Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

15,902 results · page 74 of 319

Dec 9, 2025Just TinyMCE Custom Styles: Cross-Site Request Forgery (CSRF)CVE-2025-62871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Alex Prokopenko / JustCoded Just TinyMCE Custom Styles just-tinymce-styles allows Cross Site Request Forgery.This issue affects Just TinyMCE Custom Styles: from n/a through <= 1.2.1.
Product
Just TinyMCE Custom Styles
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Just TinyMCE Custom Styles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Auto Alt Text: Cross-Site Request Forgery (CSRF)CVE-2025-62866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Valerio Monti Auto Alt Text auto-alt-text allows Cross Site Request Forgery.This issue affects Auto Alt Text: from n/a through <= 2.5.2.
Product
Auto Alt Text
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Auto Alt Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025SMTP Mail: Cross-Site Request Forgery (CSRF)CVE-2025-62762 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in photoboxone SMTP Mail smtp-mail allows Cross Site Request Forgery.This issue affects SMTP Mail: from n/a through <= 1.3.51.
Product
SMTP Mail
Affected
up to 1.3.51
What to do
Affects up to 1.3.51. Update SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Add Custom Codes: Cross-Site Request Forgery (CSRF)CVE-2025-62739 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Cross Site Request Forgery.This issue affects Add Custom Codes: from n/a through <= 4.80.
Product
Add Custom Codes
Affected
up to 4.80
What to do
Affects up to 4.80. Update Add Custom Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Media Library Downloader: Cross-Site Request Forgery (CSRF)CVE-2025-62734 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in M.Code Media Library Downloader media-library-downloader allows Cross Site Request Forgery.This issue affects Media Library Downloader: from n/a through <= 1.4.0.
Product
Media Library Downloader
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Media Library Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Custom Sidebars by ProteusThemes: Cross-Site Request Forgery (CSRF)CVE-2025-62733 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ProteusThemes Custom Sidebars by ProteusThemes custom-sidebars-by-proteusthemes allows Cross Site Request Forgery.This issue affects Custom Sidebars by ProteusThemes: from n/a through <= 1.0.3.
Product
Custom Sidebars by ProteusThemes
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Custom Sidebars by ProteusThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Media Library File Download: Cross-Site Request Forgery (CSRF)CVE-2025-62103 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpmediadownload Media Library File Download media-download allows Cross Site Request Forgery.This issue affects Media Library File Download: from n/a through <= 1.4.
Product
Media Library File Download
Affected
up to 1.4
What to do
Affects up to 1.4. Update Media Library File Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025DoFollow Case by Case: Cross-Site Request Forgery (CSRF)CVE-2025-62102 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
Product
DoFollow Case by Case
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update DoFollow Case by Case to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Generic Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62082 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Uddin Generic Elements generic-elements-for-elementor allows Stored XSS.This issue affects Generic Elements: from n/a through <= 1.2.9.
Product
Generic Elements
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Generic Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Duplicate Content Cure: Cross-Site Request Forgery (CSRF)CVE-2025-59132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Badi Jones Duplicate Content Cure duplicate-content-cure allows Cross Site Request Forgery.This issue affects Duplicate Content Cure: from n/a through <= 1.0.
Product
Duplicate Content Cure
Affected
up to 1.0
What to do
Affects up to 1.0. Update Duplicate Content Cure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Create Posts & Terms: Cross-Site Request Forgery (CSRF)CVE-2025-49351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Valentin Agachi Create Posts & Terms create-posts-terms allows Stored XSS.This issue affects Create Posts & Terms: from n/a through <= 1.3.1.
Product
Create Posts & Terms
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Create Posts & Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP sIFR: Cross-Site Request Forgery (CSRF)CVE-2025-49347 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jupitercow WP sIFR wp-sifr allows Stored XSS.This issue affects WP sIFR: from n/a through <= 0.6.8.1.
Product
WP sIFR
Affected
up to 0.6.8.1
What to do
Affects up to 0.6.8.1. Update WP sIFR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025PDF Creator Lite: Cross-Site Request Forgery (CSRF)CVE-2025-49341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Alex Furr PDF Creator Lite pdf-creator-lite allows Stored XSS.This issue affects PDF Creator Lite: from n/a through <= 1.2.
