Vulnerability database

5,700 results · page 54 of 114

• Apr 1, 2025News & Blog Designer Pack: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31082 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InfornWeb News & Blog Designer Pack blog-designer-pack allows PHP Local File Inclusion.This issue affects News & Blog Designer Pack: from n/a through <= 4.0.

  Product

  News & Blog Designer Pack

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update News & Blog Designer Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025JSON Structuring Markup: Cross-Site Request Forgery (CSRF)CVE-2025-31908 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui JSON Structuring Markup json-structuring-markup allows Stored XSS.This issue affects JSON Structuring Markup: from n/a through <= 0.1.

  Product

  JSON Structuring Markup

  Affected

  up to 0.1

  What to do

  Affects up to 0.1. Update JSON Structuring Markup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Profitshare: Cross-Site Request Forgery (CSRF)CVE-2025-31906 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in ProfitShare.ro WP Profitshare wp-profitshare allows Stored XSS.This issue affects WP Profitshare: from n/a through <= 1.4.9.

  Product

  WP Profitshare

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update WP Profitshare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Ebook Downloader: Cross-Site Request Forgery (CSRF)CVE-2025-31904 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Cross Site Request Forgery.This issue affects Ebook Downloader: from n/a through <= 1.0.

  Product

  Ebook Downloader

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Ebook Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Multistore Locator: Cross-Site Request Forgery (CSRF)CVE-2025-31888 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Cross Site Request Forgery.This issue affects WP Multistore Locator: from n/a through <= 2.5.2.

  Product

  WP Multistore Locator

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Pearl: Cross-Site Request Forgery (CSRF)CVE-2025-31880 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Stylemix Pearl pearl-header-builder allows Cross Site Request Forgery.This issue affects Pearl: from n/a through <= 1.3.9.

  Product

  Pearl

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Feedbucket – Website Feedback Tool: Cross-Site Request Forgery (CSRF)CVE-2025-31859 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Feedbucket Feedbucket – Website Feedback Tool feedbucket allows Cross Site Request Forgery.This issue affects Feedbucket – Website Feedback Tool: from n/a through <= 1.0.6.

  Product

  Feedbucket – Website Feedback Tool

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Feedbucket – Website Feedback Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Bulk Product Sync: Cross-Site Request Forgery (CSRF)CVE-2025-31852 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in N-Media Bulk Product Sync sync-wc-google allows Cross Site Request Forgery.This issue affects Bulk Product Sync: from n/a through <= 8.6.

  Product

  Bulk Product Sync

  Affected

  up to 8.6

  What to do

  Affects up to 8.6. Update Bulk Product Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Theme Duplicator: Cross-Site Request Forgery (CSRF)CVE-2025-31845 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Rohit Choudhary Theme Duplicator theme-duplicator allows Cross Site Request Forgery.This issue affects Theme Duplicator: from n/a through <= 1.1.

  Product

  Theme Duplicator

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Theme Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Simple Fixed Notice: Cross-Site Request Forgery (CSRF)CVE-2025-31840 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in digireturn Simple Fixed Notice dn-cookie-notice allows Cross Site Request Forgery.This issue affects Simple Fixed Notice: from n/a through <= 1.6.

  Product

  Simple Fixed Notice

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Simple Fixed Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025DN Footer Contacts: Cross-Site Request Forgery (CSRF)CVE-2025-31839 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in digireturn DN Footer Contacts dn-footer-contacts allows Cross Site Request Forgery.This issue affects DN Footer Contacts: from n/a through <= 1.8.1.

  Product

  DN Footer Contacts

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update DN Footer Contacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Easy!Appointments: Cross-Site Request Forgery (CSRF)CVE-2025-31828 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2.

  Product

  Easy!Appointments

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Easy!Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Optin Wheel: Server-Side Request Forgery (SSRF)CVE-2025-31824 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel wp-optin-wheel allows Server Side Request Forgery.This issue affects WP Optin Wheel: from n/a through <= 1.4.7.

