Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,657 results · page 42 of 94
Feb 13, 2025Simple Responsive Menu: Cross-Site Request Forgery (CSRF)CVE-2025-26543 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pukhraj Suthar Simple Responsive Menu simple-responsive-menu allows Stored XSS.This issue affects Simple Responsive Menu: from n/a through <= 2.1.
- Product
- Simple Responsive Menu
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Simple Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025WP Abstracts: Cross-Site Request ForgeryCVE-2024-12386 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Abstracts
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 12, 2025Book a Room: Cross-Site Request ForgeryCVE-2024-13437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroom_Settings' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Book a Room
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Book a Room to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Feb 11, 2025Houzez Property Feed: Cross-Site Request ForgeryCVE-2025-0808 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed exports via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Houzez Property Feed
- Affected
- up to 2.4.21
- What to do
- Affects up to 2.4.21. Update Houzez Property Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 11, 2025StaffList: Cross-Site Request ForgeryCVE-2024-13749 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation on the 'stafflist' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- StaffList
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update StaffList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 7, 2025WP All Import Pro: Cross-Site Request ForgeryCVE-2024-9661 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the delete_and_edit function. This makes it possible for unauthenticated attackers to delete imported content (posts, comments, users, etc.) via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP All Import Pro
- Affected
- up to 4.9.7
- What to do
- Affects up to 4.9.7. Update WP All Import Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwpallimport.com
Feb 7, 2025BookPress – For Book Authors: Cross-Site Request Forgery (CSRF)CVE-2025-25168 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Black and White BookPress – For Book Authors book-press allows Cross-Site Scripting (XSS).This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.
- Product
- BookPress – For Book Authors
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update BookPress – For Book Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025InLocation: Cross-Site Request Forgery (CSRF)CVE-2025-25166 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation inlocation allows Stored XSS.This issue affects InLocation: from n/a through <= 1.8.
- Product
- InLocation
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update InLocation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Style Tweaker: Cross-Site Request Forgery (CSRF)CVE-2025-25160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through <= 0.11.
- Product
- Style Tweaker
- Affected
- up to 0.11
- What to do
- Affects up to 0.11. Update Style Tweaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Quote Comments: Cross-Site Request Forgery (CSRF)CVE-2025-25156 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments quote-comments allows Stored XSS.This issue affects Quote Comments: from n/a through <= 3.0.0.
- Product
- Quote Comments
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Quote Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Custom Comment Notifications: Cross-Site Request Forgery (CSRF)CVE-2025-25154 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications custom-comment-notifications allows Stored XSS.This issue affects Custom Comment Notifications: from n/a through <= 1.0.8.
- Product
- Custom Comment Notifications
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Custom Comment Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Simple Auto Tag: Cross-Site Request Forgery (CSRF)CVE-2025-25153 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through <= 1.1.
- Product
- Simple Auto Tag
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Auto Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Smart DoFollow: Cross-Site Request Forgery (CSRF)CVE-2025-25152 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a through <= 1.0.2.
- Product
- Smart DoFollow
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Smart DoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Login-box: Cross-Site Request Forgery (CSRF)CVE-2025-25149 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4.
- Product
- Login-box
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Login-box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Read More Copy Link: Cross-Site Request Forgery (CSRF)CVE-2025-25148 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link read-more-copy-link allows Stored XSS.This issue affects Read More Copy Link: from n/a through <= 1.0.2.
- Product
- Read More Copy Link
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Read More Copy Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Auto SEO: Cross-Site Request Forgery (CSRF)CVE-2025-25147 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through <= 2.5.6.
- Product
- Auto SEO
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Auto SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Songkick Concerts and Festivals: Cross-Site Request Forgery (CSRF)CVE-2025-25146 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery.This issue affects Songkick Concerts and Festivals: from n/a through <= 0.9.7.
- Product
- Songkick Concerts and Festivals
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Songkick Concerts and Festivals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Infusionsoft Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-25145 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics infusionsoft-web-tracker allows Cross Site Request Forgery.This issue affects Infusionsoft Analytics: from n/a through <= 2.0.
- Product
- Infusionsoft Analytics
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Infusionsoft Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025GlobalQuran: Cross-Site Request Forgery (CSRF)CVE-2025-25143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ibasit GlobalQuran globalquran allows Cross Site Request Forgery.This issue affects GlobalQuran: from n/a through <= 1.0.