Product
PDF Creator Lite
Affected
up to 1.2
What to do
Affects up to 1.2. Update PDF Creator Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Login Security, FireWall, Malware removal by CleanTalk: Stored Cross-Site ScriptingCVE-2025-13604 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Login Security, FireWall, Malware removal by CleanTalk
Affected
up to 2.168
What to do
Affects up to 2.168. Update Login Security, FireWall, Malware removal by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 9, 2025Social Reviews & Recommendations: Stored Cross-Site ScriptingCVE-2025-12705 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Social Reviews & Recommendations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the 'trim_text' function in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.5.
Product
Social Reviews & Recommendations
Affected
up to 2.5
What to do
Affects up to 2.5. Update Social Reviews & Recommendations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Rich Shortcodes for Google Reviews: Stored Cross-Site ScriptingCVE-2025-12499 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in version 6.6.2.
Product
Rich Shortcodes for Google Reviews
Affected
up to 6.8
What to do
Affects up to 6.8. Update Rich Shortcodes for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025CSS3 Buttons: Stored Cross-Site ScriptingCVE-2025-13907 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CSS3 Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CSS3 Buttons
Affected
up to 0.1
What to do
Affects up to 0.1. Update CSS3 Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025TR Timthumb: Stored Cross-Site ScriptingCVE-2025-13899 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The TR Timthumb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TR Timthumb
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update TR Timthumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Ultra Skype Button: Stored Cross-Site ScriptingCVE-2025-13898 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultra Skype Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_id' parameter of the [ultra_skype] shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultra Skype Button
Affected
up to 1.0
What to do
Affects up to 1.0. Update Ultra Skype Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Social Feed Gallery Portfolio: Stored Cross-Site ScriptingCVE-2025-13896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Feed Gallery Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [igp-wp] shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Feed Gallery Portfolio
Affected
up to 1.3
What to do
Affects up to 1.3. Update Social Feed Gallery Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025CSV Sumotto: Reflected Cross-Site ScriptingCVE-2025-13894 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CSV Sumotto plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CSV Sumotto
Affected
up to 1.0
What to do
Affects up to 1.0. Update CSV Sumotto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2025RevInsite: Stored Cross-Site ScriptingCVE-2025-13863 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RevInsite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `token` parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RevInsite
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update RevInsite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Yet Another WebClap for: Stored Cross-Site ScriptingCVE-2025-13857 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yet Another WebClap for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter of the webclap_button shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Yet Another WebClap for
Affected
up to 0.2
What to do
Affects up to 0.2. Update Yet Another WebClap for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Extra Post Images: Stored Cross-Site ScriptingCVE-2025-13856 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Extra Post Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the extra-images shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Extra Post Images
Affected
up to 1.0
What to do
Affects up to 1.0. Update Extra Post Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Cute News Ticker: Stored Cross-Site ScriptingCVE-2025-13656 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cute News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cute News Ticker
Affected
up to 1.0
What to do
Affects up to 1.0. Update Cute News Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025WP Landing Page: Cross-Site Request ForgeryCVE-2025-13629 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the 'wplp_api_update_text' function. This makes it possible for unauthenticated attackers to update arbitrary post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Landing Page
Affected
up to 0.9.3
What to do
Affects up to 0.9.3. Update WP Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025myLCO: Reflected Cross-Site ScriptingCVE-2025-13626 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The myLCO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
myLCO
Affected
up to 0.8.1
What to do
Affects up to 0.8.1. Update myLCO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Application Passwords: Reflected Cross-Site ScriptingCVE-2025-13308 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the "No, I do not approve of this connection" button, granted they can successfully trick the victim into performing an action such as clicking on a link.
Product
Application Passwords
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update Application Passwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Live Sales Notification for Woocommerce – Woomotiv: Reflected Cross-Site ScriptingCVE-2025-13137 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woomotiv_limit' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Live Sales Notification for Woocommerce – Woomotiv
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Live Sales Notification for Woocommerce – Woomotiv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 6, 2025List Attachments Shortcode: Stored Cross-Site ScriptingCVE-2025-12717 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' parameter in the [list-attachments] shortcode in all versions up to, and including, 0.4.1a due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
List Attachments Shortcode
Affected
up to 0.4.1a
What to do
Affects up to 0.4.1a. Update List Attachments Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Canadian Nutrition Facts Label: Stored Cross-Site ScriptingCVE-2025-12715 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Canadian Nutrition Facts Label plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'percentage' field in the Nutrition Label custom post type in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Canadian Nutrition Facts Label
Affected
up to 3.0
What to do
Affects up to 3.0. Update Canadian Nutrition Facts Label to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025Widgets for Google Reviews: Stored Cross-Site ScriptingCVE-2025-12510 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site.
