored XSS.This issue affects Bible Embed: from n/a through <= 0.0.4.
- Product
- Bible Embed
- Affected
- up to 0.0.4
- What to do
- Affects up to 0.0.4. Update Bible Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WP-BlackCheck: Cross-Site Request Forgery (CSRF)CVE-2025-23511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stargazer WP-BlackCheck wp-blackcheck allows Stored XSS.This issue affects WP-BlackCheck: from n/a through <= 2.7.2.
- Product
- WP-BlackCheck
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update WP-BlackCheck to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WordPress Logging Service: Cross-Site Request Forgery (CSRF)CVE-2025-23510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jan Štětina WordPress Logging Service wordpress-logging-service allows Stored XSS.This issue affects WordPress Logging Service: from n/a through <= 1.5.4.
- Product
- WordPress Logging Service
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update WordPress Logging Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Extra Options – Favicons: Cross-Site Request Forgery (CSRF)CVE-2025-23508 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in OrigoThemes Extra Options – Favicons extra-options-favicons allows Stored XSS.This issue affects Extra Options – Favicons: from n/a through <= 1.1.0.
- Product
- Extra Options – Favicons
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Extra Options – Favicons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Cookie Consent & Autoblock for GDPR/CCPA: Cross-Site Request Forgery (CSRF)CVE-2025-23501 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in SpruceJoy Cookie Consent & Autoblock for GDPR/CCPA cookie-consent-autoblock allows Stored XSS.This issue affects Cookie Consent & Autoblock for GDPR/CCPA: from n/a through <= 1.0.1.
- Product
- Cookie Consent & Autoblock for GDPR/CCPA
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Cookie Consent & Autoblock for GDPR/CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Board Election: Cross-Site Request Forgery (CSRF)CVE-2025-23499 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier Board Election board-election allows Stored XSS.This issue affects Board Election: from n/a through <= 1.0.1.
- Product
- Board Election
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Board Election to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Simple Project Manager: Cross-Site Request Forgery (CSRF)CVE-2025-23497 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in albdesign Simple Project Manager simple-project-managment allows Stored XSS.This issue affects Simple Project Manager: from n/a through <= 1.2.2.
- Product
- Simple Project Manager
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Simple Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Universal Analytics Injector: Cross-Site Request Forgery (CSRF)CVE-2025-23483 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in hoyce Universal Analytics Injector universal-analytics-injector allows Stored XSS.This issue affects Universal Analytics Injector: from n/a through <= 1.0.3.
- Product
- Universal Analytics Injector
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Universal Analytics Injector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025my-related-posts: Cross-Site Request Forgery (CSRF)CVE-2025-23476 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in isnowfy my-related-posts my-related-posts allows Stored XSS.This issue affects my-related-posts: from n/a through <= 1.1.
- Product
- my-related-posts
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update my-related-posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025ECT Add to Cart Button: Cross-Site Request Forgery (CSRF)CVE-2025-23471 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Add to Cart Button ect-add-to-cart-button allows Stored XSS.This issue affects ECT Add to Cart Button: from n/a through <= 1.4.
- Product
- ECT Add to Cart Button
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update ECT Add to Cart Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Visit Site Link enhanced: Cross-Site Request Forgery (CSRF)CVE-2025-23470 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through <= 1.0.
- Product
- Visit Site Link enhanced
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Visit Site Link enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025RSS News Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-23467 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in vimal.ghorecha RSS News Scroller rss-news-scroller allows Stored XSS.This issue affects RSS News Scroller: from n/a through <= 2.0.0.
- Product
- RSS News Scroller
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update RSS News Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025MD Custom content after or before of post: Cross-Site Request Forgery (CSRF)CVE-2025-23463 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mukesh Dak MD Custom content after or before of post md-custom-content allows Stored XSS.This issue affects MD Custom content after or before of post: from n/a through <= 1.0.
- Product
- MD Custom content after or before of post
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update MD Custom content after or before of post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025EmailShroud: Cross-Site Request Forgery (CSRF)CVE-2025-23456 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Oddthinking EmailShroud emailshroud allows Reflected XSS.This issue affects EmailShroud: from n/a through <= 2.2.1.
- Product
- EmailShroud
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update EmailShroud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WP VTiger Synchronization: Cross-Site Request Forgery (CSRF)CVE-2025-23455 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Master Software Solutions WP VTiger Synchronization msstiger allows Stored XSS.This issue affects WP VTiger Synchronization: from n/a through <= 1.1.1.
- Product
- WP VTiger Synchronization
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WP VTiger Synchronization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Easy Tynt: Cross-Site Request Forgery (CSRF)CVE-2025-23445 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in scottswezey Easy Tynt easy-tynt allows Cross Site Request Forgery.This issue affects Easy Tynt: from n/a through <= 0.2.5.1.
- Product
- Easy Tynt
- Affected
- up to 0.2.5.1
- What to do
- Affects up to 0.2.5.1. Update Easy Tynt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Shockingly Big IE6 Warning: Cross-Site Request Forgery (CSRF)CVE-2025-23442 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mschertel Shockingly Big IE6 Warning shockingly-big-ie6-warning allows Stored XSS.This issue affects Shockingly Big IE6 Warning: from n/a through <= 1.6.3.
