Vulnerability database

4,657 results · page 46 of 94

• Jan 16, 2025Simple Project Manager: Cross-Site Request Forgery (CSRF)CVE-2025-23497 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in albdesign Simple Project Manager simple-project-managment allows Stored XSS.This issue affects Simple Project Manager: from n/a through <= 1.2.2.

  Product

  Simple Project Manager

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Simple Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Universal Analytics Injector: Cross-Site Request Forgery (CSRF)CVE-2025-23483 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hoyce Universal Analytics Injector universal-analytics-injector allows Stored XSS.This issue affects Universal Analytics Injector: from n/a through <= 1.0.3.

  Product

  Universal Analytics Injector

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Universal Analytics Injector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025my-related-posts: Cross-Site Request Forgery (CSRF)CVE-2025-23476 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in isnowfy my-related-posts my-related-posts allows Stored XSS.This issue affects my-related-posts: from n/a through <= 1.1.

  Product

  my-related-posts

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update my-related-posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025ECT Add to Cart Button: Cross-Site Request Forgery (CSRF)CVE-2025-23471 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in etemplates ECT Add to Cart Button ect-add-to-cart-button allows Stored XSS.This issue affects ECT Add to Cart Button: from n/a through <= 1.4.

  Product

  ECT Add to Cart Button

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update ECT Add to Cart Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Visit Site Link enhanced: Cross-Site Request Forgery (CSRF)CVE-2025-23470 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in xavsio4 Visit Site Link enhanced visit-site-link-enhanced allows Stored XSS.This issue affects Visit Site Link enhanced: from n/a through <= 1.0.

  Product

  Visit Site Link enhanced

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Visit Site Link enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025RSS News Scroller: Cross-Site Request Forgery (CSRF)CVE-2025-23467 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in vimal.ghorecha RSS News Scroller rss-news-scroller allows Stored XSS.This issue affects RSS News Scroller: from n/a through <= 2.0.0.

  Product

  RSS News Scroller

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update RSS News Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025MD Custom content after or before of post: Cross-Site Request Forgery (CSRF)CVE-2025-23463 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mukesh Dak MD Custom content after or before of post md-custom-content allows Stored XSS.This issue affects MD Custom content after or before of post: from n/a through <= 1.0.

  Product

  MD Custom content after or before of post

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update MD Custom content after or before of post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025EmailShroud: Cross-Site Request Forgery (CSRF)CVE-2025-23456 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Oddthinking EmailShroud emailshroud allows Reflected XSS.This issue affects EmailShroud: from n/a through <= 2.2.1.

  Product

  EmailShroud

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update EmailShroud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025WP VTiger Synchronization: Cross-Site Request Forgery (CSRF)CVE-2025-23455 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Master Software Solutions WP VTiger Synchronization msstiger allows Stored XSS.This issue affects WP VTiger Synchronization: from n/a through <= 1.1.1.

  Product

  WP VTiger Synchronization

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update WP VTiger Synchronization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Easy Tynt: Cross-Site Request Forgery (CSRF)CVE-2025-23445 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in scottswezey Easy Tynt easy-tynt allows Cross Site Request Forgery.This issue affects Easy Tynt: from n/a through <= 0.2.5.1.

  Product

  Easy Tynt

  Affected

  up to 0.2.5.1

  What to do

  Affects up to 0.2.5.1. Update Easy Tynt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Shockingly Big IE6 Warning: Cross-Site Request Forgery (CSRF)CVE-2025-23442 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mschertel Shockingly Big IE6 Warning shockingly-big-ie6-warning allows Stored XSS.This issue affects Shockingly Big IE6 Warning: from n/a through <= 1.6.3.

  Product

  Shockingly Big IE6 Warning

  Affected

  up to 1.6.3

  What to do

  Affects up to 1.6.3. Update Shockingly Big IE6 Warning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Wp-Scribd-List: Cross-Site Request Forgery (CSRF)CVE-2025-23436 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in capa Wp-Scribd-List wp-scribd-list allows Stored XSS.This issue affects Wp-Scribd-List: from n/a through <= 1.2.

