Vulnerability database

4,657 results · page 44 of 94

• Jan 24, 2025Automate Hub Free by Sperse.IO: Cross-Site Request ForgeryCVE-2024-13683 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to missing or incorrect nonce validation on the 'automate_hub' page. This makes it possible for unauthenticated attackers to update an activation status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Automate Hub Free by Sperse.IO

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Automate Hub Free by Sperse.IO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Jan 23, 2025Rocket Media Library Mime Type: Cross-Site Request Forgery (CSRF)CVE-2025-22768 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in JinHan Park Rocket Media Library Mime Type rocket-media-library-mime-type allows Stored XSS.This issue affects Rocket Media Library Mime Type: from n/a through <= 2.1.0.

  Product

  Rocket Media Library Mime Type

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Rocket Media Library Mime Type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Ultimate Subscribe: Cross-Site Request Forgery (CSRF)CVE-2025-23806 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeFarmer Ultimate Subscribe ultimate-subscribe allows Reflected XSS.This issue affects Ultimate Subscribe: from n/a through <= 1.3.

  Product

  Ultimate Subscribe

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Ultimate Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025Snippy: Cross-Site Request Forgery (CSRF)CVE-2025-23803 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through <= 1.4.1.

  Product

  Snippy

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Snippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2025AI Power: Complete AI Pack: Server-Side Request ForgeryCVE-2024-13360 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_troubleshoot_add_vector(). This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

  Product

  AI Power: Complete AI Pack

  Affected

  up to 1.8.96

  What to do

  Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 21, 2025AnyRoad: Cross-Site Request Forgery (CSRF)CVE-2025-23996 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in AnyRoad AnyRoad anyguide allows Cross Site Request Forgery.This issue affects AnyRoad: from n/a through <= 1.3.2.

  Product

  AnyRoad

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update AnyRoad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025PPO Call To Actions: Cross-Site Request Forgery (CSRF)CVE-2025-24001 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ngô Thắng IT PPO Call To Actions ppo-call-to-actions allows Cross Site Request Forgery.This issue affects PPO Call To Actions: from n/a through <= 0.1.3.

  Product

  PPO Call To Actions

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update PPO Call To Actions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 21, 2025wp-greet: Cross-Site Request ForgeryCVE-2024-13444 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  wp-greet

  Affected

  up to 6.2

  What to do

  Affects up to 6.2. Update wp-greet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 21, 2025WP-BibTeX: Cross-Site Request ForgeryCVE-2024-12005 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  WP-BibTeX

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update WP-BibTeX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 18, 2025Webcamconsult: Cross-Site Request ForgeryCVE-2024-13432 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Webcamconsult plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Webcamconsult

  Affected

  up to 1.5.0

  What to do

  Affects up to 1.5.0. Update Webcamconsult to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 18, 2025ShipWorks Connector for Woocommerce: Cross-Site Request ForgeryCVE-2024-13317 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The ShipWorks Connector for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is due to missing or incorrect nonce validation on the 'shipworks-wordpress' page. This makes it possible for unauthenticated attackers to update the services username and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  ShipWorks Connector for Woocommerce

  Affected

  up to 5.2.5

  What to do

  Affects up to 5.2.5. Update ShipWorks Connector for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 18, 2025WP Abstracts: Cross-Site Request ForgeryCVE-2024-12385 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing nonce validation on the wpabstracts_load_status() and wpabstracts_delete_abstracts() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  WP Abstracts

  Affected

  up to 2.7.2

  What to do

  Affects up to 2.7.2. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 16, 2025iSpring Embedder: Cross-Site Request Forgery (CSRF)CVE-2025-23922 · WordPress plugins & themes · reported by PatchstackCritical 10

  Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue affects iSpring Embedder: from n/a through <= 1.0.

  Product

  iSpring Embedder

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update iSpring Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Error Notification: Cross-Site Request Forgery (CSRF)CVE-2025-23902 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Taras Dashkevych Error Notification error-notification allows Cross Site Request Forgery.This issue affects Error Notification: from n/a through <= 0.2.7.

  Product

  Error Notification

  Affected

  up to 0.2.7

  What to do

  Affects up to 0.2.7. Update Error Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025GravatarLocalCache: Cross-Site Request Forgery (CSRF)CVE-2025-23901 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cybio GravatarLocalCache gravatarlocalcache allows Cross Site Request Forgery.This issue affects GravatarLocalCache: from n/a through <= 1.1.2.

  Product

  GravatarLocalCache

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update GravatarLocalCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Genki Announcement: Cross-Site Request Forgery (CSRF)CVE-2025-23900 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in genkisan Genki Announcement genki-announcement allows Cross Site Request Forgery.This issue affects Genki Announcement: from n/a through <= 1.4.1.

  Product

  Genki Announcement

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Genki Announcement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Apply with LinkedIn buttons: Cross-Site Request Forgery (CSRF)CVE-2025-23898 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows Stored XSS.This issue affects Apply with LinkedIn buttons: from n/a through <= 2.3.