- Product
- Shockingly Big IE6 Warning
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Shockingly Big IE6 Warning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Wp-Scribd-List: Cross-Site Request Forgery (CSRF)CVE-2025-23436 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in capa Wp-Scribd-List wp-scribd-list allows Stored XSS.This issue affects Wp-Scribd-List: from n/a through <= 1.2.
- Product
- Wp-Scribd-List
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Wp-Scribd-List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Password Protect Plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-23435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in marcucci Password Protect Plugin for WordPress password-protect-plugin-for-wordpress allows Stored XSS.This issue affects Password Protect Plugin for WordPress: from n/a through <= 0.8.1.0.
- Product
- Password Protect Plugin for
- Affected
- up to 0.8.1.0
- What to do
- Affects up to 0.8.1.0. Update Password Protect Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Mass Custom Fields Manager: Cross-Site Request Forgery (CSRF)CVE-2025-23430 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Oren Yomtov Mass Custom Fields Manager mass-custom-fields-manager allows Reflected XSS.This issue affects Mass Custom Fields Manager: from n/a through <= 1.5.
- Product
- Mass Custom Fields Manager
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Mass Custom Fields Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025go Social: Cross-Site Request Forgery (CSRF)CVE-2025-23426 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through <= 1.0.
- Product
- go Social
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update go Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Marquee Style RSS News Ticker: Cross-Site Request Forgery (CSRF)CVE-2025-23424 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bnovotny Marquee Style RSS News Ticker marquee-style-rss-news-ticker allows Cross Site Request Forgery.This issue affects Marquee Style RSS News Ticker: from n/a through <= 3.2.0.
- Product
- Marquee Style RSS News Ticker
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Marquee Style RSS News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025WP User Profile Avatar: Cross-Site Request ForgeryCVE-2024-10789 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupa_user_admin() function. This makes it possible for unauthenticated attackers to update the plugins setting which controls access to the functionality via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP User Profile Avatar
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 15, 2025Background Control: Cross-Site Request Forgery (CSRF)CVE-2025-22784 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Control: from n/a through <= 1.0.5.
- Product
- Background Control
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Background Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Build Private Store For Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2025-22731 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Cross Site Request Forgery.This issue affects Build Private Store For Woocommerce: from n/a through <= 1.0.
- Product
- Build Private Store For Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Build Private Store For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Course Migration for LearnDash: Server-Side Request Forgery (SSRF)CVE-2025-22346 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course Migration for LearnDash: from 1.0.2 through n/a.
- Product
- Course Migration for LearnDash
- What to do
- Update Course Migration for LearnDash to the newest version.
Jan 14, 2025Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2025-0393 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Royal Elementor Addons and Templates
- Affected
- up to 1.7.1006
- What to do
- Affects up to 1.7.1006. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2025Zephyr Admin: Cross-Site Request Forgery (CSRF)CVE-2025-22814 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.
- Product
- Zephyr Admin
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Zephyr Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Greenshift – animation and page builder blocks: Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site ScriptingCVE-2024-6155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.
- Product
- Greenshift – animation and page builder blocks
- Affected
- up to 9.0.0
- What to do
- Affects up to 9.0.0. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2025Woocommerce check pincode/zipcode for shipping: Cross-Site Request ForgeryCVE-2024-12218 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Woocommerce check pincode/zipcode for shipping
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Woocommerce check pincode/zipcode for shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 9, 2025WordPress Header Builder Plugin – Pearl: Cross-Site Request ForgeryCVE-2024-12206 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the stm_header_builder page. This makes it possible for unauthenticated attackers to delete arbitrary headers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WordPress Header Builder Plugin – Pearl
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update WordPress Header Builder Plugin – Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Prayer Times Anywhere: Cross-Site Request Forgery (CSRF)CVE-2025-22590 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Prayer Times Anywhere prayer-times-anywhere allows Stored XSS.This issue affects Prayer Times Anywhere: from n/a through <= 2.0.1.
- Product
- Prayer Times Anywhere
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Prayer Times Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Quote Tweet: Cross-Site Request Forgery (CSRF)CVE-2025-22589 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bozdoz Quote Tweet quote-tweet allows Stored XSS.This issue affects Quote Tweet: from n/a through <= 0.7.
- Product
- Quote Tweet
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Quote Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Uptime Robot: Cross-Site Request Forgery (CSRF)CVE-2025-22582 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through <= 0.1.3.
- Product
- Uptime Robot
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Uptime Robot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Instabot: Cross-Site Request Forgery (CSRF)CVE-2025-22571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in instabot Instabot instabot allows Cross Site Request Forgery.This issue affects Instabot: from n/a through <= 1.10.
- Product
- Instabot
- Affected
- up to 1.10
- What to do
- Affects up to 1.10. Update Instabot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Pretty Url: Cross-Site Request Forgery (CSRF)CVE-2025-22563 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in faaiq Pretty Url pretty-url allows Cross Site Request Forgery.This issue affects Pretty Url: from n/a through <= 1.5.5.
- Product
- Pretty Url
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Title Experiments Free: Cross-Site Request Forgery (CSRF)CVE-2025-22562 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in kbowson Title Experiments Free wp-experiments-free allows Cross Site Request Forgery.This issue affects Title Experiments Free: from n/a through <= 9.0.4.
- Product
- Title Experiments Free
- Affected
- up to 9.0.4
- What to do
- Affects up to 9.0.4. Update Title Experiments Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.