Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
612 results · page 5 of 13
Aug 28, 2025Newsletter subscription optin module: Cross-Site Request Forgery (CSRF)CVE-2025-48308 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through <= 1.2.9.
- Product
- Newsletter subscription optin module
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Newsletter subscription optin module to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP-Database-Optimizer-Tools: Cross-Site Request Forgery (CSRF)CVE-2025-53219 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in pl4g4 WP-Database-Optimizer-Tools wp-database-optimizer-tools allows Cross Site Request Forgery.This issue affects WP-Database-Optimizer-Tools: from n/a through <= 0.2.
- Product
- WP-Database-Optimizer-Tools
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update WP-Database-Optimizer-Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Structured Content (JSON-LD) #wpsc: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-3414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Structured Content (JSON-LD) #wpsc
- Fixed in
- 1.7.0
- What to do
- Update Structured Content (JSON-LD) #wpsc to 1.7.0 or newer.
Aug 8, 2025OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-6572 · WordPress plugins & themes · reported by WPScanMedium 5.9
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2025ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization: Stored Cross-Site ScriptingCVE-2025-6626 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
- Affected
- up to 3.10.3
- What to do
- Affects up to 3.10.3. Update ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2025BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript: Arbitrary file uploadsCVE-2025-7443 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
- Affected
- up to 2.2.42
- What to do
- Affects up to 2.2.42. Update BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2025WP Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-53314 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through <= 2.5.0.
- Product
- WP Optimizer
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025WP Optimize By xTraffic: Deserialization of Untrusted DataCVE-2025-28970 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic wp-optimize-by-xtraffic allows Object Injection.This issue affects WP Optimize By xTraffic: from n/a through <= 5.1.6.
- Product
- WP Optimize By xTraffic
- Affected
- up to 5.1.6
- What to do
- Affects up to 5.1.6. Update WP Optimize By xTraffic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025WP Map Block: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-5194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Map Block
- Fixed in
- 2.0.3
- What to do
- Update WP Map Block to 2.0.3 or newer.
Jun 17, 2025Noptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49871 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through <= 3.8.7.
- Product
- Noptin
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Track, Analyze & Optimize by WP Tao: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48145 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Reflected XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through <= 1.3.
- Product
- Track, Analyze & Optimize by WP Tao
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Track, Analyze & Optimize by WP Tao to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Newsletter: Does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embedCVE-2025-3581 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Newsletter
- Fixed in
- 8.8.5
- What to do
- Update Newsletter to 8.8.5 or newer.
Jun 6, 2025WP Mail Options: Cross-Site Request Forgery (CSRF)CVE-2025-28981 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through <= 0.2.3.
- Product
- WP Mail Options
- Affected
- up to 0.2.3
- What to do
- Affects up to 0.2.3. Update WP Mail Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025BM Content Builder: Unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' functionCVE-2025-1777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BM Content Builder
- Affected
- up to 3.16.2.1
- What to do
- Affects up to 3.16.2.1. Update BM Content Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseatheme.networdfence.com
Jun 3, 2025Post Slider and Post Carousel with Post Vertical Scrolling Widget: Does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embedCVE-2025-4567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Post Slider and Post Carousel with Post Vertical Scrolling Widget
- Fixed in
- 3.2.10
- What to do
- Update Post Slider and Post Carousel with Post Vertical Scrolling Widget to 3.2.10 or newer.
Jun 2, 2025WP-Optimize: Does not properly escape user inputCVE-2025-3951 · WordPress plugins & themes · reported by WPScanMedium 4.1
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.
- Product
- WP-Optimize
- Fixed in
- 4.2.0
- What to do
- Update WP-Optimize to 4.2.0 or newer.