  Product

  Apply with LinkedIn buttons

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Apply with LinkedIn buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Add RSS: Cross-Site Request Forgery (CSRF)CVE-2025-23895 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.This issue affects Add RSS: from n/a through <= 1.5.

  Product

  Add RSS

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Add RSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Annie: Cross-Site Request Forgery (CSRF)CVE-2025-23884 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Chris Roberts Annie annie allows Cross Site Request Forgery.This issue affects Annie: from n/a through <= 2.1.1.

  Product

  Annie

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Annie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025amr personalise: Cross-Site Request Forgery (CSRF)CVE-2025-23880 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in anmari amr personalise amr-personalise allows Cross Site Request Forgery.This issue affects amr personalise: from n/a through <= 2.10.

  Product

  amr personalise

  Affected

  up to 2.10

  What to do

  Affects up to 2.10. Update amr personalise to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Better Protected Pages: Cross-Site Request Forgery (CSRF)CVE-2025-23875 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in madeglobal Better Protected Pages better-protected-pages allows Stored XSS.This issue affects Better Protected Pages: from n/a through <= 1.0.

  Product

  Better Protected Pages

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Better Protected Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025PayForm: Cross-Site Request Forgery (CSRF)CVE-2025-23872 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in payform PayForm payform allows Stored XSS.This issue affects PayForm: from n/a through <= 2.0.

  Product

  PayForm

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update PayForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025LSD Google Maps Embedder: Cross-Site Request Forgery (CSRF)CVE-2025-23871 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Bas Matthee LSD Google Maps Embedder lsd-google-maps-embedder allows Cross Site Request Forgery.This issue affects LSD Google Maps Embedder: from n/a through <= 1.1.

  Product

  LSD Google Maps Embedder

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update LSD Google Maps Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Copyright Safeguard Footer Notice: Cross-Site Request Forgery (CSRF)CVE-2025-23870 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wygk Copyright Safeguard Footer Notice copyright-safeguard-footer-notice allows Stored XSS.This issue affects Copyright Safeguard Footer Notice: from n/a through <= 3.0.

  Product

  Copyright Safeguard Footer Notice

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update Copyright Safeguard Footer Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025CJ Custom Content: Cross-Site Request Forgery (CSRF)CVE-2025-23869 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Custom Content cj-custom-content allows Stored XSS.This issue affects CJ Custom Content: from n/a through <= 2.0.

  Product

  CJ Custom Content

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update CJ Custom Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Debt Calculator: Cross-Site Request Forgery (CSRF)CVE-2025-23861 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Zack Katz Debt Calculator debt-calculator allows Cross Site Request Forgery.This issue affects Debt Calculator: from n/a through <= 1.0.1.

  Product

  Debt Calculator

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Debt Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Hotspots Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-23848 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in dpowney Hotspots Analytics hotspots allows Stored XSS.This issue affects Hotspots Analytics: from n/a through <= 4.0.12.

  Product

  Hotspots Analytics

  Affected

  up to 4.0.12

  What to do

  Affects up to 4.0.12. Update Hotspots Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Custom Widget Classes: Cross-Site Request Forgery (CSRF)CVE-2025-23844 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jamsheer K Custom Widget Classes custom-widget-classes allows Cross Site Request Forgery.This issue affects Custom Widget Classes: from n/a through <= 1.1.

  Product

  Custom Widget Classes

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Custom Widget Classes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WordPress Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-23842 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Nilesh Shiragave WordPress Gallery Plugin wordpress-gallery-plugin allows Cross Site Request Forgery.This issue affects WordPress Gallery Plugin: from n/a through <= 1.4.

  Product

  WordPress Gallery

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update WordPress Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Admin Cleanup: Cross-Site Request Forgery (CSRF)CVE-2025-23832 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Matt Gibbs Admin Cleanup admin-cleanup allows Stored XSS.This issue affects Admin Cleanup: from n/a through <= 1.0.2.

  Product

  Admin Cleanup

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Admin Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025CNZZ&51LA for: Cross-Site Request Forgery (CSRF)CVE-2025-23823 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in jprintf CNZZ&51LA for WordPress cnzz51la-for-wordpress allows Cross Site Request Forgery.This issue affects CNZZ&51LA for WordPress: from n/a through <= 1.0.1.

  Product

  CNZZ&51LA for

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update CNZZ&51LA for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Category Custom Fields: Cross-Site Request Forgery (CSRF)CVE-2025-23822 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in alicornea Category Custom Fields categorycustomfields allows Cross Site Request Forgery.This issue affects Category Custom Fields: from n/a through <= 1.0.

  Product

  Category Custom Fields

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Category Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Cookies Alert: Cross-Site Request Forgery (CSRF)CVE-2025-23821 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in aleapp WP Cookies Alert wp-cookies-alert allows Cross Site Request Forgery.This issue affects WP Cookies Alert: from n/a through <= 1.1.1.

  Product

  WP Cookies Alert

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update WP Cookies Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Content Security Policy Pro: Cross-Site Request Forgery (CSRF)CVE-2025-23820 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in thapa.laxman Content Security Policy Pro content-security-policy-pro allows Cross Site Request Forgery.This issue affects Content Security Policy Pro: from n/a through <= 1.3.5.

