Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

4,613 results · page 56 of 93

Mar 27, 2025publish post email notification: Cross-Site Request Forgery (CSRF)CVE-2025-30816 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This issue affects publish post email notification: from n/a through <= 1.0.2.3.
Product
publish post email notification
Affected
up to 1.0.2.3
What to do
Affects up to 1.0.2.3. Update publish post email notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025Product Catalog: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30524 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through <= 1.0.4.
Product
Product Catalog
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025WP Multistore Locator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28898 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows SQL Injection.This issue affects WP Multistore Locator: from n/a through <= 2.5.2.
Product
WP Multistore Locator
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update WP Multistore Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025WP Compress – Instant Performance & Speed Optimization: Unauthorized access, modification, and loss of dataCVE-2025-2110 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
Product
WP Compress – Instant Performance & Speed Optimization
Affected
up to 6.30.15
What to do
Affects up to 6.30.15. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2025BWL Advanced FAQ Manager: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13801 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'baf_set_notice_status' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
BWL Advanced FAQ Manager
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update BWL Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 25, 2025Ultimate Dashboard – Custom WordPress Dashboard: Unauthorized modification of dataCVE-2025-2276 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_module_actions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules.
Product
Ultimate Dashboard – Custom WordPress Dashboard
Affected
up to 3.8.7
What to do
Affects up to 3.8.7. Update Ultimate Dashboard – Custom WordPress Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 25, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Unauthorized access and modification of dataCVE-2025-2224 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
Product
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
Affected
up to 8.2
What to do
Affects up to 8.2. Update Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site SCVE-2025-1798 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.
Fixed in
1.1.2
What to do
Update the plugin to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2025aoa-downloadable: Lacks authorization and authentication for requests to its downloadCVE-2024-13618 · WordPress plugins & themes · reported by WPScanHigh 7.2
The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
Product
aoa-downloadable
Affected
up to 0.1.0
What to do
Affects up to 0.1.0. Update aoa-downloadable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 24, 2025Related Posts via Categories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30602 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alphasis Related Posts via Categories related-posts-via-categories allows Stored XSS.This issue affects Related Posts via Categories: from n/a through <= 2.1.2.
Product
Related Posts via Categories
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Related Posts via Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025Menu Duplicator: Missing AuthorizationCVE-2025-30543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in swayam.tejwani Menu Duplicator copy-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Menu Duplicator: from n/a through <= 1.0.
Product
Menu Duplicator
Affected
up to 1.0
What to do
Affects up to 1.0. Update Menu Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 22, 2025ProfileGrid – User Profiles, Groups and Communities: Unauthorized modification of dataCVE-2025-1408 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.4.4
What to do
Affects up to 5.9.4.4. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2025Motors – Car Dealer, Classifieds & Listing: Unauthorized modification of dataCVE-2024-13737 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the motors_create_template and motors_delete_template functions in all versions up to, and including, 1.4.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts or create listing templates. This issue requires Elementor plugin to be installed, which is a required plugin for Motors Starter Theme.
Product
Motors – Car Dealer, Classifieds & Listing
Affected
up to 1.4.57
What to do
Affects up to 1.4.57. Update Motors – Car Dealer, Classifieds & Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized modification of dataCVE-2025-1766 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
Product
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Affected
up to 4.0.24
What to do
Affects up to 4.0.24. Update Event Manager, Events Calendar, Tickets, Registrations – Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2025Passbeemedia Web Push Notification: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13877 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Passbeemedia Web Push Notification
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Passbeemedia Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 19, 2025FoodBakery | Delivery Restaurant Directory: Unauthorized access of data and modification of dataCVE-2024-12920 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, export_widget_settings, ajax_import_widget_data, foodbakery_var_settings_backup_generate, foodbakery_var_backup_file_restore, and theme_option_rest_all functions in all versions up to, and including, 4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files, update theme options, export widget options, import widget options, generate backups, restore backups, and reset theme options.
Product
FoodBakery | Delivery Restaurant Directory
Affected
up to 4.7
What to do
Affects up to 4.7. Update FoodBakery | Delivery Restaurant Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 19, 2025CozyStay: Unauthorized modification of dataCVE-2024-13412 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to execute arbitrary actions.