- Product
- GlobalQuran
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update GlobalQuran to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Simple User Profile: Cross-Site Request Forgery (CSRF)CVE-2025-25140 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile: from n/a through <= 1.9.
- Product
- Simple User Profile
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Simple User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025WP Custom Post RSS Feed: Cross-Site Request Forgery (CSRF)CVE-2025-25139 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Cynob IT Consultancy WP Custom Post RSS Feed wp-custom-post-rss-feed allows Stored XSS.This issue affects WP Custom Post RSS Feed: from n/a through <= 1.0.0.
- Product
- WP Custom Post RSS Feed
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Custom Post RSS Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025On Page SEO + Whatsapp Chat Button: Cross-Site Request Forgery (CSRF)CVE-2025-25138 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through <= 2.0.0.
- Product
- On Page SEO + Whatsapp Chat Button
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update On Page SEO + Whatsapp Chat Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Custom Links On Admin Dashboard Toolbar: Cross-Site Request Forgery (CSRF)CVE-2025-25135 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar customize-wpadmin allows Stored XSS.This issue affects Custom Links On Admin Dashboard Toolbar: from n/a through <= 3.3.
- Product
- Custom Links On Admin Dashboard Toolbar
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Custom Links On Admin Dashboard Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Facilita Form Tracker: Cross-Site Request Forgery (CSRF)CVE-2025-25128 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker facilita-form-tracker allows Stored XSS.This issue affects Facilita Form Tracker: from n/a through <= 1.0.
- Product
- Facilita Form Tracker
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Facilita Form Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025ZMSEO: Cross-Site Request Forgery (CSRF)CVE-2025-25126 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in zmseo ZMSEO zmseo allows Stored XSS.This issue affects ZMSEO: from n/a through <= 1.14.1.
- Product
- ZMSEO
- Affected
- up to 1.14.1
- What to do
- Affects up to 1.14.1. Update ZMSEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Fyrebox Quizzes: Cross-Site Request Forgery (CSRF)CVE-2025-25125 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a through <= 3.1.
- Product
- Fyrebox Quizzes
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Fyrebox Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Easy Related Posts: Cross-Site Request Forgery (CSRF)CVE-2025-25123 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in xdark Easy Related Posts easy-related-posts allows Stored XSS.This issue affects Easy Related Posts: from n/a through <= 2.0.2.
- Product
- Easy Related Posts
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Easy Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025WP Spell Check: Cross-Site Request Forgery (CSRF)CVE-2025-25111 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell Check: from n/a through <= 9.21.
- Product
- WP Spell Check
- Affected
- up to 9.21
- What to do
- Affects up to 9.21. Update WP Spell Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025OneStore Sites: Cross-Site Request Forgery (CSRF)CVE-2025-25107 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites onestore-sites allows Cross Site Request Forgery.This issue affects OneStore Sites: from n/a through <= 0.1.1.
- Product
- OneStore Sites
- Affected
- up to 0.1.1
- What to do
- Affects up to 0.1.1. Update OneStore Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Starter Templates by FancyWP: Cross-Site Request Forgery (CSRF)CVE-2025-25106 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP starter-templates allows Cross Site Request Forgery.This issue affects Starter Templates by FancyWP: from n/a through <= 2.0.0.
- Product
- Starter Templates by FancyWP
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Starter Templates by FancyWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025URL-Preview-Box: Cross-Site Request Forgery (CSRF)CVE-2025-25104 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box good-url-preview-box allows Cross Site Request Forgery.This issue affects URL-Preview-Box: from n/a through <= 1.20.
- Product
- URL-Preview-Box
- Affected
- up to 1.20
- What to do
- Affects up to 1.20. Update URL-Preview-Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Indeed API: Cross-Site Request Forgery (CSRF)CVE-2025-25103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a through <= 0.5.
- Product
- Indeed API
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Indeed API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Munk Sites: Cross-Site Request Forgery (CSRF)CVE-2025-25101 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a through <= 1.0.7.
- Product
- Munk Sites
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Munk Sites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Child Themes Helper: Cross-Site Request Forgery (CSRF)CVE-2025-25093 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability in paulswarthout Child Themes Helper child-themes-helper allows Path Traversal.This issue affects Child Themes Helper: from n/a through <= 2.2.7.
