Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
706 results · page 6 of 15
Aug 14, 2025Post and Page Builder by BoldGrid: Path Traversal: '.../...//'CVE-2025-52712 · WordPress plugins & themes · reported by PatchstackMedium 4.2
Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
- Product
- Post and Page Builder by BoldGrid
- Affected
- up to 1.27.8
- What to do
- Affects up to 1.27.8. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2025Post SMTP: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-24000 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
- Product
- Post SMTP
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 31, 2025HT Mega – Absolute Addons For Elementor: Path TraversalCVE-2025-8151 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1 via the 'save_block_css' function. This makes it possible for authenticated attackers, with Author-level access and above, to create CSS files in any directory, and delete CSS files in any directory in a Windows environment.
- Product
- HT Mega – Absolute Addons For Elementor
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update HT Mega – Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2025Birth Chart Compatibility: Full Path DisclosureCVE-2025-6082 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Birth Chart Compatibility
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Birth Chart Compatibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgwordpress.org
Jul 16, 2025HTML5 Radio Player - WPBakery Page Builder Addon: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31070 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg-cleverbakery allows Path Traversal.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through <= 2.5.
- Product
- HTML5 Radio Player - WPBakery Page Builder Addon
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update HTML5 Radio Player - WPBakery Page Builder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Easy Video Player Wordpress & WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-28955 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FWDesign Easy Video Player Wordpress & WooCommerce fwdevp allows Path Traversal.This issue affects Easy Video Player Wordpress & WooCommerce: from n/a through <= 10.0.
- Product
- Easy Video Player Wordpress & WooCommerce
- Affected
- up to 10.0
- What to do
- Affects up to 10.0. Update Easy Video Player Wordpress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2025RSFirewall!: Path TraversalCVE-2025-7518 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- RSFirewall!
- Affected
- up to 1.1.42
- What to do
- Affects up to 1.1.42. Update RSFirewall! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 4, 2025Leyka: Path Traversal: '.../...//'CVE-2025-52805 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through <= 3.32.1.
- Product
- Leyka
- Affected
- up to 3.32.1
- What to do
- Affects up to 3.32.1. Update Leyka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025Frontend Admin by DynamiApps: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49303 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Path Traversal.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.7.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.28.7
- What to do
- Affects up to 3.28.7. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025Aviation Weather from NOAA: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-28980 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-noaa allows Path Traversal.This issue affects Aviation Weather from NOAA: from n/a through <= 0.7.2.
- Product
- Aviation Weather from NOAA
- Affected
- up to 0.7.2
- What to do
- Affects up to 0.7.2. Update Aviation Weather from NOAA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Plugin Inspector: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-53298 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gioni Plugin Inspector plugin-inspector allows Path Traversal.This issue affects Plugin Inspector: from n/a through <= 1.5.
- Product
- Plugin Inspector
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Plugin Inspector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Davenport - Versatile Blog and Magazine: Path Traversal: '.../...//'CVE-2025-52811 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local File Inclusion.This issue affects Davenport - Versatile Blog and Magazine WordPress Theme: from n/a through <= 1.3.
- Product
- Davenport - Versatile Blog and Magazine
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Davenport - Versatile Blog and Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Katerio - Magazine: Path TraversalCVE-2025-52810 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.
- Product
- Katerio - Magazine
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Katerio - Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025FW Food Menu: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49448 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Food Menu allows Path Traversal. This issue affects FW Food Menu : from n/a through 6.0.0.
- Product
- FW Food Menu
- Affected
- up to 6.0.0
- What to do
- Affects up to 6.0.0. Update FW Food Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025WP SmartPay: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-25171 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP SmartPay: from n/a through <= 2.7.13.
- Product
- WP SmartPay
- Affected
- up to 2.7.13
- What to do
- Affects up to 2.7.13. Update WP SmartPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Image Shadow: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-24765 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RobMarsh Image Shadow image-shadow allows Path Traversal.This issue affects Image Shadow: from n/a through <= 1.1.0.
- Product
- Image Shadow
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Image Shadow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Litho: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49879 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho litho allows Path Traversal.This issue affects Litho: from n/a through <= 3.0.
- Product
- Litho
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Litho to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: Path Traversal: '.../...//'CVE-2025-49451 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: from n/a through <= 1.0.13.
- Product
- Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025FW Gallery: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-49415 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This issue affects FW Gallery: from n/a through <= 8.0.0.
- Product
- FW Gallery
- Affected
- up to 8.0.0
- What to do
- Affects up to 8.0.0. Update FW Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Grill and Chow: Path Traversal: '.../...//'CVE-2025-49297 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6.
- Product
- Grill and Chow
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Grill and Chow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025GrandPrix: Path Traversal: '.../...//'CVE-2025-49296 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6.
- Product
- GrandPrix
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update GrandPrix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025MediClinic: Path Traversal: '.../...//'CVE-2025-49295 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through <= 2.1.