Product
Widgets for Google Reviews
Affected
up to 13.2.4
What to do
Affects up to 13.2.4. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Link Whisper Free: Reflected Cross-Site ScriptingCVE-2025-11263 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Link Whisper Free
Affected
up to 0.8.8
What to do
Affects up to 0.8.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025CryptX: Stored Cross-Site ScriptingCVE-2025-13739 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CryptX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `cryptx` shortcode in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CryptX
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update CryptX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Trail Manager: Stored Cross-Site ScriptingCVE-2025-13682 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Trail Manager
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Trail Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 5, 2025Thai Lottery Widget: Stored Cross-Site ScriptingCVE-2025-13678 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `thailottery` shortcode in all versions up to, and including, 2.5. This is due to insufficient input sanitization and output escaping on the user supplied `width` and `height` shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Thai Lottery Widget
Affected
up to 2.5
What to do
Affects up to 2.5. Update Thai Lottery Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Cool Tag Cloud: Stored Cross-Site ScriptingCVE-2025-13614 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' shortcode in all versions up to, and including, 2.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cool Tag Cloud
Affected
up to 2.29
What to do
Affects up to 2.29. Update Cool Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025User Generator and Importer: Cross-Site Request ForgeryCVE-2025-12879 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the "Import Using CSV File" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
Product
User Generator and Importer
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update User Generator and Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025ARK Related Posts: Cross-Site Request Forgery in version 2CVE-2025-13684 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on the ark_rp_options_page function. This makes it possible for unauthenticated attackers to modify the plugin's configuration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ARK Related Posts
What to do
Update ARK Related Posts to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors: Cross-Site Request ForgeryCVE-2025-12130 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. This makes it possible for unauthenticated attackers to delete vendor products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 5, 2025Nouri.sh Newsletter: Reflected Cross-Site ScriptingCVE-2025-13515 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Nouri.sh Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.0.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Nouri.sh Newsletter
Affected
up to 1.0.1.3
What to do
Affects up to 1.0.1.3. Update Nouri.sh Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Torod – The smart shipping and delivery portal for e-shops and retailers: Cross-Site Request ForgeryCVE-2025-12373 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the save_settings function. This makes it possible for unauthenticated attackers to modify plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Torod – The smart shipping and delivery portal for e-shops and retailers
Affected
up to 1.9
What to do
Affects up to 1.9. Update Torod – The smart shipping and delivery portal for e-shops and retailers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Weekly Planner: Stored Cross-Site ScriptingCVE-2025-12186 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Weekly Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Weekly Planner
Affected
up to 1.0
What to do
Affects up to 1.0. Update Weekly Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 5, 2025Easy Jump Links Menus: Stored Cross-Site ScriptingCVE-2025-13860 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Jump Links Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `h_tags` parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Jump Links Menus
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Easy Jump Links Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025WP-SOS-Donate Donation Sidebar: Reflected Cross-Site ScriptingCVE-2025-13625 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-SOS-Donate Donation Sidebar Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP-SOS-Donate Donation Sidebar
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update WP-SOS-Donate Donation Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Twitscription: Reflected Cross-Site ScriptingCVE-2025-13623 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Twitscription plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Twitscription
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Twitscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Jabbernotification: Reflected Cross-Site ScriptingCVE-2025-13622 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.99-RC2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Jabbernotification
Affected
up to 0.99-RC2
What to do
Affects up to 0.99-RC2. Update Jabbernotification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025dream gallery: Cross-Site Request ForgeryCVE-2025-13621 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'dreampluginsmain' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
dream gallery
Affected
up to 1.0
What to do
Affects up to 1.0. Update dream gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025CoSign Single Signon: Reflected Cross-Site ScriptingCVE-2025-13512 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CoSign Single Signon
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update CoSign Single Signon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 5, 2025Quantic Social Image Hover: Cross-Site Request ForgeryCVE-2025-13360 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Quantic Social Image Hover
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Quantic Social Image Hover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.