Product
CozyStay
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update CozyStay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 19, 2025Altair: Unauthorized modification of data that can lead to privilege escalationCVE-2024-12922 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check within functions.php in all versions up to, and including, 5.2.4. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Altair
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update Altair to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net themeforest.net
Mar 19, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Unauthenticated Post TrashingCVE-2025-2290 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for unauthenticated attackers to change status to "Trash" for every published post, therefore limiting the availability of the website's content.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Affected
up to 8.0.1
What to do
Affects up to 8.0.1. Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025Directory Listings WordPress plugin – uListing: Unauthorized modification of data and PHP Object InjectionCVE-2025-1657 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update post meta data and inject PHP Objects that may be unserialized. A capability check was added in 2.1.8, but the unserialize is still present.
Product
Directory Listings WordPress plugin – uListing
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Directory Listings WordPress plugin – uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 14, 2025The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, andCVE-2025-2232 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.purethemes.net wordfence.com
Mar 14, 2025Civi - Job Board & Freelance Marketplace: Authentication bypassCVE-2024-13772 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email.
Product
Civi - Job Board & Freelance Marketplace
Affected
up to 2.1.6.1
What to do
Affects up to 2.1.6.1. Update Civi - Job Board & Freelance Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025Civi - Job Board & Freelance Marketplace: Authentication bypassCVE-2024-13771 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim.
Product
Civi - Job Board & Freelance Marketplace
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Civi - Job Board & Freelance Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025JobCareer | Job Board Responsive: Unauthorized access, modification, and loss of dataCVE-2024-12810 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 7.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files, generate backups, restore backups, update theme options, and reset theme options to default settings.
Product
JobCareer | Job Board Responsive
Affected
up to 7.1
What to do
Affects up to 7.1. Update JobCareer | Job Board Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025ShareThis Dashboard for Google Analytics: Unauthorized modification of dataCVE-2025-1507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_actions() function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all features.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2025SoundRise Music: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2103 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusic_ajax() function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
SoundRise Music
Affected
up to 1.6.11
What to do
Affects up to 1.6.11. Update SoundRise Music to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025Eco Nature - Environment & Ecology: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-0952 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
Product
Eco Nature - Environment & Ecology
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Eco Nature - Environment & Ecology to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025Industrial: Unauthorized modification of data that can lead to privilege escalationCVE-2024-13376 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the _ajax_get_total_content_import_items() function in all versions up to, and including, 1.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Industrial
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Industrial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025WP JobHunt: Authentication bypassCVE-2024-11286 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the cs_parse_request() function. This makes it possible for unauthenticated attackers to to log in to any user's account, including administrators.
Product
WP JobHunt
Affected
up to 7.1
What to do
Affects up to 7.1. Update WP JobHunt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 14, 2025WP JobHunt: Authentication bypassCVE-2024-11283 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to wp_ajax_google_api_login_callback function not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to access arbitrary candidate accounts.
Product
WP JobHunt
Affected
up to 7.1
What to do
Affects up to 7.1. Update WP JobHunt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 13, 2025Page Builder: Pagelayer – Drag and Drop website builder: Unauthorized post publicationCVE-2025-2104 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to unauthorized post publication due to insufficient validation on the pagelayer_save_content() function in all versions up to, and including, 1.9.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to bypass post moderation and publish posts to the site.
Product
Page Builder: Pagelayer – Drag and Drop website builder
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2025CRM and Lead Management by vcita: Unauthorized modification of dataCVE-2024-13703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae() function in all versions up to, and including, 2.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable and disable plugin widgets.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025WATI Chat and Notification: Cross-Site Request Forgery (CSRF)CVE-2025-28925 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Hieu Nguyen WATI Chat and Notification wati-chat-and-notification allows Stored XSS.This issue affects WATI Chat and Notification: from n/a through <= 1.1.2.
Product
WATI Chat and Notification
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WATI Chat and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025List of Posts from each Category plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-28894 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through <= 2.0.
