Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

797 results · page 9 of 16

Jun 6, 2025AppBanners: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30625 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Pramschufer AppBanners appbanners allows Stored XSS.This issue affects AppBanners: from n/a through <= 1.5.14.
Product
AppBanners
Affected
up to 1.5.14
What to do
Affects up to 1.5.14. Update AppBanners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized modification of dataCVE-2025-4683 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.17.5
What to do
Affects up to 4.17.5. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 23, 2025WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31056 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce WhatsCart-for-WooCommerce allows SQL Injection.This issue affects WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce: from n/a through <= 1.1.0.
Product
WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025WhatsApp Click to Chat Plugin for: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39411 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: from n/a through <= 2.2.12.
Product
WhatsApp Click to Chat Plugin for
Affected
up to 2.2.12
What to do
Affects up to 2.2.12. Update WhatsApp Click to Chat Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2025Sitewide Discount for WooCommerce: Apply Discount to All Products: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48248 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Sitewide Discount for WooCommerce: Apply Discount to All Products global-shop-discount-for-woocommerce allows Stored XSS.This issue affects Sitewide Discount for WooCommerce: Apply Discount to All Products: from n/a through <= 2.2.1.
Product
Sitewide Discount for WooCommerce: Apply Discount to All Products
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Sitewide Discount for WooCommerce: Apply Discount to All Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025Push notification for Mobile and Web app: Missing AuthorizationCVE-2025-48127 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through <= 2.0.3.
Product
Push notification for Mobile and Web app
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Push notification for Mobile and Web app to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025QuickCal - Appointment Booking Calendar for: Cross-Site Request Forgery (CSRF)CVE-2025-32310 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.
Product
QuickCal - Appointment Booking Calendar for
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update QuickCal - Appointment Booking Calendar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 16, 2025QuickCal - Appointment Booking Calendar for: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32299 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.
Product
QuickCal - Appointment Booking Calendar for
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update QuickCal - Appointment Booking Calendar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2025Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses: Does not sanitise and escape some of its settingsCVE-2024-9882 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses
Fixed in
1.9.4
What to do
Update Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses to 1.9.4 or newer.
Full record and what to do →NVD record wpscan.com
May 15, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2024-8620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.93 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
MapPress Maps for
Fixed in
2.93
What to do
Update MapPress Maps for to 2.93 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025ApplyOnline: Does not protect uploaded files during the application processCVE-2024-10098 · WordPress plugins & themes · reported by WPScanLow 2.7
The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain
Product
ApplyOnline
Fixed in
2.6.3
What to do
Update ApplyOnline to 2.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2025Happyforms: Does not sanitise and escape some of its settingsCVE-2024-10054 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Happyforms
Fixed in
1.26.3
What to do
Update Happyforms to 1.26.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2025LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2025-3769 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.1.92
What to do
Affects up to 5.1.92. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Limited privilege escalationCVE-2025-3438 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticated attackers to to register with the 'wcfm_vendor' role, which is a Store Vendor role in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. The vulnerability can only be exploited if the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin is installed and activated. The vulnerability was partially patched in version 4.17.3.
Product
MStore API – Create Native Android & iOS Apps On The Cloud
Affected
up to 4.17.4
What to do
Affects up to 4.17.4. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 24, 2025Appsero Helper: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39377 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection.This issue affects Appsero Helper: from n/a through <= 1.3.4.
Product
Appsero Helper
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Appsero Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 22, 2025Appointment Booking Calendar: Missing AuthorizationCVE-2025-46247 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
Product
Appointment Booking Calendar
Affected
up to 1.3.92
What to do
Affects up to 1.3.92. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 22, 2025Appointment Booking Calendar: Cross-Site Request Forgery (CSRF)CVE-2025-46241 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.
Product
Appointment Booking Calendar
Affected
up to 1.3.92
What to do
Affects up to 1.3.92. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 18, 2025MapPress Maps for: Does not sanitise and escape some of its settingsCVE-2025-2162 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
MapPress Maps for
Fixed in
2.94.10
What to do
Update MapPress Maps for to 2.94.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2025Mobile App for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through <= 0.4.61.