  Product

  Wp-Scribd-List

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Wp-Scribd-List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Password Protect Plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-23435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in marcucci Password Protect Plugin for WordPress password-protect-plugin-for-wordpress allows Stored XSS.This issue affects Password Protect Plugin for WordPress: from n/a through <= 0.8.1.0.

  Product

  Password Protect Plugin for

  Affected

  up to 0.8.1.0

  What to do

  Affects up to 0.8.1.0. Update Password Protect Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Mass Custom Fields Manager: Cross-Site Request Forgery (CSRF)CVE-2025-23430 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Oren Yomtov Mass Custom Fields Manager mass-custom-fields-manager allows Reflected XSS.This issue affects Mass Custom Fields Manager: from n/a through <= 1.5.

  Product

  Mass Custom Fields Manager

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Mass Custom Fields Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025go Social: Cross-Site Request Forgery (CSRF)CVE-2025-23426 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Binesh Dobhal go Social go-social allows Stored XSS.This issue affects go Social: from n/a through <= 1.0.

  Product

  go Social

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update go Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 16, 2025Marquee Style RSS News Ticker: Cross-Site Request Forgery (CSRF)CVE-2025-23424 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bnovotny Marquee Style RSS News Ticker marquee-style-rss-news-ticker allows Cross Site Request Forgery.This issue affects Marquee Style RSS News Ticker: from n/a through <= 3.2.0.

  Product

  Marquee Style RSS News Ticker

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update Marquee Style RSS News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025WP User Profile Avatar: Cross-Site Request ForgeryCVE-2024-10789 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupa_user_admin() function. This makes it possible for unauthenticated attackers to update the plugins setting which controls access to the functionality via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  WP User Profile Avatar

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 15, 2025Background Control: Cross-Site Request Forgery (CSRF)CVE-2025-22784 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Control: from n/a through <= 1.0.5.

  Product

  Background Control

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Background Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Build Private Store For Woocommerce: Cross-Site Request Forgery (CSRF)CVE-2025-22731 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Cross Site Request Forgery.This issue affects Build Private Store For Woocommerce: from n/a through <= 1.0.

  Product

  Build Private Store For Woocommerce

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Build Private Store For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 15, 2025Course Migration for LearnDash: Server-Side Request Forgery (SSRF)CVE-2025-22346 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course Migration for LearnDash: from 1.0.2 through n/a.

  Product

  Course Migration for LearnDash

  What to do

  Update Course Migration for LearnDash to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 14, 2025Royal Elementor Addons and Templates: Cross-Site Request ForgeryCVE-2025-0393 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Royal Elementor Addons and Templates

  Affected

  up to 1.7.1006

  What to do

  Affects up to 1.7.1006. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 9, 2025Zephyr Admin: Cross-Site Request Forgery (CSRF)CVE-2025-22814 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.

  Product

  Zephyr Admin

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Zephyr Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 9, 2025Greenshift – animation and page builder blocks: Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site ScriptingCVE-2024-6155 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.

  Product

  Greenshift – animation and page builder blocks

  Affected

  up to 9.0.0

  What to do

  Affects up to 9.0.0. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 9, 2025Woocommerce check pincode/zipcode for shipping: Cross-Site Request ForgeryCVE-2024-12218 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Woocommerce check pincode/zipcode for shipping

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Woocommerce check pincode/zipcode for shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Jan 9, 2025WordPress Header Builder Plugin – Pearl: Cross-Site Request ForgeryCVE-2024-12206 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the stm_header_builder page. This makes it possible for unauthenticated attackers to delete arbitrary headers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  WordPress Header Builder Plugin – Pearl

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update WordPress Header Builder Plugin – Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 9, 2025PostLists: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-10815 · WordPress plugins & themes · reported by WPScanMedium 4.2

  The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

  Product

  PostLists

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update PostLists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 7, 2025Prayer Times Anywhere: Cross-Site Request Forgery (CSRF)CVE-2025-22590 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Prayer Times Anywhere prayer-times-anywhere allows Stored XSS.This issue affects Prayer Times Anywhere: from n/a through <= 2.0.1.