Product
List of Posts from each Category plugin for
Affected
up to 2.0
What to do
Affects up to 2.0. Update List of Posts from each Category plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WP Bulk Post Duplicator: Cross-Site Request Forgery (CSRF)CVE-2025-28884 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Kumar WP Bulk Post Duplicator wp-bulk-post-duplicator allows Cross Site Request Forgery.This issue affects WP Bulk Post Duplicator: from n/a through <= 1.2.
Product
WP Bulk Post Duplicator
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Bulk Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025Frontpage category filter: Cross-Site Request Forgery (CSRF)CVE-2025-28867 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue affects Frontpage category filter: from n/a through <= 1.0.2.
Product
Frontpage category filter
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Frontpage category filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 8, 2025RomethemeKit For Elementor: Unauthorized modification of dataCVE-2024-10326 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_options and reset_widgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or reset plugin widgets to their default state (all enabled). NOTE: This vulnerability was partially fixed in version 1.5.3.
Product
RomethemeKit For Elementor
Affected
up to 1.5.3
Fixed in
1.5.3
What to do
Update RomethemeKit For Elementor to 1.5.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 8, 2025Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit: Unauthorized access, modification, and loss of dataCVE-2024-13816 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete posts, list and delete batches, list assistant uploaded files, delete personas, delete forms, delete templates, and clear logs. The vulnerability was partially patched in version 2.3.5.
Product
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
Affected
up to 2.3.6
What to do
Affects up to 2.3.6. Update Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record coderevolution.ro wordfence.com
Mar 8, 2025miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon: Authentication bypassCVE-2024-11087 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.
Product
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon
Affected
up to 200.3.9
What to do
Affects up to 200.3.9. Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record miniorange.com wordfence.com
Mar 7, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of data that can lead to privilege escalationCVE-2025-1309 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the uip_save_form_as_option() function in all versions up to, and including, 3.5.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.04
What to do
Affects up to 3.5.04. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025WPCOM Member: Authentication bypassCVE-2025-1475 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'user_phone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if SMS login is enabled.
Product
WPCOM Member
Affected
up to 1.7.5
What to do
Affects up to 1.7.5. Update WPCOM Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 7, 2025Flex Mag - Responsive WordPress News: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13655 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
Flex Mag - Responsive WordPress News
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Flex Mag - Responsive WordPress News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 6, 2025Homey: Authentication bypassCVE-2025-0749 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it possible for unauthenticated attackers to log in to the first verified user.
Product
Homey
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update Homey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record favethemes.zendesk.com wordfence.com
Mar 6, 2025Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics: Unauthorized modification of dataCVE-2025-1666 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the send_uninstall_survey() function in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit the uninstall survey on behalf of a website.
Product
Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2025Notibar – Notification Bar for: Stored Cross-Site ScriptingCVE-2025-1672 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Notibar – Notification Bar for
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Notibar – Notification Bar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 5, 2025WP Real Estate Manager: Authentication BypassCVE-2025-1515 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.
Product
WP Real Estate Manager
Affected
up to 2.8
What to do
Affects up to 2.8. Update WP Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Mar 5, 2025Simple Notification: Stored Cross-Site ScriptingCVE-2024-13866 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Simple Notification
Affected
up to 1.3
What to do
Affects up to 1.3. Update Simple Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 3, 2025VW Storefront: Unauthorized modification of dataCVE-2024-13686 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_settings() function in all versions up to, and including, 0.9.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the themes settings.
Product
VW Storefront
Affected
up to 0.9.9
What to do
Affects up to 0.9.9. Update VW Storefront to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Mar 3, 2025SMS Alert Order Notifications: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-26988 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.7.8.
Product
SMS Alert Order Notifications
Affected
up to 3.7.8
What to do
Affects up to 3.7.8. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025SMS Alert Order Notifications: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26984 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Reflected XSS.This issue affects SMS Alert Order Notifications: from n/a through <= 3.7.8.
Product
SMS Alert Order Notifications
Affected
up to 3.7.8
What to do
Affects up to 3.7.8. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.