- Product
- Child Themes Helper
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Child Themes Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025WP Keyword Monitor: Cross-Site Request Forgery (CSRF)CVE-2025-25088 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyword Monitor: from n/a through <= 1.0.5.
- Product
- WP Keyword Monitor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WP Keyword Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Show notice or message on admin area: Cross-Site Request Forgery (CSRF)CVE-2025-25075 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through <= 2.0.
- Product
- Show notice or message on admin area
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Show notice or message on admin area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025WP Social Stream: Cross-Site Request Forgery (CSRF)CVE-2025-25074 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream wp-social-stream allows Stored XSS.This issue affects WP Social Stream: from n/a through <= 1.1.
- Product
- WP Social Stream
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Social Stream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025WP Admin Custom Page: Cross-Site Request Forgery (CSRF)CVE-2025-25072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in thunderbax WP Admin Custom Page wp-admin-custom-page allows Stored XSS.This issue affects WP Admin Custom Page: from n/a through <= 1.5.0.
- Product
- WP Admin Custom Page
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update WP Admin Custom Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Vignette Ads: Cross-Site Request Forgery (CSRF)CVE-2025-25071 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through <= 0.2.
- Product
- Vignette Ads
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Vignette Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025ShopSite: Cross-Site Request ForgeryCVE-2024-13510 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ShopSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ShopSite
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update ShopSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 4, 2025DSGVO All in one for WP: Cross-Site Request ForgeryCVE-2024-13356 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing or incorrect nonce validation in the user_remove_form.php file. This makes it possible for unauthenticated attackers to delete admin user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- DSGVO All in one for WP
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update DSGVO All in one for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2025Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5.CVE-2025-24982 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while logged in, the log data may be deleted.
- What to do
- Update the plugin to the newest version.
Feb 3, 2025Forge – Front-End Page Builder: Cross-Site Request Forgery (CSRF)CVE-2025-22703 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through <= 1.4.6.
- Product
- Forge – Front-End Page Builder
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Forge – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Traveler Layout Essential For Elementor: Server-Side Request Forgery (SSRF)CVE-2025-22701 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in shinetheme Traveler Layout Essential For Elementor traveler-layout-essential-for-elementor.This issue affects Traveler Layout Essential For Elementor: from n/a through < 1.4.
- Product
- Traveler Layout Essential For Elementor
- What to do
- Update Traveler Layout Essential For Elementor to the newest version.
Feb 3, 2025DigiTimber cPanel Integration: Cross-Site Request Forgery (CSRF)CVE-2025-22690 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects DigiTimber cPanel Integration: from n/a through <= 1.4.6.
- Product
- DigiTimber cPanel Integration
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update DigiTimber cPanel Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Unlimited Page Sidebars: Cross-Site Request Forgery (CSRF)CVE-2025-22688 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Ederson Peka Unlimited Page Sidebars unlimited-page-sidebars allows Stored XSS.This issue affects Unlimited Page Sidebars: from n/a through <= 0.2.6.
- Product
- Unlimited Page Sidebars
- Affected
- up to 0.2.6
- What to do
- Affects up to 0.2.6. Update Unlimited Page Sidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Tags to Keywords: Cross-Site Request Forgery (CSRF)CVE-2025-22685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in CheGevara29 Tags to Keywords tags-to-meta-keywords allows Stored XSS.This issue affects Tags to Keywords: from n/a through <= 1.0.1.
- Product
- Tags to Keywords
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Tags to Keywords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025EZPZ SAML SP Single Sign On (SSO): Cross-Site Request Forgery (CSRF)CVE-2025-24749 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO) allows Cross Site Request Forgery. This issue affects EZPZ SAML SP Single Sign On (SSO): from n/a through 1.2.5.
- Product
- EZPZ SAML SP Single Sign On (SSO)
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update EZPZ SAML SP Single Sign On (SSO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Post Meta: Cross-Site Request Forgery (CSRF)CVE-2025-24549 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Mahbubur Rahman Post Meta post-meta allows Reflected XSS.This issue affects Post Meta: from n/a through <= 1.0.9.
- Product
- Post Meta
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Scroll Styler: Cross-Site Request Forgery (CSRF)CVE-2025-23990 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in jablonczay Scroll Styler scroll-styler.This issue affects Scroll Styler: from n/a through <= 1.1.
- Product
- Scroll Styler
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Scroll Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.