Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
706 results · page 5 of 15
Dec 29, 2025Mobile builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-68860 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through <= 1.4.2.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Tuturn: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-64236 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a before 3.6.
- Product
- Tuturn
- Fixed in
- 3.6
- What to do
- Update Tuturn to 3.6 or newer.
Dec 18, 2025Tuturn: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-64235 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows Path Traversal.This issue affects Tuturn: from n/a before 3.6.
- Product
- Tuturn
- Fixed in
- 3.6
- What to do
- Update Tuturn to 3.6 or newer.
Dec 18, 2025Filr: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-64230 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Chill Filr filr-protection allows Path Traversal.This issue affects Filr: from n/a through <= 1.2.10.
- Product
- Filr
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Filr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Pathfinder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58885 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <= 1.16.
- Product
- Pathfinder
- Affected
- up to 1.16
- What to do
- Affects up to 1.16. Update Pathfinder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025MapSVG: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54748 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RomanCode MapSVG mapsvg allows Path Traversal.This issue affects MapSVG: from n/a through < 8.6.12.
- Product
- MapSVG
- What to do
- Update MapSVG to the newest version.
Dec 16, 2025Health Check & Troubleshooting: Path Traversal: '.../...//'CVE-2025-64253 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Path Traversal: '.../...//' vulnerability in WordPress.org Health Check & Troubleshooting health-check allows Path Traversal.This issue affects Health Check & Troubleshooting: from n/a through <= 1.7.1.
- Product
- Health Check & Troubleshooting
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Health Check & Troubleshooting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2025Image Gallery – Photo Grid & Video Gallery: Path TraversalCVE-2025-13891 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.
- Product
- Image Gallery – Photo Grid & Video Gallery
- Affected
- up to 2.13.3
- What to do
- Affects up to 2.13.3. Update Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2025Hippoo Mobile App for WooCommerce: Path TraversalCVE-2025-13339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Hippoo Mobile App for WooCommerce
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 9, 2025Simple Download Counter: Path TraversalCVE-2025-13677 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path validation in the `simple_download_counter_parse_path()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which may contain sensitive information such as database credentials (wp-config.php) or system files. Please note that the vendor opted to continue to allow remote file downloads from arbitrary locations on the server, however, has disabled this functionality on multi-sites and provided a warning to site owners in the readme.txt when they install the plugin. While not an optimal patch, we have considered this sufficient and recommend users proceed to use the plugin with caution.
- Product
- Simple Download Counter
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Simple Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025CSV to SortTable: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-13070 · WordPress plugins & themes · reported by WPScanMedium 6.6
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
- Product
- CSV to SortTable
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update CSV to SortTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025Backup Migration: Does not properly generate its backup path in certain server configurationsCVE-2025-12394 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.
- Product
- Backup Migration
- Fixed in
- 2.0.0
- What to do
- Update Backup Migration to 2.0.0 or newer.
Nov 6, 2025Search & Go: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-62064 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7.
- Product
- Search & Go
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Search & Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Download Counter: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60242 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Anatoly Download Counter download-counter allows Path Traversal.This issue affects Download Counter: from n/a through <= 1.4.
- Product
- Download Counter
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Barcode Scanner with Inventory & Order Manager: Path Traversal: '.../...//'CVE-2025-58972 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Path Traversal: '.../...//' vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.10.4.
- Product
- Barcode Scanner with Inventory & Order Manager
- Affected
- up to 1.10.4
- What to do
- Affects up to 1.10.4. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Blanka - One Page: Path Traversal: '.../...//'CVE-2025-48090 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5.
- Product
- Blanka - One Page
- What to do
- Update Blanka - One Page to the newest version.
Nov 6, 2025Wanderland: Path Traversal: '.../...//'CVE-2025-39467 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects Wanderland: from n/a through <= 1.7.1.
- Product
- Wanderland
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Wanderland to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Smush Image Compression and Optimization: Path Traversal: '.../...//'CVE-2025-22288 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through <= 3.17.0.