May 21, 2025WP YouTube Video Optimizer: Stored Cross-Site ScriptingCVE-2025-4217 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP YouTube Video Optimizer
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP YouTube Video Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 19, 2025Qi Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-1627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 19, 2025Qi Blocks: Does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embedCVE-2025-1626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 19, 2025Qi Blocks: Does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embedCVE-2025-1625 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0688 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- Spiritual Gifts Survey (and optional S.H.A.P.E survey)
- Affected
- up to 0.9.10
- What to do
- Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Spiritual Gifts Survey (and optional S.H.A.P.E survey): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users.
- Product
- Spiritual Gifts Survey (and optional S.H.A.P.E survey)
- Affected
- up to 0.9.10
- What to do
- Affects up to 0.9.10. Update Spiritual Gifts Survey (and optional S.H.A.P.E survey) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-9645 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry
- Fixed in
- 2.2.93
- What to do
- Update Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry to 2.2.93 or newer.
May 15, 2025Countdown Timer for WordPress Block Editor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-10631 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Countdown Timer for WordPress Block Editor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Countdown Timer for WordPress Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2025tagDiv Opt-In Builder: Time-based SQL InjectionCVE-2025-2890 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId’ parameter in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- tagDiv Opt-In Builder
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update tagDiv Opt-In Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Internal Link Optimiser: Cross-Site Request Forgery (CSRF)CVE-2025-39547 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Stored XSS.This issue affects Internal Link Optimiser: from n/a through <= 5.1.3.
- Product
- Internal Link Optimiser
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update Internal Link Optimiser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Macro Calculator with Admin Email Optin & Data: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26730 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue affects Macro Calculator with Admin Email Optin & Data: from n/a through 1.0.
- Product
- Macro Calculator with Admin Email Optin & Data
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Macro Calculator with Admin Email Optin & Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13338 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 12, 2025Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2024-13337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcr_clearfy' page. This makes it possible for unauthenticated attackers to update the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.devplugins.trac.wordpress.org
Apr 10, 2025Internal Link Optimiser: Missing AuthorizationCVE-2025-32243 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Link Optimiser: from n/a through <= 5.1.2.
- Product
- Internal Link Optimiser
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update Internal Link Optimiser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Easy WP Optimizer: Missing AuthorizationCVE-2025-32147 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in coothemes Easy WP Optimizer easy-wp-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy WP Optimizer: from n/a through <= 1.1.0.
- Product
- Easy WP Optimizer
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Easy WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Optin Wheel: Server-Side Request Forgery (SSRF)CVE-2025-31824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel wp-optin-wheel allows Server Side Request Forgery.This issue affects WP Optin Wheel: from n/a through <= 1.4.7.
- Product
- WP Optin Wheel
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update WP Optin Wheel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025AIO Performance Profiler, Monitor, Optimize, Compress & Debug: Insertion of Sensitive Information into Log FileCVE-2025-31788 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-performance-accelerator allows Retrieve Embedded Sensitive Data.This issue affects AIO Performance Profiler, Monitor, Optimize, Compress & Debug: from n/a through <= 1.3.
- Product
- AIO Performance Profiler, Monitor, Optimize, Compress & Debug
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update AIO Performance Profiler, Monitor, Optimize, Compress & Debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025WP Database Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-31474 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Cross Site Request Forgery.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.
- Product
- WP Database Optimizer
- Affected
- up to 1.2.1.3
- What to do
- Affects up to 1.2.1.3. Update WP Database Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025WP Database Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31473 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Stored XSS.This issue affects WP Database Optimizer: from n/a through <= 1.2.1.3.
- Product
- WP Database Optimizer
- Affected
- up to 1.2.1.3
- What to do
- Affects up to 1.2.1.3. Update WP Database Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025TGG WP Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31463 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in preetindersodhi TGG WP Optimizer tgg-wp-optimizer allows Stored XSS.This issue affects TGG WP Optimizer: from n/a through <= 1.25.
- Product
- TGG WP Optimizer
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update TGG WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025AIO Performance Profiler, Monitor, Optimize, Compress & Debug: Missing AuthorizationCVE-2025-22647 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-performance-accelerator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO Performance Profiler, Monitor, Optimize, Compress & Debug: from n/a through <= 1.2.
