Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,239 results · page 46 of 185
Nov 21, 2025Seriously Simple Podcasting: Missing AuthorizationCVE-2025-66060 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.13.0
- What to do
- Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Seriously Simple Podcasting: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-66059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Retrieve Embedded Sensitive Data.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.13.0
- What to do
- Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66057 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows DOM-Based XSS.This issue affects Bold Page Builder: from n/a through <= 5.5.2.
- Product
- Bold Page Builder
- Affected
- up to 5.5.2
- What to do
- Affects up to 5.5.2. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Enfold: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66053 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects Enfold: from n/a through <= 7.1.2.
- Product
- Enfold
- Affected
- up to 7.1.2
- What to do
- Affects up to 7.1.2. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Simple User Registration: Stored Cross-Site ScriptingCVE-2025-12160 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple User Registration
- Affected
- up to 6.6
- What to do
- Affects up to 6.6. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 21, 2025Import WP – Export and Import CSV and XML files to: Sensitive Information ExposureCVE-2025-12894 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp.
- Product
- Import WP – Export and Import CSV and XML files to
- Affected
- up to 2.14.17
- What to do
- Affects up to 2.14.17. Update Import WP – Export and Import CSV and XML files to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 21, 2025URL Image Importer: Arbitrary file uploadsCVE-2025-12138 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The URL Image Importer plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.0.6. This is due to the plugin relying on a user-controlled Content-Type HTTP header to validate file uploads in the 'uimptr_import_image_from_url()' function which writes the file to the server before performing proper validation. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible via the uploaded PHP file.
- Product
- URL Image Importer
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update URL Image Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2025SiteSEO – SEO Simplified: Improper Authorization leading to Sensitive Post Meta DisclosureCVE-2025-13085 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Improper Authorization leading to Sensitive Post Meta Disclosure in versions up to and including 1.3.2. This is due to missing object-level authorization checks in the resolve_variables() AJAX handler. This makes it possible for authenticated attackers with the siteseo_manage capability (e.g., Author-level users who have been granted SiteSEO access by an administrator) to read arbitrary post metadata from any post, page, attachment, or WooCommerce order they cannot edit, via the custom field variable resolution feature granted they have been given access to SiteSEO by an administrator and legacy storage is enabled. In affected WooCommerce installations, this exposes sensitive customer billing information including names, email addresses, phone numbers, physical addresses, and payment methods.
- Product
- SiteSEO – SEO Simplified
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update SiteSEO – SEO Simplified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2025WP Import – Ultimate CSV XML Importer for: PHP Object InjectionCVE-2025-13145 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.33.1. This is due to deserialization of untrusted data supplied via CSV file imports in the import_single_post_as_csv function within SingleImportExport.php. This makes it possible for authenticated attackers, with administrator-level access or higher, to inject a PHP object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
- Product
- WP Import – Ultimate CSV XML Importer for
- Affected
- up to 7.33.1
- What to do
- Affects up to 7.33.1. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2025SiteSEO – SEO Simplified: Unauthorized modification of dataCVE-2025-12814 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect capability check on the siteseo_reset_settings function in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, who have been granted access to at least on SiteSEO setting capability, to reset the plugin's settings.
- Product
- SiteSEO – SEO Simplified
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update SiteSEO – SEO Simplified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2025Simple User Import Export: CSV InjectionCVE-2025-13133 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Simple User Import Export plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.1.7 via the 'Import/export users' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration
- Product
- Simple User Import Export
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Simple User Import Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordit.wordpress.orgwordfence.com
Nov 13, 2025Qi Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64383 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue affects Qi Blocks: from n/a through <= 1.4.3.
- Product
- Qi Blocks
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Qi Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Order Export & Order Import for WooCommerce: Missing AuthorizationCVE-2025-64382 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Export & Order Import for WooCommerce: from n/a through <= 2.6.7.
- Product
- Order Export & Order Import for WooCommerce
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Booking Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64381 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Calendar booking allows Stored XSS.This issue affects Booking Calendar: from n/a through <= 10.14.7.
