Vulnerability database

3,629 results · page 5 of 73

• Dec 31, 2025Bloggie: Cross-Site Request Forgery (CSRF)CVE-2025-31054 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Themefy Bloggie allows Reflected XSS.This issue affects Bloggie: from n/a through 2.0.8.

  Product

  Bloggie

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Bloggie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025WP Gmail SMTP: Cross-Site Request Forgery (CSRF)CVE-2025-62123 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.

  Product

  WP Gmail SMTP

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update WP Gmail SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Co-marquage service-public.fr: Cross-Site Request Forgery (CSRF)CVE-2025-62113 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in emendo_seb Co-marquage service-public.fr co-marquage-service-public allows Cross Site Request Forgery.This issue affects Co-marquage service-public.fr: from n/a through <= 0.5.77.

  Product

  Co-marquage service-public.fr

  Affected

  up to 0.5.77

  What to do

  Affects up to 0.5.77. Update Co-marquage service-public.fr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Pardakht Delkhah: Cross-Site Request Forgery (CSRF)CVE-2025-62101 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Omid Shamloo Pardakht Delkhah pardakht-delkhah allows Cross Site Request Forgery.This issue affects Pardakht Delkhah: from n/a through <= 3.0.0.

  Product

  Pardakht Delkhah

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Pardakht Delkhah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Post Snippets: Cross-Site Request Forgery (CSRF)CVE-2025-63040 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Post Snippets post-snippets allows Cross Site Request Forgery.This issue affects Post Snippets: from n/a through <= 4.0.11.

  Product

  Post Snippets

  Affected

  up to 4.0.11

  What to do

  Affects up to 4.0.11. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Gmedia Photo Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-63014 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Cross Site Request Forgery.This issue affects Gmedia Photo Gallery: from n/a through <= 1.25.0.

  Product

  Gmedia Photo Gallery

  Affected

  up to 1.25.0

  What to do

  Affects up to 1.25.0. Update Gmedia Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Robots.txt rewrite: Cross-Site Request Forgery (CSRF)CVE-2025-62148 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Eugen Bobrowski Robots.txt rewrite robotstxt-rewrite allows Cross Site Request Forgery.This issue affects Robots.txt rewrite: from n/a through <= 1.6.1.

  Product

  Robots.txt rewrite

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Robots.txt rewrite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025FormFacade: Cross-Site Request Forgery (CSRF)CVE-2025-62133 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in manidoraisamy FormFacade formfacade allows Cross Site Request Forgery.This issue affects FormFacade: from n/a through <= 1.4.1.

  Product

  FormFacade

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update FormFacade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Mergado Pack: Cross-Site Request Forgery (CSRF)CVE-2025-62089 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Cross Site Request Forgery.This issue affects Mergado Pack: from n/a through <= 4.2.1.

  Product

  Mergado Pack

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Mergado Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025iNext Woo Pincode Checker: Cross-Site Request Forgery (CSRF)CVE-2025-62084 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Imdad Next Web iNext Woo Pincode Checker inext-woo-pincode-checker allows Cross Site Request Forgery.This issue affects iNext Woo Pincode Checker: from n/a through <= 2.3.1.

  Product

  iNext Woo Pincode Checker

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update iNext Woo Pincode Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-62080 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross Site Request Forgery.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.

  Product

  Live Shopping & Shoppable Videos For WooCommerce

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Appointify: Cross-Site Request Forgery (CSRF)CVE-2025-59130 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a through <= 1.0.8.

  Product

  Appointify

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Contact Form Widget: Cross-Site Request Forgery (CSRF)CVE-2025-62134 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.5.1.

  Product

  Contact Form Widget

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Contact Form Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025OpenHook: Cross-Site Request Forgery (CSRF)CVE-2025-62120 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Rick Beckman OpenHook thesis-openhook allows Cross Site Request Forgery.This issue affects OpenHook: from n/a through <= 4.3.1.

  Product

  OpenHook

  Affected

  up to 4.3.1

  What to do

  Affects up to 4.3.1. Update OpenHook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025EasyIndex: Cross-Site Request Forgery (CSRF)CVE-2025-62117 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Jayce53 EasyIndex easyindex allows Cross Site Request Forgery.This issue affects EasyIndex: from n/a through <= 1.1.1704.

  Product

  EasyIndex

  Affected

  up to 1.1.1704

  What to do

  Affects up to 1.1.1704. Update EasyIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Everest Backup: Cross-Site Request Forgery (CSRF)CVE-2025-62992 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Path Traversal.This issue affects Everest Backup: from n/a through <= 2.3.11.

