Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,243 results · page 85 of 185
Apr 11, 2025MultiMailer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SCAND MultiMailer scand-multi-mailer allows Reflected XSS.This issue affects MultiMailer: from n/a through <= 1.0.3.
- Product
- MultiMailer
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update MultiMailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Simple WP Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32509 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through <= 1.8.17.
- Product
- Simple WP Events
- Affected
- up to 1.8.17
- What to do
- Affects up to 1.8.17. Update Simple WP Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Bulk Product Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31599 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N-Media Bulk Product Sync sync-wc-google allows SQL Injection.This issue affects Bulk Product Sync: from n/a through <= 8.6.
- Product
- Bulk Product Sync
- Affected
- up to 8.6
- What to do
- Affects up to 8.6. Update Bulk Product Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WPSmartContracts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31565 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts allows Blind SQL Injection.This issue affects WPSmartContracts: from n/a through <= 2.0.12.
- Product
- WPSmartContracts
- Affected
- up to 2.0.12
- What to do
- Affects up to 2.0.12. Update WPSmartContracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Insert HTML Here: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31379 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in programphases Insert HTML Here insert-html-here allows Reflected XSS.This issue affects Insert HTML Here: from n/a through <= 1.0.
- Product
- Insert HTML Here
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Insert HTML Here to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Oppso Unit Converter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31378 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danbwb Oppso Unit Converter oppso-unit-converter allows Reflected XSS.This issue affects Oppso Unit Converter: from n/a through <= 1.1.1.
- Product
- Oppso Unit Converter
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Oppso Unit Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WP Food ordering and Restaurant Menu: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31040 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Exthemes WP Food ordering and Restaurant Menu wp-food allows PHP Local File Inclusion.This issue affects WP Food ordering and Restaurant Menu: from n/a through <= 2.7.
- Product
- WP Food ordering and Restaurant Menu
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update WP Food ordering and Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WP Hide Categories: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31028 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through <= 1.0.
- Product
- WP Hide Categories
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Hide Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Mobile Smart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31021 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dolby_uk Mobile Smart mobile-smart allows Reflected XSS.This issue affects Mobile Smart: from n/a through <= v1.3.16.
- Product
- Mobile Smart
- Affected
- up to 1.3.16
- What to do
- Affects up to 1.3.16. Update Mobile Smart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025WordPress SMTP Service, Email Delivery Solved! — MailHawk: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31015 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk mailhawk allows PHP Local File Inclusion.This issue affects WordPress SMTP Service, Email Delivery Solved! — MailHawk: from n/a through <= 1.3.1.
- Product
- WordPress SMTP Service, Email Delivery Solved! — MailHawk
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WordPress SMTP Service, Email Delivery Solved! — MailHawk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Material Dashboard: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-31014 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
- Product
- Material Dashboard
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Linet ERP-Woocommerce Integration: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-31411 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Path Traversal.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.12.
- Product
- Linet ERP-Woocommerce Integration
- Affected
- up to 3.5.12
- What to do
- Affects up to 3.5.12. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Vice Versa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27350 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Vice Versa vice-versa allows Reflected XSS.This issue affects Vice Versa: from n/a through <= 2.2.3.
- Product
- Vice Versa
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Vice Versa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025JetCompareWishlist: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22279 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetCompareWishlist jet-compare-wishlist allows PHP Local File Inclusion.This issue affects JetCompareWishlist: from n/a through <= 1.5.9.
- Product
- JetCompareWishlist
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update JetCompareWishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Review Stars Count For WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32687 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magnigenie Review Stars Count For WooCommerce review-stars-count-for-woocommerce allows SQL Injection.This issue affects Review Stars Count For WooCommerce: from n/a through <= 2.0.
- Product
- Review Stars Count For WooCommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Review Stars Count For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Real Estate Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32668 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows PHP Local File Inclusion.This issue affects Real Estate Manager: from n/a through <= 7.3.
- Product
- Real Estate Manager
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Tutor LMS: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-32230 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through <= 3.4.0.
- Product
- Tutor LMS
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Hive Support: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32214 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hive Support Hive Support hive-support allows Stored XSS.This issue affects Hive Support: from n/a through <= 1.2.11.
- Product
- Hive Support
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32209 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.5.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.5
- What to do
- Affects up to 7.1.5. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Piotnet Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32205 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Piotnet Forms: from n/a through <= 1.0.30.
- Product
- Piotnet Forms
- Affected
- up to 1.0.30
- What to do
- Affects up to 1.0.30. Update Piotnet Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Contact Form Builder by vcita: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32199 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyale-vc Contact Form Builder by vcita contact-form-with-a-meeting-scheduler-by-vcita allows DOM-Based XSS.This issue affects Contact Form Builder by vcita: from n/a through <= 4.10.2.
- Product
- Contact Form Builder by vcita
- Affected
- up to 4.10.2
- What to do
- Affects up to 4.10.2. Update Contact Form Builder by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Brizy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32198 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefusecom Brizy brizy.This issue affects Brizy: from n/a through <= 2.7.7.
- Product
- Brizy
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update Brizy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025EventON: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32160 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite.This issue affects EventON: from n/a through <= 2.4.1.
- Product
- EventON
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025aThemes Addons for Elementor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32158 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.3.
- Product
- aThemes Addons for Elementor
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025FooBox Image Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32139 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooBox Image Lightbox foobox-image-lightbox.This issue affects FooBox Image Lightbox : from n/a through <= 2.7.33.
- Product
- FooBox Image Lightbox
- Affected
- up to 2.7.33
- What to do
- Affects up to 2.7.33. Update FooBox Image Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Nearby Locations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32128 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through <= 1.1.1.
