Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

3,629 results · page 6 of 73

Dec 12, 2025Construction Light: Does not have authorisation and CSRFCVE-2025-10684 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
Product
Construction Light
Fixed in
1.6.8
What to do
Update Construction Light to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com
Dec 9, 2025WP Fast Cache: Cross-Site Request Forgery (CSRF)CVE-2023-22675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Taylor Hawkes WP Fast Cache allows Cross Site Request Forgery.This issue affects WP Fast Cache: from n/a through 1.5.
Product
WP Fast Cache
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP Fast Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vdp.patchstack.com
Dec 9, 2025SupportCandy: Cross-Site Request Forgery (CSRF)CVE-2025-67598 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.
Product
SupportCandy
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Business Directory: Cross-Site Request Forgery (CSRF)CVE-2025-67596 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Cross Site Request Forgery.This issue affects Business Directory: from n/a through <= 6.4.19.
Product
Business Directory
Affected
up to 6.4.19
What to do
Affects up to 6.4.19. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Quiz Maker: Cross-Site Request Forgery (CSRF)CVE-2025-67595 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.0.82.
Product
Quiz Maker
Affected
up to 6.7.0.82
What to do
Affects up to 6.7.0.82. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025UsersWP: Cross-Site Request Forgery (CSRF)CVE-2025-67593 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.48.
Product
UsersWP
Affected
up to 1.2.48
What to do
Affects up to 1.2.48. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025JNews Paywall: Cross-Site Request Forgery (CSRF)CVE-2025-67591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross Site Request Forgery.This issue affects JNews Paywall: from n/a through < 12.0.1.
Product
JNews Paywall
What to do
Update JNews Paywall to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Ultimate FAQ: Cross-Site Request Forgery (CSRF)CVE-2025-67590 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: from n/a through <= 2.4.3.
Product
Ultimate FAQ
Affected
up to 2.4.3
What to do
Affects up to 2.4.3. Update Ultimate FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Rencontre: Cross-Site Request Forgery (CSRF)CVE-2025-67534 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS.This issue affects Rencontre: from n/a through <= 3.13.7.
Product
Rencontre
Affected
up to 3.13.7
What to do
Affects up to 3.13.7. Update Rencontre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025CWW Companion: Cross-Site Request Forgery (CSRF)CVE-2025-67473 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in codeworkweb CWW Companion cww-companion allows Cross Site Request Forgery.This issue affects CWW Companion: from n/a through <= 1.3.2.
Product
CWW Companion
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update CWW Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Cross-Site Request Forgery (CSRF)CVE-2025-67472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Quick Contact Form: Cross-Site Request Forgery (CSRF)CVE-2025-67471 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Quick Contact Form quick-contact-form allows Cross Site Request Forgery.This issue affects Quick Contact Form: from n/a through <= 8.2.5.
Product
Quick Contact Form
Affected
up to 8.2.5
What to do
Affects up to 8.2.5. Update Quick Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025PDF Thumbnail Generator: Cross-Site Request Forgery (CSRF)CVE-2025-67469 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in kubiq PDF Thumbnail Generator pdf-thumbnail-generator allows Cross Site Request Forgery.This issue affects PDF Thumbnail Generator: from n/a through <= 1.4.
Product
PDF Thumbnail Generator
Affected
up to 1.4
What to do
Affects up to 1.4. Update PDF Thumbnail Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025GiveWP: Cross-Site Request Forgery (CSRF)CVE-2025-67467 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give allows Cross Site Request Forgery.This issue affects GiveWP: from n/a through <= 4.13.1.
Product
GiveWP
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Simple Link Directory: Cross-Site Request Forgery (CSRF)CVE-2025-67465 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Cross Site Request Forgery.This issue affects Simple Link Directory: from n/a through <= 8.8.3.
Product
Simple Link Directory
Affected
up to 8.8.3
What to do
Affects up to 8.8.3. Update Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Salon booking system: Cross-Site Request Forgery (CSRF)CVE-2025-66531 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through <= 10.30.3.
Product
Salon booking system
Affected
up to 10.30.3
What to do
Affects up to 10.30.3. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Chartify: Cross-Site Request Forgery (CSRF)CVE-2025-66529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify chart-builder allows Cross Site Request Forgery.This issue affects Chartify: from n/a through <= 3.6.3.
Product
Chartify
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Chartify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Simple Folio: Cross-Site Request Forgery (CSRF)CVE-2025-64256 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Folio simple-folio allows Cross Site Request Forgery.This issue affects Simple Folio: from n/a through <= 1.1.0.
Product
Simple Folio
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Simple Folio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025KALLYAS: Cross-Site Request Forgery (CSRF)CVE-2025-63060 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in hogash KALLYAS kallyas allows Cross Site Request Forgery.This issue affects KALLYAS: from n/a through < 4.25.0.
