Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,207 results · page 8 of 25
Sep 3, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-58599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.
- Product
- Order Delivery Date for WooCommerce
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2025Intl DateTime Calendar: Stored Cross-Site ScriptingCVE-2025-8293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Intl DateTime Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Intl DateTime Calendar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Intl DateTime Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Aug 14, 2025Structured Content (JSON-LD) #wpsc: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-3414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Structured Content (JSON-LD) #wpsc
- Fixed in
- 1.7.0
- What to do
- Update Structured Content (JSON-LD) #wpsc to 1.7.0 or newer.
Aug 8, 2025OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-6572 · WordPress plugins & themes · reported by WPScanMedium 5.9
The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 15, 2025Companion Auto Update: Stored Cross-Site ScriptingCVE-2025-4369 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘update_delay_days’ parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Companion Auto Update
- Affected
- up to 3.9.2
- What to do
- Affects up to 3.9.2. Update Companion Auto Update to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2025GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-6200 · WordPress plugins & themes · reported by WPScanMedium 5.9
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GeoDirectory
- Fixed in
- 2.8.120
- What to do
- Update GeoDirectory to 2.8.120 or newer.
Jul 11, 2025Order Delivery Date: Discloses arbitrary post title (suchCVE-2025-2942 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such information
- Product
- Order Delivery Date
- Fixed in
- 12.6.0
- What to do
- Update Order Delivery Date to 12.6.0 or newer.
Jun 27, 2025WP Map Block: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-5194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Map Block
- Fixed in
- 2.0.3
- What to do
- Update WP Map Block to 2.0.3 or newer.
Jun 10, 2025Axle Demo Importer: Does not validate files to be uploadedCVE-2025-4954 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Axle Demo Importer WordPress plugin through 1.0.3 does not validate files to be uploaded, which could allow authenticated users (author and above) to upload arbitrary files such as PHP on the server
- Product
- Axle Demo Importer
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Axle Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Newsletter: Does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embedCVE-2025-3581 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Newsletter
- Fixed in
- 8.8.5
- What to do
- Update Newsletter to 8.8.5 or newer.
Jun 3, 2025Post Slider and Post Carousel with Post Vertical Scrolling Widget: Does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embedCVE-2025-4567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Post Slider and Post Carousel with Post Vertical Scrolling Widget
- Fixed in
- 3.2.10
- What to do
- Update Post Slider and Post Carousel with Post Vertical Scrolling Widget to 3.2.10 or newer.
May 20, 2025Order Delivery Date: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-2929 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Order Delivery Date WordPress plugin before 12.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Order Delivery Date
- Fixed in
- 12.4.0
- What to do
- Update Order Delivery Date to 12.4.0 or newer.
May 19, 2025Qi Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-1627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 19, 2025Qi Blocks: Does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embedCVE-2025-1626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 19, 2025Qi Blocks: Does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embedCVE-2025-1625 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qi Blocks
- Fixed in
- 1.4
- What to do
- Update Qi Blocks to 1.4 or newer.
May 17, 2025CSV Mass Importer: Does not properly validate uploaded filesCVE-2025-4190 · WordPress plugins & themes · reported by WPScanHigh 7.2
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- CSV Mass Importer
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update CSV Mass Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025ValidateCertify: Cross-Site Request Forgery (CSRF)CVE-2025-48115 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.4.
- Product
- ValidateCertify
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update ValidateCertify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Simple Lightbox: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3516 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Simple Lightbox
- Fixed in
- 2.9.4
- What to do
- Update Simple Lightbox to 2.9.4 or newer.
May 15, 2025Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-9645 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry
- Fixed in
- 2.2.93
- What to do
- Update Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry to 2.2.93 or newer.
May 15, 2025Z-Downloads: Does not properly validate files uploadedCVE-2024-8699 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- Z-Downloads
- Fixed in
- 1.11.5
- What to do
- Update Z-Downloads to 1.11.5 or newer.
May 15, 2025Z-Downloads: Does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScriptCVE-2024-8673 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.
- Product
- Z-Downloads
- Fixed in
- 1.11.7
- What to do
- Update Z-Downloads to 1.11.7 or newer.
May 15, 2025PVN Auth Popup: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- PVN Auth Popup
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update PVN Auth Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025If-So Dynamic Content Personalization: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5440 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- If-So Dynamic Content Personalization
- Fixed in
- 1.8.0.3
- What to do
- Update If-So Dynamic Content Personalization to 1.8.0.3 or newer.
May 15, 2025EventPrime: Does not properly validate permissionsCVE-2024-4665 · WordPress plugins & themes · reported by WPScanMedium 6.4
The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.
- Product
- EventPrime
- Fixed in
- 3.5.0
- What to do
- Update EventPrime to 3.5.0 or newer.
May 15, 2025Twitter Bootstrap Collapse aka Accordian Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-12722 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Twitter Bootstrap Collapse aka Accordian Shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Twitter Bootstrap Collapse aka Accordian Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Planning Center Online Giving: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11502 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Planning Center Online Giving
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Planning Center Online Giving to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025JSFiddle Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10818 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- JSFiddle Shortcode
- Fixed in
- 1.1.3
- What to do
- Update JSFiddle Shortcode to 1.1.3 or newer.