- Product
- Booking Calendar
- Affected
- up to 10.14.7
- What to do
- Affects up to 10.14.7. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Booster for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64380 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Stored XSS.This issue affects Booster for WooCommerce: from n/a through <= 7.3.2.
- Product
- Booster for WooCommerce
- Affected
- up to 7.3.2
- What to do
- Affects up to 7.3.2. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Analytics Germanized for Google Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64292 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PascalBajorat Analytics Germanized for Google Analytics ga-germanized allows DOM-Based XSS.This issue affects Analytics Germanized for Google Analytics: from n/a through <= 1.6.2.
- Product
- Analytics Germanized for Google Analytics
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Analytics Germanized for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Booking Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64275 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through <= 2.1.17.
- Product
- Booking Manager
- Affected
- up to 2.1.17
- What to do
- Affects up to 2.1.17. Update Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Popup addon for Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64264 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows Stored XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.5.1.
- Product
- Popup addon for Ninja Forms
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Popup addon for Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed: Unauthorized modification of dataCVE-2025-12015 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_wpqai_disconnect_quicq_afosto' AJAX endpoint in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect Afosto
- Product
- Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 13, 2025Comment Edit Core – Simple Comment Editing: Sensitive Information ExposureCVE-2025-12681 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0 via the 'ajax_get_comment' function. This makes it possible for unauthenticated attackers to extract sensitive data including user IDs, IP addresses, and email addresses.
- Product
- Comment Edit Core – Simple Comment Editing
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Comment Edit Core – Simple Comment Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 2025Import any XML, CSV or Excel File to WordPress (WP All Import): Remote Code ExecutionCVE-2025-12733 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6. This is due to the use of eval() on unsanitized user-supplied input in the pmxi_if function within helpers/functions.php. This makes it possible for authenticated attackers, with import capabilities (typically administrators), to inject and execute arbitrary PHP code on the server via crafted import templates. This can lead to remote code execution.
- Product
- Import any XML, CSV or Excel File to WordPress (WP All Import)
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update Import any XML, CSV or Excel File to WordPress (WP All Import) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 12, 20250 Day Analytics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64293 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through <= 4.0.0.
- Product
- 0 Day Analytics
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update 0 Day Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of sensitive informationCVE-2025-12732 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API keys configured through the plugin's admin interface.
- Product
- WP Import – Ultimate CSV XML Importer for
- Affected
- up to 7.33
- What to do
- Affects up to 7.33. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 10, 2025Simple Donate: Stored Cross-Site ScriptingCVE-2025-11882 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's simpledonate shortcode in versions less than, or equal to, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Donate
- What to do
- Update Simple Donate to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 7, 2025HTML Forms – Simple WordPress Forms: Stored Cross-Site ScriptingCVE-2025-12125 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The HTML Forms – Simple WordPress Forms Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- HTML Forms – Simple WordPress Forms
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update HTML Forms – Simple WordPress Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 7, 2025Simple Downloads List: Unauthorized modification of dataCVE-2025-12583 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint along with many others in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to alter many of the plugin's settings/downloads and inject malicious web scripts.
- Product
- Simple Downloads List
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Simple Downloads List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2025Alloggio - Hotel Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64287 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP Local File Inclusion.This issue affects Alloggio - Hotel Booking: from n/a through <= 1.8.
- Product
- Alloggio - Hotel Booking
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Alloggio - Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Import from YML: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64232 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Import from YML import-from-yml allows Reflected XSS.This issue affects Import from YML: from n/a through <= 3.1.17.
- Product
- Import from YML
- Affected
- up to 3.1.17
- What to do
- Affects up to 3.1.17. Update Import from YML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Grand Conference Theme Custom Post Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64224 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Reflected XSS.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.
- Product
- Grand Conference Theme Custom Post Type
- Fixed in
- 2.6.4
- What to do
- Update Grand Conference Theme Custom Post Type to 2.6.4 or newer.