  Product

  Everest Backup

  Affected

  up to 2.3.11

  What to do

  Affects up to 2.3.11. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Zoho ZeptoMail: Cross-Site Request Forgery (CSRF)CVE-2025-49028 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail Zoho ZeptoMail transmail allows Stored XSS.This issue affects Zoho ZeptoMail: from n/a through <= 3.3.1.

  Product

  Zoho ZeptoMail

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update Zoho ZeptoMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Custom Post Status: Cross-Site Request Forgery (CSRF)CVE-2025-68885 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in page-carbajal Custom Post Status custom-post-status allows Stored XSS.This issue affects Custom Post Status: from n/a through <= 1.1.0.

  Product

  Custom Post Status

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Custom Post Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Recent Posts From Each Category: Cross-Site Request Forgery (CSRF)CVE-2025-49354 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Mindstien Technologies Recent Posts From Each Category recent-posts-from-each-category allows Stored XSS.This issue affects Recent Posts From Each Category: from n/a through <= 1.4.

  Product

  Recent Posts From Each Category

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Recent Posts From Each Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Noindex by Path: Cross-Site Request Forgery (CSRF)CVE-2025-49353 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path noindex-by-path allows Stored XSS.This issue affects Noindex by Path: from n/a through <= 1.0.

  Product

  Noindex by Path

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Noindex by Path to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025WP-EasyArchives: Cross-Site Request Forgery (CSRF)CVE-2025-49345 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through <= 3.1.2.

  Product

  WP-EasyArchives

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update WP-EasyArchives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025SensitiveTagCloud: Cross-Site Request Forgery (CSRF)CVE-2025-49344 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in reneade SensitiveTagCloud sensitive-tag-cloud allows Stored XSS.This issue affects SensitiveTagCloud: from n/a through <= 1.4.1.

  Product

  SensitiveTagCloud

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update SensitiveTagCloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Social Profilr: Cross-Site Request Forgery (CSRF)CVE-2025-49343 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in socialprofilr Social Profilr social-profilr-display-social-network-profile allows Stored XSS.This issue affects Social Profilr: from n/a through <= 1.0.

  Product

  Social Profilr

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Social Profilr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Custom Style: Cross-Site Request Forgery (CSRF)CVE-2025-49342 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in merzedes Custom Style custom-style allows Stored XSS.This issue affects Custom Style: from n/a through <= 1.0.

  Product

  Custom Style

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Custom Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Behance Portfolio Manager: Cross-Site Request Forgery (CSRF)CVE-2025-59137 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.

  Product

  Behance Portfolio Manager

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Simple Archive Generator: Cross-Site Request Forgery (CSRF)CVE-2025-49346 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.

  Product

  Simple Archive Generator

  Affected

  up to 5.2

  What to do

  Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025WP-CalDav2ICS: Cross-Site Request Forgery (CSRF)CVE-2025-59131 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2ICS: from n/a through <= 1.3.4.

  Product

  WP-CalDav2ICS

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update WP-CalDav2ICS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Import into Easy Property Listings: Cross-Site Request Forgery (CSRF)CVE-2025-62112 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Merv Barrett Import into Easy Property Listings easy-property-listings-xml-csv-import allows Cross Site Request Forgery.This issue affects Import into Easy Property Listings: from n/a through <= 2.2.1.

  Product

  Import into Easy Property Listings

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Import into Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025WING WordPress Migrator: Cross-Site Request Forgery (CSRF)CVE-2025-52835 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through <= 1.2.0.

  Product

  WING WordPress Migrator

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update WING WordPress Migrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Popup box: Cross-Site Request Forgery (CSRF)CVE-2025-69021 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.

  Product

  Popup box

  Affected

  up to 6.0.7

  What to do

  Affects up to 6.0.7. Update Popup box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Heateor Social Login: Cross-Site Request Forgery (CSRF)CVE-2025-68998 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.

  Product

  Heateor Social Login

  Affected

  up to 1.1.39

  What to do

  Affects up to 1.1.39. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Five Star Restaurant Reservations: Cross-Site Request Forgery (CSRF)CVE-2025-68601 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.8.

  Product

  Five Star Restaurant Reservations

  Affected

  up to 2.7.8

  What to do

  Affects up to 2.7.8. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Vimeotheque: Cross-Site Request Forgery (CSRF)CVE-2025-68584 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.

  Product

  Vimeotheque

  Affected

  up to 2.3.5.2

  What to do

  Affects up to 2.3.5.2. Update Vimeotheque to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Fast User Switching: Cross-Site Request Forgery (CSRF)CVE-2025-68583 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affects Fast User Switching: from n/a through <= 1.4.10.

  Product

  Fast User Switching

  Affected

  up to 1.4.10

  What to do

  Affects up to 1.4.10. Update Fast User Switching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Advanced Classifieds & Directory Pro: Cross-Site Request Forgery (CSRF)CVE-2025-68580 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Request Forgery.This issue affects Advanced Classifieds & Directory Pro: from n/a through <= 3.2.9.