May 15, 2025Countdown Timer for WordPress Block Editor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-10631 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Countdown Timer for WordPress Block Editor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Countdown Timer for WordPress Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP Dashboard Notes: Does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX actionCVE-2023-7239 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.
- Product
- WP Dashboard Notes
- Fixed in
- 1.0.11
- What to do
- Update WP Dashboard Notes to 1.0.11 or newer.
May 15, 2025Payment Gateway for Telcell: Does not validate the api_url parameter before redirecting the user to its valueCVE-2023-6786 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue
- Product
- Payment Gateway for Telcell
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Payment Gateway for Telcell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Responsive Lightbox & Gallery: Does not validate and escape some of its attributes before outputting them back in a page/postCVE-2025-3742 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.5.1
- What to do
- Update Responsive Lightbox & Gallery to 2.5.1 or newer.
Apr 26, 2025Order Delivery Date: Does not have authorization and CSRF checksCVE-2025-2907 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
- Product
- Order Delivery Date
- Fixed in
- 12.3.1
- What to do
- Update Order Delivery Date to 12.3.1 or newer.
Apr 24, 2025COVID-19 (Coronavirus) Update Your Customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46523 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devignstudiosltd COVID-19 (Coronavirus) Update Your Customers covid-19-alert allows Stored XSS.This issue affects COVID-19 (Coronavirus) Update Your Customers: from n/a through <= 1.5.1.
- Product
- COVID-19 (Coronavirus) Update Your Customers
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update COVID-19 (Coronavirus) Update Your Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Nepali Post Date: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Padam Shankhadev Nepali Post Date nepali-post-date allows Stored XSS.This issue affects Nepali Post Date: from n/a through <= 5.1.1.
- Product
- Nepali Post Date
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update Nepali Post Date to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticCVE-2025-2558 · WordPress plugins & themes · reported by WPScanHigh 8.6
The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025User Registration & Membership: Does not properly validate data in an AJAX actionCVE-2025-2594 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.
- Product
- User Registration & Membership
- Fixed in
- 4.1.3
- What to do
- Update User Registration & Membership to 4.1.3 or newer.
Apr 17, 2025WP Editor: Arbitrary file updateCVE-2025-3294 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
- Product
- WP Editor
- Affected
- up to 1.2.9.1
- What to do
- Affects up to 1.2.9.1. Update WP Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 15, 2025Nepali Date Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26950 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali Date Converter nepali-date-converter allows Stored XSS.This issue affects Nepali Date Converter: from n/a through <= 2.0.8.
- Product
- Nepali Date Converter
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Nepali Date Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Email Notifications for Updates: Missing AuthorizationCVE-2025-26741 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates wp-update-mail-notification allows Privilege Escalation.This issue affects Email Notifications for Updates: from n/a through <= 1.1.6.
- Product
- Email Notifications for Updates
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Lock Your Updates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32537 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Lock Your Updates lock-your-updates allows Reflected XSS.This issue affects Lock Your Updates: from n/a through <= 1.1.
- Product
- Lock Your Updates
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Lock Your Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Nepali Date Utilities: Cross-Site Request Forgery (CSRF)CVE-2025-32664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in ashokbasnet Nepali Date Utilities nepali-date-utilities allows Stored XSS.This issue affects Nepali Date Utilities: from n/a through <= 1.0.15.
- Product
- Nepali Date Utilities
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update Nepali Date Utilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Email Notifications for Updates: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26741 is likely a duplicate of this issue.
- Product
- Email Notifications for Updates
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2025Maps: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-2279 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Maps
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Latest Custom Post Type Updates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Wood Latest Custom Post Type Updates latest-custom-post-type-updates allows Reflected XSS.This issue affects Latest Custom Post Type Updates: from n/a through <= 1.3.0.
- Product
- Latest Custom Post Type Updates
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Latest Custom Post Type Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Lana Downloads Manager: Does not validate user input used in a pathCVE-2025-2048 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
- Product
- Lana Downloads Manager
- Fixed in
- 1.10.0
- What to do
- Update Lana Downloads Manager to 1.10.0 or newer.
Mar 31, 2025WP Date and Time Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31590 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denra.com WP Date and Time Shortcode wp-date-and-time-shortcode allows Stored XSS.This issue affects WP Date and Time Shortcode: from n/a through <= 2.6.7.
- Product
- WP Date and Time Shortcode
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update WP Date and Time Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025ValidateCertify: Cross-Site Request Forgery (CSRF)CVE-2025-30811 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.1.
- Product
- ValidateCertify
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update ValidateCertify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2025aoa-downloadable: Doesn't validate a parameter in its download functionCVE-2024-13617 · WordPress plugins & themes · reported by WPScanHigh 8.6
The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server
- Product
- aoa-downloadable
- Affected
- up to 0.1.0
- What to do
- Affects up to 0.1.0. Update aoa-downloadable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Plugins Last Updated Column: Cross-Site Request Forgery (CSRF)CVE-2025-28887 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This issue affects Plugins Last Updated Column: from n/a through <= 0.1.3.
- Product
- Plugins Last Updated Column
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Plugins Last Updated Column to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Comment Date and Gravatar remover: Cross-Site Request Forgery (CSRF)CVE-2025-28862 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request Forgery.This issue affects Comment Date and Gravatar remover: from n/a through <= 1.0.
- Product
- Comment Date and Gravatar remover
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Comment Date and Gravatar remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.