Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,935 results · page 6 of 39
Feb 4, 2026Fortis for WooCommerce: Authorization bypassCVE-2026-0679 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'check_fortis_notify_response' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order statuses to paid/processing/completed, effectively allowing them to mark orders as paid without payment.
- Product
- Fortis for WooCommerce
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Fortis for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 2, 2026Library Viewer: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2025-15396 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Library Viewer
- Fixed in
- 3.2.0
- What to do
- Update Library Viewer to 3.2.0 or newer.
Jan 26, 2026AhaChat Messenger Marketing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14316 · WordPress plugins & themes · reported by WPScanHigh 7.1
The AhaChat Messenger Marketing WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- AhaChat Messenger Marketing
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AhaChat Messenger Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2026Frontis Blocks: Server-Side Request ForgeryCVE-2026-0807 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint.
- Product
- Frontis Blocks
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Frontis Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026Frontis Blocks: Server-Side Request Forgery (SSRF)CVE-2025-68030 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in WP Messiah Frontis Blocks frontis-blocks allows Server Side Request Forgery.This issue affects Frontis Blocks: from n/a through <= 1.1.5.
- Product
- Frontis Blocks
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Frontis Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 12, 2026Quiz Maker: Does not sanitise and escape some of its settingsCVE-2025-14579 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Maker WordPress plugin before 6.7.0.89 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quiz Maker
- Fixed in
- 6.7.0.89
- What to do
- Update Quiz Maker to 6.7.0.89 or newer.
Jan 9, 2026NEX-Forms: Does not sanitise and escape some of its settingsCVE-2025-14803 · WordPress plugins & themes · reported by WPScanMedium 6.8
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.
- Product
- NEX-Forms
- Fixed in
- 9.1.8
- What to do
- Update NEX-Forms to 9.1.8 or newer.
Jan 5, 2026FlexTable: Does not sanitise and escape the imported links from Google Sheet cellsCVE-2025-9543 · WordPress plugins & themes · reported by WPScanLow 3.5
The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- FlexTable
- Fixed in
- 3.19.2
- What to do
- Update FlexTable to 3.19.2 or newer.
Jan 2, 2026ShopBuilder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13456 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ShopBuilder
- Fixed in
- 3.2.2
- What to do
- Update ShopBuilder to 3.2.2 or newer.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14313 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Advance WP Query Search Filter: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-14312 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Advance WP Query Search Filter
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Advance WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025FV Antispam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66102 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Antispam fv-antispam allows Reflected XSS.This issue affects FV Antispam: from n/a through <= 2.7.
- Product
- FV Antispam
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update FV Antispam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67983 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows DOM-Based XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 8.3.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 8.3
- What to do
- Affects up to 8.3. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 15, 2025URL Shortify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13355 · WordPress plugins & themes · reported by WPScanHigh 7.1
The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- URL Shortify
- Fixed in
- 1.11.4
- What to do
- Update URL Shortify to 1.11.4 or newer.
Dec 9, 2025Custom Admin Menu: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-13071 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Custom Admin Menu
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Admin Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025Broken Link Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-12629 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Broken Link Manager
- Affected
- up to 0.6.5
- What to do
- Affects up to 0.6.5. Update Broken Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025WordPress eCommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-14015 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WordPress eCommerce
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update WordPress eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Time-based SQL InjectionCVE-2025-7402 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.95
- What to do
- Affects up to 4.95. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Oct 30, 2025NS Maintenance Mode for WP: Does not sanitise and escape some of its settingsCVE-2025-10636 · WordPress plugins & themes · reported by WPScanLow 3.5
The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- NS Maintenance Mode for WP
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update NS Maintenance Mode for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MultiSite Clone Duplicator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52760 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Globalis MultiSite Clone Duplicator multisite-clone-duplicator allows Reflected XSS.This issue affects MultiSite Clone Duplicator: from n/a through <= 1.5.3.
- Product
- MultiSite Clone Duplicator
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update MultiSite Clone Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2025Simple SEO: Does not sanitise and escape some parametersCVE-2025-10357 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple SEO WordPress plugin before 2.0.32 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- Simple SEO
- Fixed in
- 2.0.32
- What to do
- Update Simple SEO to 2.0.32 or newer.
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Ajax WooSearch
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2025CTL Behance Importer Lite: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9587 · WordPress plugins & themes · reported by WPScanHigh 8.6
The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- CTL Behance Importer Lite
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CTL Behance Importer Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 29, 2025Postie: Does not sanitise and escape some of its settingsCVE-2024-5200 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Postie
- Fixed in
- 1.9.71
- What to do
- Update Postie to 1.9.71 or newer.