  Product

  Content Security Policy Pro

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Content Security Policy Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025More Link Modifier: Cross-Site Request Forgery (CSRF)CVE-2025-23818 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in pyko More Link Modifier more-link-modifier allows Stored XSS.This issue affects More Link Modifier: from n/a through <= 1.0.3.

  Product

  More Link Modifier

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update More Link Modifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025MHR-Custom-Anti-Copy: Cross-Site Request Forgery (CSRF)CVE-2025-23817 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mahadirz MHR-Custom-Anti-Copy mhr-custom-anti-copy allows Stored XSS.This issue affects MHR-Custom-Anti-Copy: from n/a through <= 2.0.

  Product

  MHR-Custom-Anti-Copy

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update MHR-Custom-Anti-Copy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025root Cookie: Cross-Site Request Forgery (CSRF)CVE-2025-23815 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in linickx root Cookie allows Cross Site Request Forgery. This issue affects root Cookie: from n/a through 1.6.

  Product

  root Cookie

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update root Cookie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Len Slider: Cross-Site Request Forgery (CSRF)CVE-2025-23810 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Igor Sazonov Len Slider len-slider allows Reflected XSS.This issue affects Len Slider: from n/a through <= 2.0.11.

  Product

  Len Slider

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update Len Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Custom List Table Example: Cross-Site Request Forgery (CSRF)CVE-2025-23808 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dutch van Andel Custom List Table Example custom-list-table-example allows Reflected XSS.This issue affects Custom List Table Example: from n/a through <= 1.4.1.

  Product

  Custom List Table Example

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Custom List Table Example to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025SEOReseller Partner: Cross-Site Request Forgery (CSRF)CVE-2025-23805 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in itamarg SEOReseller Partner sr-partner allows Cross Site Request Forgery.This issue affects SEOReseller Partner: from n/a through <= 1.3.15.

  Product

  SEOReseller Partner

  Affected

  up to 1.3.15

  What to do

  Affects up to 1.3.15. Update SEOReseller Partner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Service Payment Form With Authorize.net: Cross-Site Request Forgery (CSRF)CVE-2025-23804 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Shiv Prakash Tiwari WP Service Payment Form With Authorize.net wp-service-payment-form-with-authorizenet allows Reflected XSS.This issue affects WP Service Payment Form With Authorize.net: from n/a through <= 2.6.0.

  Product

  WP Service Payment Form With Authorize.net

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update WP Service Payment Form With Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Style Admin: Cross-Site Request Forgery (CSRF)CVE-2025-23801 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in FuzzGuard Style Admin style-admin allows Stored XSS.This issue affects Style Admin: from n/a through <= 1.4.3.

  Product

  Style Admin

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Style Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025OrangeBox: Cross-Site Request Forgery (CSRF)CVE-2025-23800 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in nova706 OrangeBox orangebox allows Cross Site Request Forgery.This issue affects OrangeBox: from n/a through <= 3.0.0.

  Product

  OrangeBox

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update OrangeBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP Options Editor: Cross-Site Request Forgery (CSRF)CVE-2025-23797 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Cross-Site Request Forgery (CSRF) vulnerability in Mike Selander WP Options Editor wp-options-editor allows Privilege Escalation.This issue affects WP Options Editor: from n/a through <= 1.1.

  Product

  WP Options Editor

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update WP Options Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Auto FTP: Cross-Site Request Forgery (CSRF)CVE-2025-23793 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Turcu Auto FTP auto-ftp allows Stored XSS.This issue affects Auto FTP: from n/a through <= 1.0.1.

  Product

  Auto FTP

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Auto FTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025W3SPEEDSTER: Cross-Site Request Forgery (CSRF)CVE-2025-23765 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in w3speedster W3SPEEDSTER w3speedster-wp allows Cross Site Request Forgery.This issue affects W3SPEEDSTER: from n/a through <= 7.33.

  Product

  W3SPEEDSTER

  Affected

  up to 7.33

  What to do

  Affects up to 7.33. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025mybb Last Topics: Cross-Site Request Forgery (CSRF)CVE-2025-23749 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in progpars.net mybb Last Topics mybb-last-topics allows Stored XSS.This issue affects mybb Last Topics: from n/a through <= 1.0.

  Product

  mybb Last Topics

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update mybb Last Topics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Call me Now: Cross-Site Request Forgery (CSRF)CVE-2025-23745 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Tussendoor B.V. Call me Now call-me-now allows Stored XSS.This issue affects Call me Now: from n/a through <= 1.0.5.

  Product

  Call me Now

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Call me Now to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Social Analytics: Cross-Site Request Forgery (CSRF)CVE-2025-23743 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in MartijnScheijbeler Social Analytics social-analytics allows Stored XSS.This issue affects Social Analytics: from n/a through <= 0.2.

  Product

  Social Analytics

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Social Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Web Push: Cross-Site Request Forgery (CSRF)CVE-2025-23720 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Marco Castelluccio Web Push web-push allows Stored XSS.This issue affects Web Push: from n/a through <= 1.4.0.

  Product

  Web Push

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Web Push to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.