Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
697 results · page 6 of 14
Jun 9, 2025Seofy Core: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-39473 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebGeniusLab Seofy Core seofy-core allows PHP Local File Inclusion.This issue affects Seofy Core: from n/a through <= 1.6.8.
- Product
- Seofy Core
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update Seofy Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31917 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.3.
- Product
- Universal Video Player
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025CLEVER: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31635 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup CLEVER lbg-audio11-html5-shoutcast_history allows Path Traversal.This issue affects CLEVER: from n/a through <= 2.6.
- Product
- CLEVER
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update CLEVER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Universal Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31057 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player elementor_widget_universal_video_player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 1.4.0.
- Product
- Universal Video Player
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Universal Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Apptha Slider Gallery: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31050 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appthaplugins Apptha Slider Gallery apptha-slider-gallery allows Path Traversal.This issue affects Apptha Slider Gallery: from n/a through <= 2.5.
- Product
- Apptha Slider Gallery
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Apptha Slider Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025WP Job Portal: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48273 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Path Traversal.This issue affects WP Job Portal: from n/a through <= 2.3.2.
- Product
- WP Job Portal
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025belingoGeo: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47603 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Belingo belingoGeo belingogeo allows Path Traversal.This issue affects belingoGeo: from n/a through <= 1.12.0.
- Product
- belingoGeo
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update belingoGeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47535 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.2.0.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Infocob CRM Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47513 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in James Laforge Infocob CRM Forms infocob-crm-forms allows Path Traversal.This issue affects Infocob CRM Forms: from n/a through <= 2.4.0.
- Product
- Infocob CRM Forms
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Infocob CRM Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Tainacan: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47512 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tainacan Tainacan tainacan allows Path Traversal.This issue affects Tainacan: from n/a through <= 0.21.14.
- Product
- Tainacan
- Affected
- up to 0.21.14
- What to do
- Affects up to 0.21.14. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Drag and Drop File Upload for Elementor Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47492 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Path Traversal.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.4.3.
- Product
- Drag and Drop File Upload for Elementor Forms
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Drag and Drop File Upload for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Web3Press: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LikeCoin Web3Press likecoin allows Path Traversal.This issue affects Web3Press: from n/a through <= 3.2.0.
- Product
- Web3Press
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Web3Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46486 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.7.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.7
- What to do
- Affects up to 7.1.7. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025KBx Pro Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31053 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Path Traversal.This issue affects KBx Pro Ultimate: from n/a through < 8.0.5.
- Product
- KBx Pro Ultimate
- What to do
- Update KBx Pro Ultimate to the newest version.
May 22, 2025Hot Random Image: Path TraversalCVE-2025-4419 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to access arbitrary images with allowed extensions, outside of the originally intended directory.
- Product
- Hot Random Image
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2025Section Widget: Path Traversal: '.../...//'CVE-2025-46441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Path Traversal: '.../...//' vulnerability in ctltwp Section Widget section-widget allows Path Traversal.This issue affects Section Widget: from n/a through <= 3.3.1.
- Product
- Section Widget
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Section Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Restaurant: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32926 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Tastyc: Path Traversal: '.../...//'CVE-2025-27010 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.
- Product
- Tastyc
- What to do
- Update Tastyc to the newest version.
May 16, 2025WHMpress: Path TraversalCVE-2025-39492 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.
- Product
- WHMpress
- What to do
- Update WHMpress to the newest version.
May 16, 2025WHMpress: Path TraversalCVE-2025-39491 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.
- Product
- WHMpress
- What to do
- Update WHMpress to the newest version.
May 14, 2025Eventin: Relative Path TraversalCVE-2025-47445 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.
- Product
- Eventin
- Affected
- up to 4.0.26
- What to do
- Affects up to 4.0.26. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Open Close WooCommerce Store: Path Traversal: '.../...//'CVE-2025-47649 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.9.
- Product
- Open Close WooCommerce Store
- Affected
- up to 4.9.9
- What to do
- Affects up to 4.9.9. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025List category posts: Path Traversal: '.../...//'CVE-2025-47636 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Fernando Briano List category posts list-category-posts allows PHP Local File Inclusion.This issue affects List category posts: from n/a through <= 0.91.0.
- Product
- List category posts
- Affected
- up to 0.91.0
- What to do
- Affects up to 0.91.0. Update List category posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025WPMasterToolKit (WPMTK) – All in one: Directory TraversalCVE-2025-3300 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- WPMasterToolKit (WPMTK) – All in one
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update WPMasterToolKit (WPMTK) – All in one to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 18, 2025Ivy School: Path Traversal: '.../...//'CVE-2025-39470 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in ThimPress Ivy School ivy-school allows PHP Local File Inclusion.This issue affects Ivy School: from n/a through <= 1.6.0.
- Product
- Ivy School
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Ivy School to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025StoreContrl Woocommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-39568 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arture B.V. StoreContrl Woocommerce storecontrl-wp-connection allows Path Traversal.This issue affects StoreContrl Woocommerce: from n/a through <= 4.1.3.
- Product
- StoreContrl Woocommerce
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update StoreContrl Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025MyTicket Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-27299 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Asia MyTicket Events myticket-events allows Path Traversal.This issue affects MyTicket Events: from n/a through <= 1.2.4.
