Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

573 results · page 5 of 12

Feb 19, 2026YITH WooCommerce Compare: Deserialization of Untrusted DataCVE-2026-22333 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through <= 3.6.0.
Product
YITH WooCommerce Compare
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update YITH WooCommerce Compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026WpEvently: Deserialization of Untrusted DataCVE-2026-24954 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.
Product
WpEvently
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026North: Deserialization of Untrusted DataCVE-2025-69099 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5.
Product
North
Affected
up to 5.7.5
What to do
Affects up to 5.7.5. Update North to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Sound | Musical Instruments Online Store: Deserialization of Untrusted DataCVE-2025-69079 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.
Product
Sound | Musical Instruments Online Store
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update Sound | Musical Instruments Online Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Tech Life CPT: Deserialization of Untrusted DataCVE-2025-69036 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Tech Life CPT: from n/a through <= 16.4.
Product
Tech Life CPT
Affected
up to 16.4
What to do
Affects up to 16.4. Update Tech Life CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Dental Care CPT: Deserialization of Untrusted DataCVE-2025-69035 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.
Product
Dental Care CPT
Fixed in
21.6
What to do
Update Dental Care CPT to 21.6 or newer.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026OneLife: Deserialization of Untrusted DataCVE-2025-69002 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.
Product
OneLife
Affected
up to 3.9
What to do
Affects up to 3.9. Update OneLife to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Anona: Deserialization of Untrusted DataCVE-2025-68903 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects Anona: from n/a through <= 8.0.
Product
Anona
Affected
up to 8.0
What to do
Affects up to 8.0. Update Anona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Vivagh: Deserialization of Untrusted DataCVE-2025-68899 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through <= 2.4.
Product
Vivagh
Affected
up to 2.4
What to do
Affects up to 2.4. Update Vivagh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Eventin: Deserialization of Untrusted DataCVE-2025-68047 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.
Product
Eventin
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Kids Heaven: Deserialization of Untrusted DataCVE-2025-67619 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.
Product
Kids Heaven
Affected
up to 3.2
What to do
Affects up to 3.2. Update Kids Heaven to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Consult Aid: Deserialization of Untrusted DataCVE-2025-67617 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
Product
Consult Aid
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Consult Aid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026JupiterX Core: Deserialization of Untrusted DataCVE-2025-50004 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.
Product
JupiterX Core
Affected
up to 4.10.1
What to do
Affects up to 4.10.1. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Newsletters: Deserialization of Untrusted DataCVE-2025-67911 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.
Product
Newsletters
Affected
up to 4.11
What to do
Affects up to 4.11. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026DZS Video Gallery: Deserialization of Untrusted DataCVE-2025-47552 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.
Product
DZS Video Gallery
Affected
up to 12.37
What to do
Affects up to 12.37. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026DZS Video Gallery: Deserialization of Untrusted DataCVE-2025-47553 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.25.
Product
DZS Video Gallery
Affected
up to 12.25
What to do
Affects up to 12.25. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026Themify Edmin: Deserialization of Untrusted DataCVE-2025-31047 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0.
Product
Themify Edmin
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Themify Edmin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Icegram Express Pro: Deserialization of Untrusted DataCVE-2025-68038 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Express Pro: from n/a through < 5.9.14.
Product
Icegram Express Pro
What to do
Update Icegram Express Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Booking and Rental Manager: Deserialization of Untrusted DataCVE-2025-64266 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.
Product
Booking and Rental Manager
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Codiqa: Deserialization of Untrusted DataCVE-2025-64233 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.
Product
Codiqa
What to do
Update Codiqa to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.7
What to do
Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Jannah: Deserialization of Untrusted DataCVE-2025-64206 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.
Product
Jannah
Affected
up to 7.6.0
What to do
Affects up to 7.6.0. Update Jannah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms Salesforce: Deserialization of Untrusted DataCVE-2025-60180 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.5.1.
Product
WP Gravity Forms Salesforce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms HubSpot: Deserialization of Untrusted DataCVE-2025-60178 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.
Product
WP Gravity Forms HubSpot
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update WP Gravity Forms HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms Constant Contact: Deserialization of Untrusted DataCVE-2025-60174 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.
Product
WP Gravity Forms Constant Contact
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Gravity Forms Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms Zoho CRM and Bigin: Deserialization of Untrusted DataCVE-2025-60091 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.