- Product
- AIO Performance Profiler, Monitor, Optimize, Compress & Debug
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update AIO Performance Profiler, Monitor, Optimize, Compress & Debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Management-screen-droptiles: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23666 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cxc-sawa Management-screen-droptiles cxc-sawa allows Reflected XSS.This issue affects Management-screen-droptiles: from n/a through <= 1.0.
- Product
- Management-screen-droptiles
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Management-screen-droptiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025WP Compress – Instant Performance & Speed Optimization: Unauthorized access, modification, and loss of dataCVE-2025-2110 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
- Product
- WP Compress – Instant Performance & Speed Optimization
- Affected
- up to 6.30.15
- What to do
- Affects up to 6.30.15. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2025Advanced iFrame: Unauthorized excessive creation of options on the aip_map_url_callback() functionCVE-2025-1440 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the advancediFrameParameterData option with an excessive amount of unvalidated data.
- Product
- Advanced iFrame
- Affected
- up to 2024.5
- What to do
- Affects up to 2024.5. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 25, 2025WP Compress – Instant Performance & Speed Optimization: Server-Side Request ForgeryCVE-2025-2109 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
- Product
- WP Compress – Instant Performance & Speed Optimization
- Affected
- up to 6.30.15
- What to do
- Affects up to 6.30.15. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 24, 2025Simple Optimizer: Cross-Site Request Forgery (CSRF)CVE-2025-30538 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Simple Optimizer simple-optimizer allows Cross Site Request Forgery.This issue affects Simple Optimizer: from n/a through <= 1.2.7.
- Product
- Simple Optimizer
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Simple Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Theme Options Z: Cross-Site Request Forgery (CSRF)CVE-2025-25121 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in shyammakwana Theme Options Z theme-options-z allows Cross Site Request Forgery.This issue affects Theme Options Z: from n/a through <= 1.4.
- Product
- Theme Options Z
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Theme Options Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Top Bar – PopUps – by WPOptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25118 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows Reflected XSS.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.8.
- Product
- Top Bar – PopUps – by WPOptin
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Top Bar – PopUps – by WPOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Guten Free Options: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23813 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tony Hayes Guten Free Options guten-free-options allows Reflected XSS.This issue affects Guten Free Options: from n/a through <= 0.9.7.
- Product
- Guten Free Options
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update Guten Free Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Killer Theme Options: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23473 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Punit Bhalodiya Killer Theme Options killer-theme-options allows Reflected XSS.This issue affects Killer Theme Options: from n/a through <= 2.0.
- Product
- Killer Theme Options
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Killer Theme Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025JPG, PNG Compression and Optimization: Cross-Site Request Forgery (CSRF)CVE-2025-27316 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in hosting.io JPG, PNG Compression and Optimization wp-image-compression allows Cross Site Request Forgery.This issue affects JPG, PNG Compression and Optimization: from n/a through <= 1.7.35.
- Product
- JPG, PNG Compression and Optimization
- Affected
- up to 1.7.35
- What to do
- Affects up to 1.7.35. Update JPG, PNG Compression and Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025NHR Options Table Manager: Deserialization of Untrusted DataCVE-2025-27301 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager nhrrob-options-table-manager allows Object Injection.This issue affects NHR Options Table Manager: from n/a through <= 1.1.2.
- Product
- NHR Options Table Manager
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update NHR Options Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025SpeedSize Image & Video AI-Optimizer: Cross-Site Request ForgeryCVE-2024-13438 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the 'speedsize_clear_css_cache_action' function. This makes it possible for unauthenticated attackers to clear the plugins cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- SpeedSize Image & Video AI-Optimizer
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update SpeedSize Image & Video AI-Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 18, 2025Option Editor: Cross-Site Request Forgery in version 1CVE-2024-13852 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the plugin_page() function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Option Editor
- What to do
- Update Option Editor to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.