  Product

  WP Optin Wheel

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update WP Optin Wheel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025OwnerRez API: Cross-Site Request Forgery (CSRF)CVE-2025-31814 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in OwnerRez OwnerRez API ownerrez allows Cross Site Request Forgery.This issue affects OwnerRez API: from n/a through <= 1.2.0.

  Product

  OwnerRez API

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update OwnerRez API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Labinator Content Types Duplicator: Cross-Site Request Forgery (CSRF)CVE-2025-31809 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Labinator Labinator Content Types Duplicator labinator-content-types-duplicator allows Cross Site Request Forgery.This issue affects Labinator Content Types Duplicator: from n/a through <= 1.1.3.

  Product

  Labinator Content Types Duplicator

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Labinator Content Types Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025SCSS WP Editor: Cross-Site Request Forgery (CSRF)CVE-2025-31808 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in IT Path Solutions SCSS WP Editor scss-wp-editor allows Cross Site Request Forgery.This issue affects SCSS WP Editor: from n/a through <= 1.2.1.

  Product

  SCSS WP Editor

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update SCSS WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Product Notices for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-31807 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in CloudRedux Product Notices for WooCommerce product-notices-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Notices for WooCommerce: from n/a through <= 1.3.4.

  Product

  Product Notices for WooCommerce

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Product Notices for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025ElementsCSS Addons for Elementor: Server-Side Request Forgery (SSRF)CVE-2025-31796 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in TheInnovs ElementsCSS Addons for Elementor css-for-elementor allows Server Side Request Forgery.This issue affects ElementsCSS Addons for Elementor: from n/a through <= 1.0.8.9.

  Product

  ElementsCSS Addons for Elementor

  Affected

  up to 1.0.8.9

  What to do

  Affects up to 1.0.8.9. Update ElementsCSS Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Clearbit Reveal: Cross-Site Request Forgery (CSRF)CVE-2025-31785 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Clearbit Clearbit Reveal clearbit allows Cross Site Request Forgery.This issue affects Clearbit Reveal: from n/a through <= 1.0.6.

  Product

  Clearbit Reveal

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Clearbit Reveal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Embed Extended: Cross-Site Request Forgery (CSRF)CVE-2025-31784 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Rudy Susanto Embed Extended embed-extended allows Cross Site Request Forgery.This issue affects Embed Extended: from n/a through <= 1.4.0.

  Product

  Embed Extended

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update Embed Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Query Wrangler: Cross-Site Request Forgery (CSRF)CVE-2025-31779 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Daggerhart Query Wrangler query-wrangler allows Cross Site Request Forgery.This issue affects Query Wrangler: from n/a through <= 1.5.54.

  Product

  Query Wrangler

  Affected

  up to 1.5.54

  What to do

  Affects up to 1.5.54. Update Query Wrangler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Uptime Robot Plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-31776 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows Cross Site Request Forgery.This issue affects Uptime Robot Plugin for WordPress: from n/a through <= 2.3.

  Product

  Uptime Robot Plugin for

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Uptime Robot Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Google SEO Pressor Snippet: Cross-Site Request Forgery (CSRF)CVE-2025-31775 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Cross Site Request Forgery.This issue affects Google SEO Pressor Snippet: from n/a through <= 2.0.

  Product

  Google SEO Pressor Snippet

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Google SEO Pressor Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025CLP – Custom Login Page by NiteoThemes: Cross-Site Request Forgery (CSRF)CVE-2025-31769 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes clp-custom-login-page allows Cross Site Request Forgery.This issue affects CLP – Custom Login Page by NiteoThemes: from n/a through <= 1.5.5.

  Product

  CLP – Custom Login Page by NiteoThemes

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update CLP – Custom Login Page by NiteoThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Cache control by Cacholong: Cross-Site Request Forgery (CSRF)CVE-2025-31763 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Preliot Cache control by Cacholong cache-control-by-cacholong allows Cross Site Request Forgery.This issue affects Cache control by Cacholong: from n/a through <= 5.4.1.