- Product
- Smush Image Compression and Optimization
- Affected
- up to 3.17.0
- What to do
- Affects up to 3.17.0. Update Smush Image Compression and Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2025MelAbu WP Download Counter Button: Does not validate the path of files to be downloadedCVE-2025-11072 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/download arbitrary files.
- Product
- MelAbu WP Download Counter Button
- Affected
- up to 1.8.6.7
- What to do
- Affects up to 1.8.6.7. Update MelAbu WP Download Counter Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Zombify: Path TraversalCVE-2025-8385 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5. This is due to insufficient input validation in the zf_get_file_by_url function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read arbitrary files on the server, including sensitive system files like /etc/passwd, via a forged request. It's worth noting that successfully exploiting this vulnerability relies on a race condition as the file generated will be deleted immediately.
- Product
- Zombify
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Zombify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 24, 2025PixelYourSite: Does not validate some URL parameters before using them to generate paths passed to function/sCVE-2025-10723 · WordPress plugins & themes · reported by WPScanLow 2.7
The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks
- Product
- PixelYourSite
- Fixed in
- 11.1.2
- What to do
- Update PixelYourSite to 11.1.2 or newer.
Oct 22, 2025WP Pipes: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60227 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue affects WP Pipes: from n/a through <= 1.4.3.
- Product
- WP Pipes
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025PT Luxa Addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-60217 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ypromo PT Luxa Addons pt-luxa-addons allows Path Traversal.This issue affects PT Luxa Addons: from n/a through <= 1.2.2.
- Product
- PT Luxa Addons
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update PT Luxa Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Emails Catch All: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-60041 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3.
- Product
- Emails Catch All
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Emails Catch All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Workreap (theme's plugin): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-59566 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.5.
- Product
- Workreap (theme's plugin)
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Workreap (theme's plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Taskbot: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-58959 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Taskbot taskbot allows Path Traversal.This issue affects Taskbot: from n/a through <= 6.4.
- Product
- Taskbot
- Affected
- up to 6.4
- What to do
- Affects up to 6.4. Update Taskbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Simple Link Directory: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-49901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
- Product
- Simple Link Directory
- What to do
- Update Simple Link Directory to the newest version.
Oct 21, 2025FormGent: Is vulnerable to arbitrary file deletion due to insufficient file path validationCVE-2025-10916 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
- Product
- FormGent
- Fixed in
- 1.0.4
- What to do
- Update FormGent to 1.0.4 or newer.
Oct 15, 2025BlindMatrix e-Commerce: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-10406 · WordPress plugins & themes · reported by WPScanMedium 5.5
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
- Product
- BlindMatrix e-Commerce
- Fixed in
- 3.1
- What to do
- Update BlindMatrix e-Commerce to 3.1 or newer.
Oct 7, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Does not validate the path of files to be downloadedCVE-2025-10162 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthenticated users (before version 15.0) and any authenticated user such as a Subscriber (versions 15.0 to 15.1) to read arbitrary files on the server via a path traversal attack; the fix released in version 14 was incomplete and no fixed version is available.
- Product
- Admin and Customer Messages After Order for WooCommerce: OrderConvo
- Affected
- up to 15.1
- What to do
- Affects up to 15.1. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2025All in One Music Player: Path TraversalCVE-2025-8559 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The All in One Music Player plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.1 via the 'theme' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of files on the server, which can contain sensitive information.
- Product
- All in One Music Player
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update All in One Music Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Sep 26, 2025BM Content Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-59002 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
- Product
- BM Content Builder
- What to do
- Update BM Content Builder to the newest version.
Sep 17, 2025StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More: Path TraversalCVE-2025-9215 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the file_download() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 5, 2025WooCommerce Payment Gateway for Saferpay: Path Traversal: '.../...//'CVE-2025-48317 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay allows Path Traversal.This issue affects WooCommerce Payment Gateway for Saferpay: from n/a through <= 0.4.9.