- Product
- MyTicket Events
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update MyTicket Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025Theme File Duplicator: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-27283 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rockgod100 Theme File Duplicator theme-file-duplicator allows Path Traversal.This issue affects Theme File Duplicator: from n/a through <= 1.3.
- Product
- Theme File Duplicator
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Theme File Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 16, 2025Administrator Z: Path Traversal: '.../...//'CVE-2025-39598 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Path Traversal: '.../...//' vulnerability in Quý Lê 91 Administrator Z administrator-z allows Path Traversal.This issue affects Administrator Z: from n/a through <= 2025.03.28.
- Product
- Administrator Z
- Affected
- up to 2025.03.28
- What to do
- Affects up to 2025.03.28. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025WPJobBoard: Path TraversalCVE-2025-30966 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Path Traversal vulnerability in NotFound WPJobBoard allows Path Traversal. This issue affects WPJobBoard: from n/a through n/a.
- Product
- WPJobBoard
- What to do
- Update WPJobBoard to the newest version.
Apr 11, 2025Print Science Designer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32671 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John Weissberg Print Science Designer print-science-designer allows Path Traversal.This issue affects Print Science Designer: from n/a through <= 1.3.155.
- Product
- Print Science Designer
- Affected
- up to 1.3.155
- What to do
- Affects up to 1.3.155. Update Print Science Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Database Toolset: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32633 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in neoslab Database Toolset database-toolset allows Path Traversal.This issue affects Database Toolset: from n/a through <= 1.8.4.
- Product
- Database Toolset
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Database Toolset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Oxygen MyData for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32631 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through <= 1.0.64.
- Product
- Oxygen MyData for WooCommerce
- Affected
- up to 1.0.64
- What to do
- Affects up to 1.0.64. Update Oxygen MyData for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WP-BusinessDirectory: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32629 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Path Traversal.This issue affects WP-BusinessDirectory: from n/a through <= 3.1.2.
- Product
- WP-BusinessDirectory
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WooCommerce Pickupp: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32587 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pickupp WooCommerce Pickupp wc-pickupp allows PHP Local File Inclusion.This issue affects WooCommerce Pickupp: from n/a through <= 2.4.3.
- Product
- WooCommerce Pickupp
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update WooCommerce Pickupp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Shop Products Filter: Path Traversal: '.../...//'CVE-2025-32585 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Trusty Plugins Shop Products Filter trusty-woo-products-filter allows PHP Local File Inclusion.This issue affects Shop Products Filter: from n/a through <= 1.2.
- Product
- Shop Products Filter
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Shop Products Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Simple WP Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32509 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through <= 1.8.17.
- Product
- Simple WP Events
- Affected
- up to 1.8.17
- What to do
- Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Linet ERP-Woocommerce Integration: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31411 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Path Traversal.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.12.
- Product
- Linet ERP-Woocommerce Integration
- Affected
- up to 3.5.12
- What to do
- Affects up to 3.5.12. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Vice Versa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27350 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Vice Versa vice-versa allows Reflected XSS.This issue affects Vice Versa: from n/a through <= 2.2.3.
- Product
- Vice Versa
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Vice Versa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.5.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.5
- What to do
- Affects up to 7.1.5. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Piotnet Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32205 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Piotnet Forms: from n/a through <= 1.0.30.
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025DyaPress ERP/CRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30582 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclusion.This issue affects DyaPress ERP/CRM: from n/a through <= 18.0.2.0.
- Product
- DyaPress ERP/CRM
- Affected
- up to 18.0.2.0
- What to do
- Affects up to 18.0.2.0. Update DyaPress ERP/CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025s2Member: Relative Path TraversalCVE-2025-32137 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419.
- Product
- s2Member
- Affected
- up to 250419
- What to do
- Affects up to 250419. Update s2Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Fonto: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31827 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vlad.olaru Fonto fonto allows Path Traversal.This issue affects Fonto: from n/a through <= 1.2.2.
- Product
- Fonto
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Fonto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Category Icon: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31825 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pixelgrade Category Icon category-icon allows Path Traversal.This issue affects Category Icon: from n/a through <= 1.0.1.
- Product
- Category Icon
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Category Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Publitio: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31800 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in publitio Publitio publitio allows Path Traversal.This issue affects Publitio: from n/a through <= 2.2.0.
- Product
- Publitio
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Docxpresso: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31554 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal.This issue affects Docxpresso: from n/a through <= 2.6.
- Product
- Docxpresso
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Docxpresso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025include-file: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30596 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tstafford include-file include-file allows Path Traversal.This issue affects include-file: from n/a through <= 1.
- Product
- include-file
- Affected
- up to 1
- What to do
- Affects up to 1. Update include-file to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Countdown & Clock: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30841 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in adamskaat Countdown & Clock countdown-builder allows Remote Code Inclusion.This issue affects Countdown & Clock: from n/a through <= 2.8.8.
- Product
- Countdown & Clock
- Affected
- up to 2.8.8
- What to do
- Affects up to 2.8.8. Update Countdown & Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025CM Download Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30910 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CreativeMindsSolutions CM Download Manager cm-download-manager allows Path Traversal.This issue affects CM Download Manager: from n/a through <= 2.9.6.
- Product
- CM Download Manager
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update CM Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.