Product
KALLYAS
What to do
Update KALLYAS to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025New User Approve: Cross-Site Request Forgery (CSRF)CVE-2025-63030 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal New User Approve new-user-approve allows Cross Site Request Forgery.This issue affects New User Approve: from n/a through <= 3.2.3.
Product
New User Approve
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP Hotel Booking: Cross-Site Request Forgery (CSRF)CVE-2025-63012 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Booking: from n/a through <= 2.2.8.
Product
WP Hotel Booking
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP Flashy Marketing Automation: Cross-Site Request Forgery (CSRF)CVE-2025-62873 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Flashyapp WP Flashy Marketing Automation wp-flashy-marketing-automation allows Cross Site Request Forgery.This issue affects WP Flashy Marketing Automation: from n/a through <= 2.0.8.
Product
WP Flashy Marketing Automation
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update WP Flashy Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Social Photo Fetcher: Cross-Site Request Forgery (CSRF)CVE-2025-62872 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in JK Social Photo Fetcher facebook-photo-fetcher allows Cross Site Request Forgery.This issue affects Social Photo Fetcher: from n/a through <= 3.0.4.
Product
Social Photo Fetcher
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Social Photo Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Just TinyMCE Custom Styles: Cross-Site Request Forgery (CSRF)CVE-2025-62871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Alex Prokopenko / JustCoded Just TinyMCE Custom Styles just-tinymce-styles allows Cross Site Request Forgery.This issue affects Just TinyMCE Custom Styles: from n/a through <= 1.2.1.
Product
Just TinyMCE Custom Styles
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Just TinyMCE Custom Styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Auto Alt Text: Cross-Site Request Forgery (CSRF)CVE-2025-62866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Valerio Monti Auto Alt Text auto-alt-text allows Cross Site Request Forgery.This issue affects Auto Alt Text: from n/a through <= 2.5.2.
Product
Auto Alt Text
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Auto Alt Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025SMTP Mail: Cross-Site Request Forgery (CSRF)CVE-2025-62762 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in photoboxone SMTP Mail smtp-mail allows Cross Site Request Forgery.This issue affects SMTP Mail: from n/a through <= 1.3.51.
Product
SMTP Mail
Affected
up to 1.3.51
What to do
Affects up to 1.3.51. Update SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Add Custom Codes: Cross-Site Request Forgery (CSRF)CVE-2025-62739 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Cross Site Request Forgery.This issue affects Add Custom Codes: from n/a through <= 4.80.
Product
Add Custom Codes
Affected
up to 4.80
What to do
Affects up to 4.80. Update Add Custom Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Media Library Downloader: Cross-Site Request Forgery (CSRF)CVE-2025-62734 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in M.Code Media Library Downloader media-library-downloader allows Cross Site Request Forgery.This issue affects Media Library Downloader: from n/a through <= 1.4.0.
Product
Media Library Downloader
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Media Library Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Custom Sidebars by ProteusThemes: Cross-Site Request Forgery (CSRF)CVE-2025-62733 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ProteusThemes Custom Sidebars by ProteusThemes custom-sidebars-by-proteusthemes allows Cross Site Request Forgery.This issue affects Custom Sidebars by ProteusThemes: from n/a through <= 1.0.3.
Product
Custom Sidebars by ProteusThemes
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Custom Sidebars by ProteusThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Media Library File Download: Cross-Site Request Forgery (CSRF)CVE-2025-62103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpmediadownload Media Library File Download media-download allows Cross Site Request Forgery.This issue affects Media Library File Download: from n/a through <= 1.4.
Product
Media Library File Download
Affected
up to 1.4
What to do
Affects up to 1.4. Update Media Library File Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025DoFollow Case by Case: Cross-Site Request Forgery (CSRF)CVE-2025-62102 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
Product
DoFollow Case by Case
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Duplicate Content Cure: Cross-Site Request Forgery (CSRF)CVE-2025-59132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Badi Jones Duplicate Content Cure duplicate-content-cure allows Cross Site Request Forgery.This issue affects Duplicate Content Cure: from n/a through <= 1.0.
Product
Duplicate Content Cure
Affected
up to 1.0
What to do
Affects up to 1.0. Update Duplicate Content Cure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Create Posts & Terms: Cross-Site Request Forgery (CSRF)CVE-2025-49351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Valentin Agachi Create Posts & Terms create-posts-terms allows Stored XSS.This issue affects Create Posts & Terms: from n/a through <= 1.3.1.
Product
Create Posts & Terms
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Create Posts & Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP sIFR: Cross-Site Request Forgery (CSRF)CVE-2025-49347 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jupitercow WP sIFR wp-sifr allows Stored XSS.This issue affects WP sIFR: from n/a through <= 0.6.8.1.