- Product
- WooCommerce Payment Gateway for Saferpay
- Affected
- up to 0.4.9
- What to do
- Affects up to 0.4.9. Update WooCommerce Payment Gateway for Saferpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Hide Real Download Path: Cross-Site Request Forgery (CSRF)CVE-2025-58849 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Deepak S Hide Real Download Path hide-real-download-path allows Stored XSS.This issue affects Hide Real Download Path: from n/a through <= 1.6.
- Product
- Hide Real Download Path
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Hide Real Download Path to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2025Pro Bulk Watermark Plugin for: Path Traversal: '.../...//'CVE-2025-4956 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through 2.0.
- Product
- Pro Bulk Watermark Plugin for
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Pro Bulk Watermark Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2025Slider Revolution: Path TraversalCVE-2025-9217 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Slider Revolution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.7.36 via the 'used_svg' and 'used_images' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Slider Revolution
- Affected
- up to 6.7.36
- What to do
- Affects up to 6.7.36. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsliderrevolution.comwordfence.com
Aug 28, 2025Jobmonster: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-54738 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Jobmonster: from n/a through <= 4.7.9.
- Product
- Jobmonster
- Affected
- up to 4.7.9
- What to do
- Affects up to 4.7.9. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025Golo: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-54725 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through <= 1.7.0.
- Product
- Golo
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Golo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025WooCommerce csv import export: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54029 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in extendons WooCommerce csv import export extendons-eo-wooimport-export allows Path Traversal.This issue affects WooCommerce csv import export: from n/a through <= 2.0.6.
- Product
- WooCommerce csv import export
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update WooCommerce csv import export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025UPC/EAN/GTIN Code Generator: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-53588 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Path Traversal.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.
- Product
- UPC/EAN/GTIN Code Generator
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update UPC/EAN/GTIN Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025File Manager, Code Editor, and Backup by Managefy: Path TraversalCVE-2025-9345 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the ajax_downloadfile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory.
- Product
- File Manager, Code Editor, and Backup by Managefy
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update File Manager, Code Editor, and Backup by Managefy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 27, 2025Printeers Print & Ship: Path Traversal: '.../...//'CVE-2025-48081 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects Printeers Print & Ship: from n/a through 1.17.0.
- Product
- Printeers Print & Ship
- Affected
- up to 1.17.0
- What to do
- Affects up to 1.17.0. Update Printeers Print & Ship to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 25, 2025Custom Query Shortcode: Path TraversalCVE-2025-8562 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Custom Query Shortcode plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.4.0 via the 'lens' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of files on the server, which can contain sensitive information.
- Product
- Custom Query Shortcode
- Affected
- up to 0.4.0
- What to do
- Affects up to 0.4.0. Update Custom Query Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.svn.wordpress.org
Aug 20, 2025Taxi Booking Manager for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-54713 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.3.0.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Simple File List: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54021 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.14.
- Product
- Simple File List
- Affected
- up to 6.1.14
- What to do
- Affects up to 6.1.14. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Prevent files / folders access: Path Traversal: '.../...//'CVE-2025-53561 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0.
- Product
- Prevent files / folders access
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Prevent files / folders access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025BuddyPress XProfile Custom Image Field: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48158 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Alex Githatu BuddyPress XProfile Custom Image Field buddypress-xprofile-image-field allows Path Traversal.This issue affects BuddyPress XProfile Custom Image Field: from n/a through <= 3.0.1.
- Product
- BuddyPress XProfile Custom Image Field
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update BuddyPress XProfile Custom Image Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Infility Global: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Infility Infility Global infility-global allows Path Traversal.This issue affects Infility Global: from n/a through <= 2.15.06.
- Product
- Infility Global
- Affected
- up to 2.15.06
- What to do
- Affects up to 2.15.06. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Barcode Scanner with Inventory & Order Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-54715 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.9.0.
- Product
- Barcode Scanner with Inventory & Order Manager
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.