  Product

  Prayer Times Anywhere

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update Prayer Times Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Quote Tweet: Cross-Site Request Forgery (CSRF)CVE-2025-22589 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bozdoz Quote Tweet quote-tweet allows Stored XSS.This issue affects Quote Tweet: from n/a through <= 0.7.

  Product

  Quote Tweet

  Affected

  up to 0.7

  What to do

  Affects up to 0.7. Update Quote Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Uptime Robot: Cross-Site Request Forgery (CSRF)CVE-2025-22582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through <= 0.1.3.

  Product

  Uptime Robot

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Uptime Robot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Instabot: Cross-Site Request Forgery (CSRF)CVE-2025-22571 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in instabot Instabot instabot allows Cross Site Request Forgery.This issue affects Instabot: from n/a through <= 1.10.

  Product

  Instabot

  Affected

  up to 1.10

  What to do

  Affects up to 1.10. Update Instabot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Pretty Url: Cross-Site Request Forgery (CSRF)CVE-2025-22563 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in faaiq Pretty Url pretty-url allows Cross Site Request Forgery.This issue affects Pretty Url: from n/a through <= 1.5.5.

  Product

  Pretty Url

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Title Experiments Free: Cross-Site Request Forgery (CSRF)CVE-2025-22562 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in kbowson Title Experiments Free wp-experiments-free allows Cross Site Request Forgery.This issue affects Title Experiments Free: from n/a through <= 9.0.4.

  Product

  Title Experiments Free

  Affected

  up to 9.0.4

  What to do

  Affects up to 9.0.4. Update Title Experiments Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025TubePress.NET: Cross-Site Request Forgery (CSRF)CVE-2025-22559 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in tubepress TubePress.NET tubepressnet allows Cross Site Request Forgery.This issue affects TubePress.NET: from n/a through <= 4.0.1.

  Product

  TubePress.NET

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update TubePress.NET to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025News Publisher Autopilot: Cross-Site Request Forgery (CSRF)CVE-2025-22557 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through <= 2.1.4.

  Product

  News Publisher Autopilot

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update News Publisher Autopilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Norse Rune Oracle: Cross-Site Request Forgery (CSRF)CVE-2025-22556 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle allows Cross Site Request Forgery.This issue affects Norse Rune Oracle Plugin: from n/a through <= 1.4.2.

  Product

  Norse Rune Oracle

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Norse Rune Oracle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Smoothness Slider Shortcode: Cross-Site Request Forgery (CSRF)CVE-2025-22555 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in njshofe Smoothness Slider Shortcode smoothness-slider-shortcode allows Cross Site Request Forgery.This issue affects Smoothness Slider Shortcode: from n/a through <= v1.2.2.

  Product

  Smoothness Slider Shortcode

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Smoothness Slider Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Affiliate Disclosure Statement: Cross-Site Request Forgery (CSRF)CVE-2025-22552 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through <= 0.3.

  Product

  Affiliate Disclosure Statement

  Affected

  up to 0.3

  What to do

  Affects up to 0.3. Update Affiliate Disclosure Statement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Virtual Bot: Cross-Site Request Forgery (CSRF)CVE-2025-22538 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Stored XSS.This issue affects Virtual Bot: from n/a through <= 1.0.0.

  Product

  Virtual Bot

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Virtual Bot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Tock Widget: Cross-Site Request Forgery (CSRF)CVE-2025-22520 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through <= 1.1.

  Product

  Tock Widget

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Tock Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Admin debug wordpress – enable debug: Cross-Site Request Forgery (CSRF)CVE-2025-22503 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in digitalzoomstudio Admin debug wordpress – enable debug dzs-enable-debug allows Cross Site Request Forgery.This issue affects Admin debug wordpress – enable debug: from n/a through <= 1.0.13.