Nov 6, 2025Easy Social Share Buttons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64198 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Easy Social Share Buttons easy-social-share-buttons3 allows Reflected XSS.This issue affects Easy Social Share Buttons: from n/a through < 10.7.1.
- Product
- Easy Social Share Buttons
- What to do
- Update Easy Social Share Buttons to the newest version.
Nov 6, 2025Booster for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64196 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Reflected XSS.This issue affects Booster for WooCommerce: from n/a through <= 7.2.5.
- Product
- Booster for WooCommerce
- Affected
- up to 7.2.5
- What to do
- Affects up to 7.2.5. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Simple Payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62076 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6.
- Product
- Simple Payment
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Simple Payment: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62075 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6.
- Product
- Simple Payment
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WPMobile.App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62074 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.71.
- Product
- WPMobile.App
- Affected
- up to 11.71
- What to do
- Affects up to 11.71. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Savory: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62067 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Savory savory.This issue affects Savory: from n/a through <= 2.5.
- Product
- Savory
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Savory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Revolution: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62066 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Revolution revolution.This issue affects Revolution: from n/a through < 2.5.8.
- Product
- Revolution
- What to do
- Update Revolution to the newest version.
Nov 6, 2025SureRank: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62059 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank.This issue affects SureRank: from n/a through <= 1.3.2.
- Product
- SureRank
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update SureRank to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Houzez Theme - Functionality: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62057 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.
- Product
- Houzez Theme - Functionality
- What to do
- Update Houzez Theme - Functionality to the newest version.
Nov 6, 2025Academist: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62055 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist academist.This issue affects Academist: from n/a through < 1.3.
- Product
- Academist
- What to do
- Update Academist to the newest version.
Nov 6, 2025Houzez: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62053 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.
- Product
- Houzez
- What to do
- Update Houzez to the newest version.
Nov 6, 2025UDesign Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62051 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign Core u-design-core.This issue affects UDesign Core: from n/a through <= 4.14.1.
- Product
- UDesign Core
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TheGem Demo Import (for WPBakery): Missing AuthorizationCVE-2025-62046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CodexThemes TheGem Demo Import (for WPBakery) thegem-importer.This issue affects TheGem Demo Import (for WPBakery): from n/a through <= 5.10.5.
- Product
- TheGem Demo Import (for WPBakery)
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update TheGem Demo Import (for WPBakery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TheGem Theme Elements (for WPBakery): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62045 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.
- Product
- TheGem Theme Elements (for WPBakery)
- Affected
- up to 5.10.5.1
- What to do
- Affects up to 5.10.5.1. Update TheGem Theme Elements (for WPBakery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TheGem Theme Elements (for WPBakery): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62044 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.
- Product
- TheGem Theme Elements (for WPBakery)
- Affected
- up to 5.10.5.1
- What to do
- Affects up to 5.10.5.1. Update TheGem Theme Elements (for WPBakery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TheGem (Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.1.
- Product
- TheGem (Elementor)
- Affected
- up to 5.10.5.1
- What to do
- Affects up to 5.10.5.1. Update TheGem (Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025YOP Poll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62040 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YOP YOP Poll yop-poll.This issue affects YOP Poll: from n/a through <= 6.5.37.
- Product
- YOP Poll
- Affected
- up to 6.5.37
- What to do
- Affects up to 6.5.37. Update YOP Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Togo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62036 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
- Product
- Togo
- What to do
- Update Togo to the newest version.
Nov 6, 2025tagDiv Cloud Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62032 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through < 3.9.2.
- Product
- tagDiv Cloud Library
- What to do
- Update tagDiv Cloud Library to the newest version.
Nov 6, 2025tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62031 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.
- Product
- tagDiv Composer
- Affected
- up to 5.4.1
- What to do
- Affects up to 5.4.1. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62030 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.
- Product
- tagDiv Composer
- Affected
- up to 5.4.1
- What to do
- Affects up to 5.4.1. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.