Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

641 results · page 5 of 13

Nov 5, 2025File Manager for Google Drive – Integrate Google Drive with: Sensitive information exposureCVE-2025-12139 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.5.3 via the "get_localize_data" function. This makes it possible for unauthenticated attackers to extract sensitive data including Google OAuth credentials (client_id and client_secret) and Google account email addresses.
Product
File Manager for Google Drive – Integrate Google Drive with
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update File Manager for Google Drive – Integrate Google Drive with to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 5, 2025ElementInvader Addons for Elementor: Allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form actionCVE-2025-10873 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.
Product
ElementInvader Addons for Elementor
Fixed in
1.4.1
What to do
Update ElementInvader Addons for Elementor to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Oct 25, 2025Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: SQL InjectionCVE-2025-11893 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation of the vulnerability requires a paid donation.
Product
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Affected
up to 1.8.8.4
What to do
Affects up to 1.8.8.4. Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2025RapidResult: SQL InjectionCVE-2025-10748 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
RapidResult
Affected
up to 1.2
What to do
Affects up to 1.2. Update RapidResult to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49378 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.
Product
Hydra Booking
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Hydra Booking: Missing AuthorizationCVE-2025-49377 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.
Product
Hydra Booking
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2025WhyDonate – FREE Donate button – Crowdfunding – Fundraising: Unauthorized loss of dataCVE-2025-10186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
Product
WhyDonate – FREE Donate button – Crowdfunding – Fundraising
Affected
up to 4.0.15
What to do
Affects up to 4.0.15. Update WhyDonate – FREE Donate button – Crowdfunding – Fundraising to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 14, 2025SureForms – Drag and Drop Form Builder for: Sensitive Information DisclosureCVE-2025-10732 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.12.1. This is due to improper access control implementation on the '/wp-json/sureforms/v1/srfm-global-settings' REST API endpoint. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve sensitive information including API keys for Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, admin email addresses, and security-related form settings.
Product
SureForms – Drag and Drop Form Builder for
Affected
up to 1.12.1
What to do
Affects up to 1.12.1. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 11, 2025Draft List: Stored Cross-Site ScriptingCVE-2025-11197 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Draft List
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Draft List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-11228 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.10.0
What to do
Affects up to 4.10.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-11227 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.10.0
What to do
Affects up to 4.10.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: SQL InjectionCVE-2025-9200 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments() function in all versions up to, and including, 0.8.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App
Affected
up to 0.8.8.8
What to do
Affects up to 0.8.8.8. Update Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 22, 2025WP Category Dropdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58239 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandrika Sista WP Category Dropdown wp-category-dropdown allows Stored XSS.This issue affects WP Category Dropdown: from n/a through <= 1.9.
Product
WP Category Dropdown
Affected
up to 1.9
What to do
Affects up to 1.9. Update WP Category Dropdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Draft: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58033 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leeshadle Draft website-builder allows Stored XSS.This issue affects Draft: from n/a through <= 3.0.9.
Product
Draft
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update Draft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025DriCub: Server-Side Request Forgery (SSRF)CVE-2025-58005 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft DriCub dricub-driving-school allows Server Side Request Forgery.This issue affects DriCub: from n/a through <= 2.9.
Product
DriCub
Affected
up to 2.9
What to do
Affects up to 2.9. Update DriCub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025DriCub: Missing AuthorizationCVE-2025-58004 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DriCub: from n/a through <= 2.9.
Product
DriCub
Affected
up to 2.9
What to do
Affects up to 2.9. Update DriCub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025UK Address Postcode Validation: Insertion of Sensitive Information Into Sent DataCVE-2025-57923 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Ideal Postcodes UK Address Postcode Validation uk-address-postcode-validation allows Retrieve Embedded Sensitive Data.This issue affects UK Address Postcode Validation: from n/a through <= 3.9.2.
Product
UK Address Postcode Validation
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update UK Address Postcode Validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 20, 2025SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more: Unauthorized creation of formsCVE-2025-10489 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress is vulnerable to unauthorized creation of forms due to a missing capability check on the register_post_types() function in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to create forms when the user interface specifically prohibits it.
Product
SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2025Draft List: Stored Cross-Site ScriptingCVE-2025-10181 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Draft List
Affected
up to 2.6
What to do
Affects up to 2.6. Update Draft List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 10, 2025Auto Save Remote Images (Drafts): Server-Side Request ForgeryCVE-2025-7843 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetch_images() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Auto Save Remote Images (Drafts)
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Auto Save Remote Images (Drafts) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 5, 2025vipdrv: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58884 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ivan Drago vipdrv vipdrv-vip-test-drive allows Stored XSS.This issue affects vipdrv: from n/a through <= 1.0.3.
Product
vipdrv
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update vipdrv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Drag and Drop File Upload for Elementor Forms: Unrestricted Upload of File with Dangerous TypeCVE-2025-49387 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.5.3.
Product
Drag and Drop File Upload for Elementor Forms
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Drag and Drop File Upload for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2025PDF for Elementor Forms + Drag And Drop Template Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58208 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Stored XSS.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.2.0.
Product
PDF for Elementor Forms + Drag And Drop Template Builder
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 21, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-7221 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 20, 2025Druco: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54055 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Druco druco allows Reflected XSS.This issue affects Druco: from n/a through <= 1.5.2.