Product
Mobile App for WooCommerce
Affected
up to 0.4.61
What to do
Affects up to 0.4.61. Update Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025Web2application: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32590 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tzin111 Web2application web2application allows Reflected XSS.This issue affects Web2application: from n/a through <= 6.1.
Product
Web2application
Affected
up to 6.1
What to do
Affects up to 6.1. Update Web2application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 17, 2025flickr-slideshow-wrapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27309 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeannot Muller flickr-slideshow-wrapper flickr-slideshow-wrapper allows Stored XSS.This issue affects flickr-slideshow-wrapper: from n/a through <= 5.4.6.
Product
flickr-slideshow-wrapper
Affected
up to 5.4.6
What to do
Affects up to 5.4.6. Update flickr-slideshow-wrapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Build App Online: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32577 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.
Product
Build App Online
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025Apptivo Business Site CRM: Missing AuthorizationCVE-2025-31909 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Apptivo Apptivo Business Site CRM apptivo-business-site allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apptivo Business Site CRM: from n/a through <= 5.3.
Product
Apptivo Business Site CRM
Affected
up to 5.3
What to do
Affects up to 5.3. Update Apptivo Business Site CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 3, 2025MapPress Maps for: Does not sanitise and escape some parametersCVE-2025-2055 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
MapPress Maps for
Fixed in
2.94.9
What to do
Update MapPress Maps for to 2.94.9 or newer.
Full record and what to do →NVD record wpscan.com
Apr 2, 2025Shopper Approved Reviews: Unauthorized modification of data that can lead to privilege escalationCVE-2025-3063 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Shopper Approved Reviews
Affected
2.0 to 2.1
What to do
Affects 2.0 to 2.1. Update Shopper Approved Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2025Easy!Appointments: Cross-Site Request Forgery (CSRF)CVE-2025-31828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through <= 1.4.2.
Product
Easy!Appointments
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Easy!Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Mobile App Canvas: Missing AuthorizationCVE-2025-31816 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in pietro Mobile App Canvas mobile-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile App Canvas: from n/a through <= 3.8.2.
Product
Mobile App Canvas
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update Mobile App Canvas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2025Append Content: Missing AuthorizationCVE-2025-31780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Andy Stratton Append Content append-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Append Content: from n/a through <= 2.1.1.
Product
Append Content
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Append Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025PostmarkApp Email Integrator: Cross-Site Request Forgery (CSRF)CVE-2025-31617 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
Product
PostmarkApp Email Integrator
Affected
up to 2.4
What to do
Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Appointy Appointment Scheduler: Cross-Site Request Forgery (CSRF)CVE-2025-31601 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in appointy Appointy Appointment Scheduler appointy-appointment-scheduler allows Cross Site Request Forgery.This issue affects Appointy Appointment Scheduler: from n/a through <= 4.2.1.
Product
Appointy Appointment Scheduler
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Appointy Appointment Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Appointify: Unrestricted Upload of File with Dangerous TypeCVE-2025-31577 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Unrestricted Upload of File with Dangerous Type vulnerability in appointify Appointify appointify allows Upload a Web Shell to a Web Server.This issue affects Appointify: from n/a through <= 1.0.8.
Product
Appointify
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025PostmarkApp Email Integrator: Missing AuthorizationCVE-2025-31576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
Product
PostmarkApp Email Integrator
Affected
up to 2.4
What to do
Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2025Custom Database Applications by Caspio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caspio Bridge Custom Database Applications by Caspio custom-database-applications-by-caspio allows DOM-Based XSS.This issue affects Custom Database Applications by Caspio: from n/a through <= 2.1.
Product
Custom Database Applications by Caspio
Affected
up to 2.1
What to do
Affects up to 2.1. Update Custom Database Applications by Caspio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 28, 2025Booking for Appointments and Events Calendar – Amelia: Full Path DisclosureCVE-2025-2578 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.19 via the 'wpAmeliaApiCall' function. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Booking for Appointments and Events Calendar – Amelia
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 27, 2025Easy Booked – Appointment Booking and Scheduling Management System for: Cross-Site Request Forgery (CSRF)CVE-2025-22634 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MD Abu Jubayer Hossain Easy Booked – Appointment Booking and Scheduling Management System for WordPress easy-booked allows Cross Site Request Forgery.This issue affects Easy Booked – Appointment Booking and Scheduling Management System for WordPress: from n/a through <= 2.4.5.