- Product
- MediClinic
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update MediClinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025WP Pipes: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48267 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2.
- Product
- WP Pipes
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Pipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spice Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48130 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.
- Product
- Spice Blocks
- Affected
- up to 2.0.7.4
- What to do
- Affects up to 2.0.7.4. Update Spice Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48124 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Path Traversal.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Welcart e-Commerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47511 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.13
- What to do
- Affects up to 2.11.13. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Arlo: Path Traversal: '.../...//'CVE-2025-39475 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3.
- Product
- Arlo
- Affected
- up to 6.0.3
- What to do
- Affects up to 6.0.3. Update Arlo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Seofy Core: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-39473 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebGeniusLab Seofy Core seofy-core allows PHP Local File Inclusion.This issue affects Seofy Core: from n/a through <= 1.6.8.
- Product
- Seofy Core
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update Seofy Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025CLEVER: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31635 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup CLEVER lbg-audio11-html5-shoutcast_history allows Path Traversal.This issue affects CLEVER: from n/a through <= 2.6.
- Product
- CLEVER
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update CLEVER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Apptha Slider Gallery: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31050 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in appthaplugins Apptha Slider Gallery apptha-slider-gallery allows Path Traversal.This issue affects Apptha Slider Gallery: from n/a through <= 2.5.
- Product
- Apptha Slider Gallery
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Apptha Slider Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025PayU India: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31022 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through < 3.8.8.
- Product
- PayU India
- What to do
- Update PayU India to the newest version.
Jun 9, 2025Password Policy Manager: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31019 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4.
- Product
- Password Policy Manager
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Password Policy Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Modern Events Calendar Lite: Full Path DisclosureCVE-2025-5733 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Modern Events Calendar Lite
- Affected
- up to 7.21.9
- What to do
- Affects up to 7.21.9. Update Modern Events Calendar Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwebnus.networdpress.org
May 30, 2025Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: Full Path DisclosureCVE-2025-4659 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 23, 2025WP Job Portal: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-48273 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Path Traversal.This issue affects WP Job Portal: from n/a through <= 2.3.2.
- Product
- WP Job Portal
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025belingoGeo: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47603 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Belingo belingoGeo belingogeo allows Path Traversal.This issue affects belingoGeo: from n/a through <= 1.12.0.
- Product
- belingoGeo
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update belingoGeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47535 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.2.0.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Infocob CRM Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47513 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in James Laforge Infocob CRM Forms infocob-crm-forms allows Path Traversal.This issue affects Infocob CRM Forms: from n/a through <= 2.4.0.
- Product
- Infocob CRM Forms
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Infocob CRM Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Tainacan: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47512 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in tainacan Tainacan tainacan allows Path Traversal.This issue affects Tainacan: from n/a through <= 0.21.14.
- Product
- Tainacan
- Affected
- up to 0.21.14
- What to do
- Affects up to 0.21.14. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Drag and Drop File Upload for Elementor Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47492 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elementor-forms allows Path Traversal.This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through <= 1.4.3.
- Product
- Drag and Drop File Upload for Elementor Forms
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Drag and Drop File Upload for Elementor Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Subaccounts for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-47461 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in mediaticus Subaccounts for WooCommerce subaccounts-for-woocommerce allows Authentication Abuse.This issue affects Subaccounts for WooCommerce: from n/a through <= 1.6.6.
- Product
- Subaccounts for WooCommerce
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Subaccounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Web3Press: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LikeCoin Web3Press likecoin allows Path Traversal.This issue affects Web3Press: from n/a through <= 3.2.0.
- Product
- Web3Press
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Web3Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46486 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.7.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.7
- What to do
- Affects up to 7.1.7. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025KBx Pro Ultimate: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31053 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in quantumcloud KBx Pro Ultimate knowledgebase-helpdesk-pro allows Path Traversal.This issue affects KBx Pro Ultimate: from n/a through < 8.0.5.
- Product
- KBx Pro Ultimate
- What to do
- Update KBx Pro Ultimate to the newest version.
May 22, 2025Hot Random Image: Path TraversalCVE-2025-4419 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hot Random Image plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.9.2 via the 'path' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to access arbitrary images with allowed extensions, outside of the originally intended directory.
- Product
- Hot Random Image
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Hot Random Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2025Section Widget: Path Traversal: '.../...//'CVE-2025-46441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Path Traversal: '.../...//' vulnerability in ctltwp Section Widget section-widget allows Path Traversal.This issue affects Section Widget: from n/a through <= 3.3.1.
- Product
- Section Widget
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Section Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Restaurant: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32926 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Tastyc: Path Traversal: '.../...//'CVE-2025-27010 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.
- Product
- Tastyc
- What to do
- Update Tastyc to the newest version.
May 19, 2025Masteriyo - LMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-33939 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.
- Product
- Masteriyo - LMS
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025WHMpress: Path TraversalCVE-2025-39492 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.
- Product
- WHMpress
- What to do
- Update WHMpress to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.