Product
WP sIFR
Affected
up to 0.6.8.1
What to do
Affects up to 0.6.8.1. Update WP sIFR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025PDF Creator Lite: Cross-Site Request Forgery (CSRF)CVE-2025-49341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alex Furr PDF Creator Lite pdf-creator-lite allows Stored XSS.This issue affects PDF Creator Lite: from n/a through <= 1.2.
Product
PDF Creator Lite
Affected
up to 1.2
What to do
Affects up to 1.2. Update PDF Creator Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 26, 2025TAX SERVICE Electronic HDM: Does not authorization and CSRF checks in an AJAX actionCVE-2025-12061 · WordPress plugins & themes · reported by WPScanHigh 8.6
The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements
Product
TAX SERVICE Electronic HDM
Fixed in
1.2.1
What to do
Update TAX SERVICE Electronic HDM to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Nov 21, 2025I Order Terms: Cross-Site Request Forgery (CSRF)CVE-2025-66097 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Terms: from n/a through <= 1.5.0.
Product
I Order Terms
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update I Order Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Giveaways and Contests by RafflePress: Cross-Site Request Forgery (CSRF)CVE-2025-66064 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.20.
Product
Giveaways and Contests by RafflePress
Affected
up to 1.12.20
What to do
Affects up to 1.12.20. Update Giveaways and Contests by RafflePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Seriously Simple Podcasting: Cross-Site Request Forgery (CSRF)CVE-2025-66061 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
Product
Seriously Simple Podcasting
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025WP Plugin Manager: Cross-Site Request Forgery (CSRF)CVE-2025-64271 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes WP Plugin Manager wp-plugin-manager allows Cross Site Request Forgery.This issue affects WP Plugin Manager: from n/a through <= 1.4.7.
Product
WP Plugin Manager
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update WP Plugin Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025Auto Prune Posts: Cross-Site Request Forgery (CSRF)CVE-2025-64262 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in ramon fincken Auto Prune Posts auto-prune-posts allows Cross Site Request Forgery.This issue affects Auto Prune Posts: from n/a through <= 3.0.0.
Product
Auto Prune Posts
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Auto Prune Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Contest Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-62950 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.0.0.
Product
Contest Gallery
Affected
up to 28.0.0
What to do
Affects up to 28.0.0. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025WP GDPR Cookie Consent: Cross-Site Request Forgery (CSRF)CVE-2025-53316 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel WP GDPR Cookie Consent wp-gdpr-cookie-consent allows Stored XSS.This issue affects WP GDPR Cookie Consent: from n/a through <= 1.0.0.
Product
WP GDPR Cookie Consent
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WP GDPR Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Simple Stripe: Cross-Site Request Forgery (CSRF)CVE-2025-48085 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ZIPANG Simple Stripe simple-stripe allows Stored XSS.This issue affects Simple Stripe: from n/a through <= 0.9.17.
Product
Simple Stripe
Affected
up to 0.9.17
What to do
Affects up to 0.9.17. Update Simple Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025wpNamedUsers: Cross-Site Request Forgery (CSRF)CVE-2025-48083 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in andriassundskard wpNamedUsers wpnamedusers allows Stored XSS.This issue affects wpNamedUsers: from n/a through <= 0.5.
Product
wpNamedUsers
Affected
up to 0.5
What to do
Affects up to 0.5. Update wpNamedUsers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Slick Google Map: Cross-Site Request Forgery (CSRF)CVE-2025-48078 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Norbert Slick Google Map slick-google-map allows Stored XSS.This issue affects Slick Google Map: from n/a through <= 0.3.
Product
Slick Google Map
Affected
up to 0.3
What to do
Affects up to 0.3. Update Slick Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Block Country: Cross-Site Request Forgery (CSRF)CVE-2025-48077 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in nitinmaurya12 Block Country block-country allows Stored XSS.This issue affects Block Country: from n/a through <= 1.0.
Product
Block Country
Affected
up to 1.0
What to do
Affects up to 1.0. Update Block Country to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2025Bard: Cross-Site Request Forgery (CSRF)CVE-2025-64368 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes Bard bardwp allows Cross Site Request Forgery.This issue affects Bard: from n/a through <= 1.6.
Product
Bard
Affected
up to 1.6
What to do
Affects up to 1.6. Update Bard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 31, 2025Advanced Database Cleaner: Cross-Site Request Forgery (CSRF)CVE-2025-64357 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner advanced-database-cleaner allows Cross Site Request Forgery.This issue affects Advanced Database Cleaner: from n/a through <= 3.1.6.
Product
Advanced Database Cleaner
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Advanced Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 29, 2025Premmerce Product Search for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-64290 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Cross Site Request Forgery.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.
Product
Premmerce Product Search for WooCommerce
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Premmerce Product Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.