Sep 27, 2025WP Statistics – The Most Popular Privacy-Friendly Analytics: Stored Cross-Site ScriptingCVE-2025-9816 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Statistics – The Most Popular Privacy-Friendly Analytics
- Affected
- up to 14.5.4
- What to do
- Affects up to 14.5.4. Update WP Statistics – The Most Popular Privacy-Friendly Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 23, 2025SureForms: Does not sanitise and escape some parametersCVE-2025-8282 · WordPress plugins & themes · reported by WPScanLow 3.5
The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.
- Product
- SureForms
- Fixed in
- 1.9.1
- What to do
- Update SureForms to 1.9.1 or newer.
Sep 22, 2025Admin and Site Enhancements (ASE): Does not sanitise SVG filesCVE-2025-9487 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads
- Product
- Admin and Site Enhancements (ASE)
- Fixed in
- 7.9.8
- What to do
- Update Admin and Site Enhancements (ASE) to 7.9.8 or newer.
Sep 9, 2025AI ChatBot for WordPress: Does not sanitise and escape some of its settingsCVE-2025-9111 · WordPress plugins & themes · reported by WPScanLow 3.5
The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AI ChatBot for WordPress
- Fixed in
- 7.1.0
- What to do
- Update AI ChatBot for WordPress to 7.1.0 or newer.
Sep 5, 2025Optio Dentistry: Stored Cross-Site ScriptingCVE-2025-9853 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Optio Dentistry
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Optio Dentistry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2025Sticky Side Buttons: Does not sanitise and escape some of its settingsCVE-2023-3666 · WordPress plugins & themes · reported by WPScanLow 3.3
The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Sticky Side Buttons
- Fixed in
- 2.0.0
- What to do
- Update Sticky Side Buttons to 2.0.0 or newer.
Aug 22, 2025Simple Statistics for Feeds: Cross-Site Request Forgery (CSRF)CVE-2025-57892 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Jeff Starr Simple Statistics for Feeds simple-feed-stats allows Cross Site Request Forgery.This issue affects Simple Statistics for Feeds: from n/a through <= 20250322.
- Product
- Simple Statistics for Feeds
- Affected
- up to 20250322
- What to do
- Affects up to 20250322. Update Simple Statistics for Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2025WP Talroo: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-8281 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin and unauthenticated users.
- Product
- WP Talroo
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update WP Talroo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49400 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 8.2
- What to do
- Affects up to 8.2. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Statistics: Missing AuthorizationCVE-2025-55716 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Statistics: from n/a through <= 14.15.
- Product
- WP Statistics
- Affected
- up to 14.15
- What to do
- Affects up to 14.15. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Shopify: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-7808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Shopify
- Fixed in
- 1.5.4
- What to do
- Update WP Shopify to 1.5.4 or newer.
Aug 1, 2025SureForms: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-5921 · WordPress plugins & themes · reported by WPScanMedium 5.8
The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.
- Product
- SureForms
- Fixed in
- 1.7.2
- What to do
- Update SureForms to 1.7.2 or newer.
Jul 25, 2025My Reservation System: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-7022 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- My Reservation System
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update My Reservation System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2025Qwizcards | online quizzes and flashcards: Does not sanitise and escape the "_stylesheet" parameter before outputting it back in the pageCVE-2025-6174 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user.
- Product
- Qwizcards | online quizzes and flashcards
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update Qwizcards | online quizzes and flashcards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025AntiSpam for Contact Form 7: Cross-Site Request Forgery (CSRF)CVE-2025-54020 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Erik AntiSpam for Contact Form 7 cf7-antispam allows Cross Site Request Forgery.This issue affects AntiSpam for Contact Form 7: from n/a through <= 0.6.3.
- Product
- AntiSpam for Contact Form 7
- Affected
- up to 0.6.3
- What to do
- Affects up to 0.6.3. Update AntiSpam for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2025Hostel: Does not sanitise and escape some of its settingsCVE-2025-6236 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Hostel
- Fixed in
- 1.1.5.9
- What to do
- Update Hostel to 1.1.5.9 or newer.
Jul 10, 2025Hostel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-6234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Hostel
- Fixed in
- 1.1.5.8
- What to do
- Update Hostel to 1.1.5.8 or newer.
Jul 4, 2025VG WORT METIS: Missing AuthorizationCVE-2025-50039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VG WORT METIS: from n/a through <= 2.0.1.
- Product
- VG WORT METIS
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update VG WORT METIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025WP Visitor Statistics (Real Time Traffic): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53566 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Stored XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.8.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 7.8
- What to do
- Affects up to 7.8. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Cross-Site Request ForgeryCVE-2025-6459 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2025-6437 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Time-based SQL InjectionCVE-2025-5339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlocalhostwordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Local File Inclusion which leads to Remote Code ExecutionCVE-2025-4689 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2025-4381 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Local File InclusionCVE-2025-4380 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jun 30, 2025Contact Form: Does not sanitise and escape some of its settingsCVE-2025-5730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Contact Form
- Fixed in
- 1.1.29
- What to do
- Update Contact Form to 1.1.29 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.