- Product
- Nearby Locations
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Nearby Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025CardGate Payments for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32119 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CardGate CardGate Payments for WooCommerce cardgate allows Blind SQL Injection.This issue affects CardGate Payments for WooCommerce: from n/a through <= 3.2.1.
- Product
- CardGate Payments for WooCommerce
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update CardGate Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025QR Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32116 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studi7 QR Master qr-master allows Reflected XSS.This issue affects QR Master: from n/a through <= 1.0.5.
- Product
- QR Master
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update QR Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Popping Content Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32115 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light popping-content-light allows Reflected XSS.This issue affects Popping Content Light: from n/a through <= 2.4.
- Product
- Popping Content Light
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Popping Content Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025WordPress 5sterrenspecialist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32114 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5sterrenspecialist WordPress 5sterrenspecialist Plugin 5-sterrenspecialist allows Reflected XSS.This issue affects WordPress 5sterrenspecialist Plugin: from n/a through <= 1.4.
- Product
- WordPress 5sterrenspecialist
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WordPress 5sterrenspecialist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025DyaPress ERP/CRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-30582 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclusion.This issue affects DyaPress ERP/CRM: from n/a through <= 18.0.2.0.
- Product
- DyaPress ERP/CRM
- Affected
- up to 18.0.2.0
- What to do
- Affects up to 18.0.2.0. Update DyaPress ERP/CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WP Subscription Forms: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32692 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows PHP Local File Inclusion.This issue affects WP Subscription Forms: from n/a through <= 1.2.4.
- Product
- WP Subscription Forms
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update WP Subscription Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025PowerPress Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32690 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blubrry PowerPress Podcasting powerpress allows DOM-Based XSS.This issue affects PowerPress Podcasting: from n/a through <= 11.12.5.
- Product
- PowerPress Podcasting
- Affected
- up to 11.12.5
- What to do
- Affects up to 11.12.5. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WP Inquiries: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32685 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aristo Rinjuang WP Inquiries wp-inquiries allows SQL Injection.This issue affects WP Inquiries: from n/a through <= 0.2.1.
- Product
- WP Inquiries
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update WP Inquiries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32683 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.6.6.
- Product
- MapSVG
- Affected
- up to 8.6.6
- What to do
- Affects up to 8.6.6. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Review Stream: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32680 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Grade Us, Inc. Review Stream review-stream allows Stored XSS.This issue affects Review Stream: from n/a through <= 1.6.7.
- Product
- Review Stream
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Review Stream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WP Social Stream Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32677 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solwininfotech WP Social Stream Designer social-stream-design allows Blind SQL Injection.This issue affects WP Social Stream Designer: from n/a through <= 1.3.
- Product
- WP Social Stream Designer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update WP Social Stream Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Verowa Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32676 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows Blind SQL Injection.This issue affects Verowa Connect: from n/a through <= 3.0.5.
- Product
- Verowa Connect
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Verowa Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Ally: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32640 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Ally pojo-accessibility allows Stored XSS.This issue affects Ally: from n/a through <= 3.1.0.
- Product
- Ally
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Ally to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WordPress Spam Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32581 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ankit Singla WordPress Spam Blocker cf7-manual-spam-blocker allows Stored XSS.This issue affects WordPress Spam Blocker: from n/a through <= 2.0.5.
- Product
- WordPress Spam Blocker
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update WordPress Spam Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025DeBounce Email Validator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32580 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Stored XSS.This issue affects DeBounce Email Validator: from n/a through <= 5.7.1.
- Product
- DeBounce Email Validator
- Affected
- up to 5.7.1
- What to do
- Affects up to 5.7.1. Update DeBounce Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025ChillPay WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32570 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ChillPay ChillPay WooCommerce chillpay-payment-gateway allows Stored XSS.This issue affects ChillPay WooCommerce: from n/a through <= 2.5.3.
- Product
- ChillPay WooCommerce
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update ChillPay WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Simple Post Meta Manager: Cross-Site Request Forgery (CSRF)CVE-2025-32556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through <= 1.0.9.
- Product
- Simple Post Meta Manager
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Simple Post Meta Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Click & Pledge Connect: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32550 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect Plugin allows SQL Injection. This issue affects Click & Pledge Connect Plugin: from 2.24080000 through WP6.6.1.
- Product
- Click & Pledge Connect
- What to do
- Update Click & Pledge Connect to the newest version.
Apr 9, 2025Canonical Attachments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32543 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hivedigital Canonical Attachments canonical-attachments allows Reflected XSS.This issue affects Canonical Attachments: from n/a through <= 1.8.
- Product
- Canonical Attachments
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Canonical Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Link Shield: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32503 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Conti Link Shield link-shield allows Stored XSS.This issue affects Link Shield: from n/a through <= 0.5.4.
- Product
- Link Shield
- Affected
- up to 0.5.4
- What to do
- Affects up to 0.5.4. Update Link Shield to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Logo Showcase Ultimate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32499 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Logo Showcase Ultimate logo-showcase-ultimate allows PHP Local File Inclusion.This issue affects Logo Showcase Ultimate: from n/a through <= 1.4.4.
- Product
- Logo Showcase Ultimate
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Logo Showcase Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Ultra Demo Importer: Cross-Site Request Forgery (CSRF)CVE-2025-32496 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web Shell to a Web Server.This issue affects Ultra Demo Importer: from n/a through <= 1.0.5.
- Product
- Ultra Demo Importer
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Ultra Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Waymark: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32495 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark waymark allows Stored XSS.This issue affects Waymark: from n/a through <= 1.5.3.
- Product
- Waymark
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Waymark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025BP Social Connect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32493 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes BP Social Connect bp-social-connect allows Stored XSS.This issue affects BP Social Connect: from n/a through <= 1.6.2.
- Product
- BP Social Connect
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update BP Social Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.