  Product

  Advanced Classifieds & Directory Pro

  Affected

  up to 3.2.9

  What to do

  Affects up to 3.2.9. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Simple Keyword to Link: Cross-Site Request Forgery (CSRF)CVE-2025-68573 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through <= 1.5.

  Product

  Simple Keyword to Link

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update Simple Keyword to Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025My auctions allegro: Cross-Site Request Forgery (CSRF)CVE-2025-68567 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Cross Site Request Forgery.This issue affects My auctions allegro: from n/a through <= 3.6.33.

  Product

  My auctions allegro

  Affected

  up to 3.6.33

  What to do

  Affects up to 3.6.33. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025WP Email Capture: Cross-Site Request Forgery (CSRF)CVE-2025-68529 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.

  Product

  WP Email Capture

  Affected

  up to 3.12.5

  What to do

  Affects up to 3.12.5. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Trade Runner: Cross-Site Request Forgery (CSRF)CVE-2025-67625 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: from n/a through <= 3.14.

  Product

  Trade Runner

  Affected

  up to 3.14

  What to do

  Affects up to 3.14. Update Trade Runner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Evergreen Post Tweeter: Cross-Site Request Forgery (CSRF)CVE-2025-67622 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in titopandub Evergreen Post Tweeter evergreen-post-tweeter allows Stored XSS.This issue affects Evergreen Post Tweeter: from n/a through <= 1.8.9.

  Product

  Evergreen Post Tweeter

  Affected

  up to 1.8.9

  What to do

  Affects up to 1.8.9. Update Evergreen Post Tweeter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 22, 2025Custom 404 Pro: Cross-Site Request Forgery (CSRF)CVE-2025-62880 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Kunal Custom 404 Pro custom-404-pro allows Cross Site Request Forgery.This issue affects Custom 404 Pro: from n/a through <= 3.12.0.

  Product

  Custom 404 Pro

  Affected

  up to 3.12.0

  What to do

  Affects up to 3.12.0. Update Custom 404 Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 22, 2025Feather Login Page: Cross-Site Request Forgery (CSRF)CVE-2025-62107 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather Login Page: from n/a through <= 1.1.7.

  Product

  Feather Login Page

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Meks Quick Plugin Disabler: Cross-Site Request Forgery (CSRF)CVE-2025-68083 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Meks Meks Quick Plugin Disabler meks-quick-plugin-disabler allows Cross Site Request Forgery.This issue affects Meks Quick Plugin Disabler: from n/a through <= 1.0.

  Product

  Meks Quick Plugin Disabler

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Meks Quick Plugin Disabler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Semrush Content Toolkit: Cross-Site Request Forgery (CSRF)CVE-2025-68082 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through <= 1.1.32.

  Product

  Semrush Content Toolkit

  Affected

  up to 1.1.32

  What to do

  Affects up to 1.1.32. Update Semrush Content Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Freshchat: Cross-Site Request Forgery (CSRF)CVE-2025-64240 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a through <= 2.3.4.

  Product

  Freshchat

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update Freshchat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025RTL Tester: Cross-Site Request Forgery (CSRF)CVE-2025-64239 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Yoav Farhi RTL Tester rtl-tester allows Cross Site Request Forgery.This issue affects RTL Tester: from n/a through <= 1.2.

  Product

  RTL Tester

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update RTL Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Quick Interest Slider: Cross-Site Request Forgery (CSRF)CVE-2025-64237 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Graham Quick Interest Slider quick-interest-slider allows Cross Site Request Forgery.This issue affects Quick Interest Slider: from n/a through <= 3.1.5.

  Product

  Quick Interest Slider

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Listify: Cross-Site Request Forgery (CSRF)CVE-2025-59009 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Listify listify allows Cross Site Request Forgery.This issue affects Listify: from n/a through <= 3.2.5.

  Product

  Listify

  Affected

  up to 3.2.5

  What to do

  Affects up to 3.2.5. Update Listify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WP Attractive Donations System - Easy Stripe & Paypal donations: Cross-Site Request Forgery (CSRF)CVE-2025-58999 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Cross Site Request Forgery.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.

  Product

  WP Attractive Donations System - Easy Stripe & Paypal donations

  Affected

  up to 1.25

  What to do

  Affects up to 1.25. Update WP Attractive Donations System - Easy Stripe & Paypal donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 14, 2025HelloLeads CRM Form Shortcode: Does not have authorisation and CSRF checkCVE-2025-12696 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them

  Product

  HelloLeads CRM Form Shortcode

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update HelloLeads CRM Form Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.