  Product

  Cache control by Cacholong

  Affected

  up to 5.4.1

  What to do

  Affects up to 5.4.1. Update Cache control by Cacholong to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025TZ PlusGallery: Cross-Site Request Forgery (CSRF)CVE-2025-31756 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Cross Site Request Forgery.This issue affects TZ PlusGallery: from n/a through <= 1.5.5.

  Product

  TZ PlusGallery

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update TZ PlusGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Breaking News WP: Cross-Site Request Forgery (CSRF)CVE-2025-31751 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in doit Breaking News WP breaking-news-wp allows Cross Site Request Forgery.This issue affects Breaking News WP: from n/a through <= 1.3.

  Product

  Breaking News WP

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Breaking News WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025JS Help Desk: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30901 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through <= 2.9.2.

  Product

  JS Help Desk

  Affected

  up to 2.9.2

  What to do

  Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025WP Travel Engine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30870 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.3.5.

  Product

  WP Travel Engine

  Affected

  up to 6.3.5

  What to do

  Affects up to 6.3.5. Update WP Travel Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Essential Real Estate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30849 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.0.

  Product

  Essential Real Estate

  Affected

  up to 5.2.0

  What to do

  Affects up to 5.2.0. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 1, 2025Subscribe to Download Lite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30782 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through <= 1.2.9.

  Product

  Subscribe to Download Lite

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update Subscribe to Download Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Rich Text Editor: Cross-Site Request Forgery (CSRF)CVE-2025-31623 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in richtexteditor Rich Text Editor richtexteditor allows Stored XSS.This issue affects Rich Text Editor: from n/a through <= 1.0.1.

  Product

  Rich Text Editor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Rich Text Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025PostmarkApp Email Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-31617 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.

  Product

  PostmarkApp Email Integrator

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Varnish: Cross-Site Request Forgery (CSRF)CVE-2025-31616 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in AdminGeekZ Varnish WordPress varnish-wp allows Cross Site Request Forgery.This issue affects Varnish WordPress: from n/a through <= 1.7.

  Product

  Varnish

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Varnish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025AB Google Map Travel: Cross-Site Request Forgery (CSRF)CVE-2025-31613 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Aboobacker. AB Google Map Travel ab-google-map-travel allows Cross Site Request Forgery.This issue affects AB Google Map Travel : from n/a through <= 4.6.

  Product

  AB Google Map Travel

  Affected

  up to 4.6

  What to do

  Affects up to 4.6. Update AB Google Map Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Apimo Connector: Cross-Site Request Forgery (CSRF)CVE-2025-31602 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Proptech Plugin Apimo Connector apimo allows Cross Site Request Forgery.This issue affects Apimo Connector: from n/a through <= 2.6.5.1.

  Product

  Apimo Connector

  Affected

  up to 2.6.5.1

  What to do

  Affects up to 2.6.5.1. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Appointy Appointment Scheduler: Cross-Site Request Forgery (CSRF)CVE-2025-31601 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in appointy Appointy Appointment Scheduler appointy-appointment-scheduler allows Cross Site Request Forgery.This issue affects Appointy Appointment Scheduler: from n/a through <= 4.2.1.

  Product

  Appointy Appointment Scheduler

  Affected

  up to 4.2.1

  What to do

  Affects up to 4.2.1. Update Appointy Appointment Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025DesignO: Cross-Site Request Forgery (CSRF)CVE-2025-31600 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in designnbuy DesignO designo allows Cross Site Request Forgery.This issue affects DesignO: from n/a through <= 2.6.0.

  Product

  DesignO

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update DesignO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Elfsight Testimonials Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31588 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Cross Site Request Forgery.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.