Product
WP Gravity Forms Zoho CRM and Bigin
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms Insightly: Deserialization of Untrusted DataCVE-2025-60090 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.
Product
WP Gravity Forms Insightly
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update WP Gravity Forms Insightly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Gravity Forms FreshDesk: Deserialization of Untrusted DataCVE-2025-60089 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
Product
WP Gravity Forms FreshDesk
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update WP Gravity Forms FreshDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF for Elementor Forms + Drag And Drop Template Builder: Deserialization of Untrusted DataCVE-2025-60084 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
Product
PDF for Elementor Forms + Drag And Drop Template Builder
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF Invoice Builder for WooCommerce: Deserialization of Untrusted DataCVE-2025-60083 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
Product
PDF Invoice Builder for WooCommerce
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF for WPForms: Deserialization of Untrusted DataCVE-2025-60082 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Object Injection.This issue affects PDF for WPForms: from n/a through <= 6.5.0.
Product
PDF for WPForms
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF for Contact Form 7: Deserialization of Untrusted DataCVE-2025-60081 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.
Product
PDF for Contact Form 7
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF for Gravity Forms + Drag And Drop Template Builder: Deserialization of Untrusted DataCVE-2025-60080 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.
Product
PDF for Gravity Forms + Drag And Drop Template Builder
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF for Gravity Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025DentiCare: Deserialization of Untrusted DataCVE-2025-54723 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.
Product
DentiCare
What to do
Update DentiCare to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Fancy Product Designer: Information Disclosure and PHAR DeserializationCVE-2025-13439 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.fancyproductdesigner.com wordfence.com
Dec 9, 2025WP Maps: Deserialization of Untrusted DataCVE-2025-67535 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.
Product
WP Maps
Affected
up to 4.8.6
What to do
Affects up to 4.8.6. Update WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025WP Webhooks: Deserialization of Untrusted DataCVE-2025-66073 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through <= 3.3.8.
Product
WP Webhooks
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update WP Webhooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Email Subscribers & Newsletters: Deserialization of Untrusted DataCVE-2025-66055 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email Subscribers & Newsletters: from n/a through <= 5.9.10.
Product
Email Subscribers & Newsletters
Affected
up to 5.9.10
What to do
Affects up to 5.9.10. Update Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Togo: Deserialization of Untrusted DataCVE-2025-62035 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
Product
Togo
What to do
Update Togo to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025WP User Manager: Deserialization of Untrusted DataCVE-2025-60245 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.
Product
WP User Manager
Affected
up to 2.9.12
What to do
Affects up to 2.9.12. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025s2Member: Deserialization of Untrusted DataCVE-2025-58998 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
Product
s2Member
Affected
up to 250701
What to do
Affects up to 250701. Update s2Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025WP Gravity Forms Keap/Infusionsoft: Deserialization of Untrusted DataCVE-2025-58636 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
Product
WP Gravity Forms Keap/Infusionsoft
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update WP Gravity Forms Keap/Infusionsoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Falang multilanguage: Deserialization of Untrusted DataCVE-2025-58619 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through <= 1.3.65.
Product
Falang multilanguage
Affected
up to 1.3.65
What to do
Affects up to 1.3.65. Update Falang multilanguage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025TranslatePress: Deserialization of Untrusted DataCVE-2025-58592 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.
Product
TranslatePress
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Yogi - Health Beauty & Yoga: Deserialization of Untrusted DataCVE-2025-54719 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.
Product
Yogi - Health Beauty & Yoga
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Yogi - Health Beauty & Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025WeMusic: Deserialization of Untrusted DataCVE-2025-53586 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1.
Product
WeMusic
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update WeMusic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Seil: Deserialization of Untrusted DataCVE-2025-53242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
Product
Seil
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Seil to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Sign-up Sheets: Deserialization of Untrusted DataCVE-2025-49393 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
Product
Sign-up Sheets
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Sign-up Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Preserve Code Formatting: Deserialization of Untrusted DataCVE-2025-49386 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through <= 4.0.1.
Product
Preserve Code Formatting
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Preserve Code Formatting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Ajax Search Lite: Deserialization of Untrusted DataCVE-2025-48086 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
Product
Ajax Search Lite
Affected
up to 4.13.3
What to do
Affects up to 4.13.3. Update Ajax Search Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.