  Product

  Admin debug wordpress – enable debug

  Affected

  up to 1.0.13

  What to do

  Affects up to 1.0.13. Update Admin debug wordpress – enable debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025BSK Forms Blacklist: Cross-Site Request Forgery (CSRF)CVE-2025-22347 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Cross-Site Request Forgery (CSRF) vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Blind SQL Injection.This issue affects BSK Forms Blacklist: from n/a through <= 3.9.

  Product

  BSK Forms Blacklist

  Affected

  up to 3.9

  What to do

  Affects up to 3.9. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025wpSOL: Cross-Site Request Forgery (CSRF)CVE-2025-22343 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through <= 1.2.0.

  Product

  wpSOL

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update wpSOL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025WP Simple Sitemap: Cross-Site Request Forgery (CSRF)CVE-2025-22342 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Jenst WP Simple Sitemap wp-simple-sitemap allows Stored XSS.This issue affects WP Simple Sitemap: from n/a through <= 0.2.

  Product

  WP Simple Sitemap

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update WP Simple Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Wizhi Multi Filters by Wenprise: Cross-Site Request Forgery (CSRF)CVE-2025-22336 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Amos Lee（一刀） Wizhi Multi Filters by Wenprise wizhi-multi-filters allows Stored XSS.This issue affects Wizhi Multi Filters by Wenprise: from n/a through <= 1.8.6.

  Product

  Wizhi Multi Filters by Wenprise

  Affected

  up to 1.8.6

  What to do

  Affects up to 1.8.6. Update Wizhi Multi Filters by Wenprise to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Elevio: Cross-Site Request Forgery (CSRF)CVE-2025-22328 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Elevio by Dixa Elevio elevio allows Stored XSS.This issue affects Elevio: from n/a through <= 4.4.1.

  Product

  Elevio

  Affected

  up to 4.4.1

  What to do

  Affects up to 4.4.1. Update Elevio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Autocompleter: Cross-Site Request Forgery (CSRF)CVE-2025-22325 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in nchankov Autocompleter autocompleter allows Stored XSS.This issue affects Autocompleter: from n/a through <= 1.3.5.2.

  Product

  Autocompleter

  Affected

  up to 1.3.5.2

  What to do

  Affects up to 1.3.5.2. Update Autocompleter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025MyBookTable Bookstore: Cross-Site Request Forgery (CSRF)CVE-2025-22301 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in zookatron MyBookTable Bookstore mybooktable allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore: from n/a through <= 3.5.3.

  Product

  MyBookTable Bookstore

  Affected

  up to 3.5.3

  What to do

  Affects up to 3.5.3. Update MyBookTable Bookstore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025PixelYourSite – Your smart PIXEL (TAG) Manager: Cross-Site Request Forgery (CSRF)CVE-2025-22300 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Cross Site Request Forgery.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through <= 10.0.1.2.

  Product

  PixelYourSite – Your smart PIXEL (TAG) Manager

  Affected

  up to 10.0.1.2

  What to do

  Affects up to 10.0.1.2. Update PixelYourSite – Your smart PIXEL (TAG) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025AI WP Writer: Cross-Site Request Forgery (CSRF)CVE-2025-22297 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in aipost AI WP Writer ai-wp-writer allows Cross Site Request Forgery.This issue affects AI WP Writer: from n/a through <= 3.8.4.4.

  Product

  AI WP Writer

  Affected

  up to 3.8.4.4

  What to do

  Affects up to 3.8.4.4. Update AI WP Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2025Compact WP Audio Player: Server-Side Request Forgery (SSRF)CVE-2024-56279 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Server-Side Request Forgery (SSRF) vulnerability in mra13 Compact WP Audio Player compact-wp-audio-player allows Server Side Request Forgery.This issue affects Compact WP Audio Player: from n/a through <= 1.9.14.

  Product

  Compact WP Audio Player

  Affected

  up to 1.9.14

  What to do

  Affects up to 1.9.14. Update Compact WP Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.