  Product

  Elfsight Testimonials Slider

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Leadfox for: Cross-Site Request Forgery (CSRF)CVE-2025-31585 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in leadfox Leadfox for WordPress leadfox allows Cross Site Request Forgery.This issue affects Leadfox for WordPress: from n/a through <= 2.1.9.

  Product

  Leadfox for

  Affected

  up to 2.1.9

  What to do

  Affects up to 2.1.9. Update Leadfox for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025WP Copy Media URL: Cross-Site Request Forgery (CSRF)CVE-2025-31583 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Copy Media URL wp-copy-media-url allows Stored XSS.This issue affects WP Copy Media URL: from n/a through <= 2.1.

  Product

  WP Copy Media URL

  Affected

  up to 2.1

  What to do

  Affects up to 2.1. Update WP Copy Media URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Multi Days Events and Multi Events in One Day Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-31572 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in v20202020 Multi Days Events and Multi Events in One Day Calendar dragon-calendar-free-version allows Cross Site Request Forgery.This issue affects Multi Days Events and Multi Events in One Day Calendar: from n/a through <= 1.1.3.

  Product

  Multi Days Events and Multi Events in One Day Calendar

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Multi Days Events and Multi Events in One Day Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Related Posts Widget with Thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-31570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wp-buy Related Posts Widget with Thumbnails advanced-css3-related-posts-widget allows Stored XSS.This issue affects Related Posts Widget with Thumbnails: from n/a through <= 1.2.

  Product

  Related Posts Widget with Thumbnails

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Related Posts Widget with Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025wordpress related Posts with thumbnails: Cross-Site Request Forgery (CSRF)CVE-2025-31569 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in wp-buy wordpress related Posts with thumbnails related-posts-list-grid-and-slider-all-in-one allows Stored XSS.This issue affects wordpress related Posts with thumbnails: from n/a through <= 3.0.0.1.

  Product

  wordpress related Posts with thumbnails

  Affected

  up to 3.0.0.1

  What to do

  Affects up to 3.0.0.1. Update wordpress related Posts with thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025Rio Video Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-31566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in riosisgroup Rio Video Gallery rio-video-gallery allows Stored XSS.This issue affects Rio Video Gallery: from n/a through <= 2.3.6.

  Product

  Rio Video Gallery

  Affected

  up to 2.3.6

  What to do

  Affects up to 2.3.6. Update Rio Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025WP Link Preview: Server-Side Request Forgery (SSRF)CVE-2025-31527 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Server-Side Request Forgery (SSRF) vulnerability in Kishan WP Link Preview wp-link-preview allows Server Side Request Forgery.This issue affects WP Link Preview: from n/a through <= 1.4.1.

  Product

  WP Link Preview

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update WP Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025WP Church Donation: Cross-Site Request Forgery (CSRF)CVE-2025-31410 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Ashish Ajani WP Church Donation wp-church-donation allows Cross Site Request Forgery.This issue affects WP Church Donation: from n/a through <= 1.7.

  Product

  WP Church Donation

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update WP Church Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025ELEX WooCommerce Request a Quote: Missing AuthorizationCVE-2025-31406 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ELEXtensions ELEX WooCommerce Request a Quote elex-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Request a Quote: from n/a through <= 2.3.9.

  Product

  ELEX WooCommerce Request a Quote

  Affected

  up to 2.3.9

  What to do

  Affects up to 2.3.9. Update ELEX WooCommerce Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025InstaWP Connect: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31387 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect instawp-connect allows PHP Local File Inclusion.This issue affects InstaWP Connect: from n/a through <= 0.1.0.82.

  Product

  InstaWP Connect

  Affected

  up to 0.1.0.82

  What to do

  Affects up to 0.1.0.82. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Mar 31, 2025JetWooBuilder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31016 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows PHP Local File Inclusion.This issue affects JetWooBuilder: from n/a through <= 2.1.18.

  Product

  JetWooBuilder

  Affected

  up to 2.1.18

  What to do

  Affects up to 2.1.18. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.