Product
Easy Booked – Appointment Booking and Scheduling Management System for
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Easy Booked – Appointment Booking and Scheduling Management System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Listings for Appfolio: Cross-Site Request Forgery (CSRF)CVE-2025-22658 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Listings for Appfolio Listings for Appfolio listings-for-appfolio allows Stored XSS.This issue affects Listings for Appfolio: from n/a through <= 1.2.0.
Product
Listings for Appfolio
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Listings for Appfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Comment Approved Notifier Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30792 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ufukart Comment Approved Notifier Extended comment-approved-notifier-extended allows Stored XSS.This issue affects Comment Approved Notifier Extended: from n/a through <= 5.2.
Product
Comment Approved Notifier Extended
Affected
up to 5.2
What to do
Affects up to 5.2. Update Comment Approved Notifier Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 27, 2025Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30766 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows DOM-Based XSS.This issue affects Happy Addons for Elementor: from n/a through <= 3.16.2.
Product
Happy Addons for Elementor
Affected
up to 3.16.2
What to do
Affects up to 3.16.2. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 26, 2025AppReview: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23714 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in podspod AppReview appreview allows Reflected XSS.This issue affects AppReview: from n/a through <= 0.2.9.
Product
AppReview
Affected
up to 0.2.9
What to do
Affects up to 0.2.9. Update AppReview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025AppExperts: Insertion of Sensitive Information Into Sent DataCVE-2025-30609 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.3.
Product
AppExperts
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update AppExperts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2025Appointment Booking Calendar — Simply Schedule Appointments Booking: Arbitrary shortcode executionCVE-2025-1119 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.6.8.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.8.5
What to do
Affects up to 1.6.8.5. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.lucianohanna.com.br plugins.trac.wordpress.org
Mar 13, 2025AppPresser – Mobile App Framework: Stored Cross-Site ScriptingCVE-2025-1561 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when logging is enabled that will execute whenever a user accesses an injected page.
Product
AppPresser – Mobile App Framework
Affected
up to 4.4.10
What to do
Affects up to 4.4.10. Update AppPresser – Mobile App Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2025Appsero Helper: Cross-Site Request ForgeryCVE-2024-13436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Appsero Helper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'appsero_helper' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Appsero Helper
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Appsero Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2025Appointment Booking Calendar — Simply Schedule Appointments Booking: Reflected Cross-Site ScriptingCVE-2024-13431 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accent_color and background parameter in all versions up to, and including, 1.6.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.8.3
What to do
Affects up to 1.6.8.3. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.lucianohanna.com.br plugins.trac.wordpress.org
Mar 3, 2025Doctor Appointment Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-27264 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows PHP Local File Inclusion.This issue affects Doctor Appointment Booking: from n/a through <= 1.0.0.
Product
Doctor Appointment Booking
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Doctor Appointment Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Doctor Appointment Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-27263 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows SQL Injection.This issue affects Doctor Appointment Booking: from n/a through <= 1.0.0.
Product
Doctor Appointment Booking
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Doctor Appointment Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Appointment Buddy Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25099 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accreteinfosolution Appointment Buddy Widget appointment-buddy-online-appointment-booking-by-accrete allows Cross-Site Scripting (XSS).This issue affects Appointment Buddy Widget: from n/a through <= 1.2.
Product
Appointment Buddy Widget
Affected
up to 1.2
What to do
Affects up to 1.2. Update Appointment Buddy Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Swift Calendar Online Appointment Scheduling: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SwiftCloud Swift Calendar Online Appointment Scheduling online-appointment-scheduling-software allows Reflected XSS.This issue affects Swift Calendar Online Appointment Scheduling: from n/a through <= 1.3.3.
Product
Swift Calendar Online Appointment Scheduling
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Swift Calendar Online Appointment Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025GoogleMapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23518 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrsaucier GoogleMapper googlemapper-2 allows Reflected XSS.This issue affects GoogleMapper: from n/a through <= 2.0.3.
Product
GoogleMapper
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update GoogleMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 27, 2025The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerablCVE-2025-1450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-hover’ parameter in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.