Product
Druco
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Druco to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2025Drag and Drop Multiple File Upload for Contact Form 7: Directory TraversalCVE-2025-8464 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7_guest_user_id cookie. This makes it possible for unauthenticated attackers to upload and delete files outside of the originally intended directory. The impact of this vulnerability is limited, as file types are validated and only safe ones can be uploaded, while deletion is limited to the plugin's uploads folder.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Affected
up to 1.3.9.0
What to do
Affects up to 1.3.9.0. Update Drag and Drop Multiple File Upload for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2025The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin forCVE-2025-7499 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_response function in all versions up to and including 4.1.1. This makes it possible for unauthenticated attackers to retrieve passwords for password-protected documents as well as the metadata of private and draft documents.
Affected
up to 4.1.1
What to do
Affects up to 4.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2025Dropshix: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49898 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xolluteon Dropshix allows DOM-Based XSS.This issue affects Dropshix: from n/a through 4.0.14.
Product
Dropshix
Affected
up to 4.0.14
What to do
Affects up to 4.0.14. Update Dropshix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Integrate Google Drive: Cross-Site Request Forgery (CSRF)CVE-2025-54703 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Cross Site Request Forgery.This issue affects Integrate Google Drive: from n/a through <= 1.5.2.
Product
Integrate Google Drive
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025WP Airdrop Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49053 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kadesthemes WP Airdrop Manager airdrop allows Stored XSS.This issue affects WP Airdrop Manager: from n/a through <= 1.0.5.
Product
WP Airdrop Manager
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update WP Airdrop Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-8620 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 5, 2025Use-your-Drive | Google Drive plugin for: Stored Cross-Site ScriptingCVE-2025-7050 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file metadata in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability can be exploited by the lowest authentication level permitted to upload files, including unauthenticated users, once a file upload shortcode is published on a publicly accessible post.
Product
Use-your-Drive | Google Drive plugin for
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Use-your-Drive | Google Drive plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpcloudplugins.gitbook.io wordfence.com
Jul 31, 2025GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2025-7205 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with GiveWP worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additionally, they need to trick an administrator into visiting the legacy version of the site.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 29, 2025Hydra Booking: Privilege EscalationCVE-2025-7689 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation.
Product
Hydra Booking
Affected
1.1.0 to 1.1.18
What to do
Affects 1.1.0 to 1.1.18. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 25, 2025Droip: Unauthorized modification and access of dataCVE-2025-5835 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more.
Product
Droip
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record droip.com wordfence.com
Jul 25, 2025Droip: Arbitrary file uploadsCVE-2025-5831 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Droip
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record droip.com wordfence.com
Jul 22, 2025The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerabCVE-2025-7644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in all widgets in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 21, 2025WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.CVE-2025-54352 · WordPress plugins & themes · reported by MITRELow 3.7
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.
Affected
up to 6.8.2
What to do
Affects up to 6.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record imperva.com
Jul 19, 2025Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms: PHP Object InjectionCVE-2025-7696 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.3 via deserialization of untrusted input within the verify_field_val() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
Product
Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2025FG Drupal to: Server-Side Request Forgery (SSRF)CVE-2025-48294 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through <= 3.90.0.
Product
FG Drupal to
Affected
up to 3.90.0
What to do
Affects up to 3.90.0. Update FG Drupal to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2025Residential Address Detection: Missing AuthorizationCVE-2025-48155 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Residential Address Detection: from n/a through <= 2.5.9.
Product
Residential Address Detection
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update Residential Address Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 9, 2025SureForms – Drag and Drop Form Builder for: PHP Object InjectionCVE-2025-6742 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
SureForms – Drag and Drop Form Builder for
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 9, 2025SureForms – Drag and Drop Form Builder for: Arbitrary file deletionCVE-2025-6691 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
SureForms – Drag and Drop Form Builder for
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update SureForms – Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2025Email Address Security by WebEmailProtector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28976 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dsrodzin Email Address Security by WebEmailProtector webemailprotector allows Stored XSS.This issue affects Email Address Security by WebEmailProtector: from n/a through <= 3.3.6.
Product
Email Address Security by WebEmailProtector
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Email Address Security by WebEmailProtector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 2, 2025Drag and Drop Multiple File Upload (Pro) - WooCommerce: Arbitrary file uploadsCVE-2025-5746 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dnd_upload_cf7_upload_chunks() function in version 5.0 - 5.0.5 (when bundled with the PrintSpace theme) and all versions up to, and including, 1.7.1 (in the standalone version). This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The execution of PHP is disabled via a .htaccess file but is still possible in certain server configurations. CVE-2025-49885 may be a duplicate of this.
Product
Drag and Drop Multiple File Upload (Pro) - WooCommerce
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Drag and Drop Multiple File Upload (Pro) - WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codedropz.com wordfence.com
Jun 27, 2025Address Autocomplete via Google for Gravity Forms: Cross-Site Request Forgery (CSRF)CVE-2025-53263 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Site Request Forgery.This issue affects Address Autocomplete via Google for Gravity Forms: from n/a through <= 1.3.4.
Product
Address Autocomplete via Google for Gravity Forms
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Address Autocomplete via Google for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025Drag and Drop Multiple File Upload (Pro) - WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-49885 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-pro allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through <= 5.0.6.
Product
Drag and Drop Multiple File Upload (Pro) - WooCommerce
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Drag and Drop Multiple File Upload (Pro) - WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 27, 2025HYDRO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31428 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO hydro allows Reflected XSS.This issue affects HYDRO: from n/a through <= 2.8.
Product
HYDRO
Affected
up to 2.8
What to do
Affects up to 2.8. Update HYDRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2025Drive Folder Embedder: Stored Cross-Site ScriptingCVE-2025-6546 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Drive Folder Embedder
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Drive Folder Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 25, 2025Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: Stored Cross-Site ScriptingCVE-2025-5275 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
Product
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Affected
up to 1.8.6.1
Fixed in
1.8.6.1
What to do
Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to 1.8.6.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.