Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,156 results · page 108 of 204
Apr 10, 2025Survey Maker: Authentication Bypass by SpoofingCVE-2025-32275 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through <= 5.1.6.3.
- Product
- Survey Maker
- Affected
- up to 5.1.6.3
- What to do
- Affects up to 5.1.6.3. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025DethemeKit For Elementor: Missing AuthorizationCVE-2025-32260 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.
- Product
- DethemeKit For Elementor
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025WP ULike: Missing AuthorizationCVE-2025-32259 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alimir WP ULike wp-ulike.This issue affects WP ULike: from n/a through <= 4.7.9.1.
- Product
- WP ULike
- Affected
- up to 4.7.9.1
- What to do
- Affects up to 4.7.9.1. Update WP ULike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025SEO Help: Missing AuthorizationCVE-2025-32244 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in QuantumCloud SEO Help seo-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Help: from n/a through <= 6.7.9.
- Product
- SEO Help
- Affected
- up to 6.7.9
- What to do
- Affects up to 6.7.9. Update SEO Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Internal Link Optimiser: Missing AuthorizationCVE-2025-32243 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Link Optimiser: from n/a through <= 5.1.2.
- Product
- Internal Link Optimiser
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update Internal Link Optimiser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Hive Support: Missing AuthorizationCVE-2025-32242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hive Support: from n/a through <= 1.2.5.
- Product
- Hive Support
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Site Notify: Missing AuthorizationCVE-2025-32240 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wpvsingh Site Notify site-notify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Notify: from n/a through <= 1.0.
- Product
- Site Notify
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Site Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: Missing AuthorizationCVE-2025-32236 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic vagonic-sortable.This issue affects Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: from n/a through <= 1.9.
- Product
- Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Ai Image Alt Text Generator for WP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32228 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.9.
- Product
- Ai Image Alt Text Generator for WP
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Asgaros Forum: Authentication Bypass by SpoofingCVE-2025-32227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authentication Bypass by Spoofing vulnerability in Asgaros Asgaros Forum asgaros-forum allows Identity Spoofing.This issue affects Asgaros Forum: from n/a through <= 3.0.0.
- Product
- Asgaros Forum
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Asgaros Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025EazyDocs: Missing AuthorizationCVE-2025-32221 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through <= 2.7.1.
- Product
- EazyDocs
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update EazyDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Spider Elements: Missing AuthorizationCVE-2025-32216 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Spider Themes Spider Elements spider-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spider Elements: from n/a through <= 1.6.6.
- Product
- Spider Elements
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Spider Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Flo Forms: Missing AuthorizationCVE-2025-32213 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.43.
- Product
- Flo Forms
- Affected
- up to 1.0.43
- What to do
- Affects up to 1.0.43. Update Flo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Specia Companion: Missing AuthorizationCVE-2025-32212 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Specia Theme Specia Companion specia-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Specia Companion: from n/a through <= 6.3.
- Product
- Specia Companion
- Affected
- up to 6.3
- What to do
- Affects up to 6.3. Update Specia Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025CM Registration and Invitation Codes: Missing AuthorizationCVE-2025-32210 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CreativeMindsSolutions CM Registration and Invitation Codes cm-invitation-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Registration and Invitation Codes: from n/a through <= 2.5.6.
- Product
- CM Registration and Invitation Codes
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update CM Registration and Invitation Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Hive Support: Missing AuthorizationCVE-2025-32208 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hive Support: from n/a through <= 1.2.5.
- Product
- Hive Support
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Embedder: Unauthorized modification of data that can lead to privilege escalationCVE-2025-3417 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Embedder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_set_global_option() function in versions 1.3 to 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Embedder
- Affected
- 1.3 to 1.3.5
- What to do
- Affects 1.3 to 1.3.5. Update Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 10, 2025SureTriggers: All-in-One Automation Platform: An authentication bypass leading to administrative account creationCVE-2025-3102 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all versions up to, and including, 1.0.78. This makes it possible for unauthenticated attackers to create administrator accounts on the target website when the plugin is installed and activated but not configured with an API key.
- Product
- SureTriggers: All-in-One Automation Platform
- Affected
- up to 1.0.78
- What to do
- Affects up to 1.0.78. Update SureTriggers: All-in-One Automation Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2025Brizy Pro: Missing AuthorizationCVE-2025-26901 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brizy Brizy Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy Pro: from n/a through 2.6.1.
- Product
- Brizy Pro
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update Brizy Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WooCommerce Multilingual & Multicurrency: Missing AuthorizationCVE-2025-26888 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through <= 5.3.8.
- Product
- WooCommerce Multilingual & Multicurrency
- Affected
- up to 5.3.8
- What to do
- Affects up to 5.3.8. Update WooCommerce Multilingual & Multicurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025MapSVG: Missing AuthorizationCVE-2025-32684 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through <= 8.6.4.
- Product
- MapSVG
- Affected
- up to 8.6.4
- What to do
- Affects up to 8.6.4. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Czater.pl – live chat i telefon: Missing AuthorizationCVE-2025-32624 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in czater Czater.pl – live chat i telefon czater allows Cross Site Request Forgery.This issue affects Czater.pl – live chat i telefon: from n/a through <= 1.0.5.
- Product
- Czater.pl – live chat i telefon
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Czater.pl – live chat i telefon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Woo Product Feed For Marketing Channels: Missing AuthorizationCVE-2025-31377 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Product Feed For Marketing Channels: from n/a through <= 1.9.0.
- Product
- Woo Product Feed For Marketing Channels
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Woo Product Feed For Marketing Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Sandwich Adsense: Missing AuthorizationCVE-2025-31042 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in rtakao Sandwich Adsense firsth3tagadsense allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sandwich Adsense: from n/a through <= 4.0.2.
- Product
- Sandwich Adsense
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Sandwich Adsense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Age Gate: Missing AuthorizationCVE-2025-31012 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Phil Age Gate age-gate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Age Gate: from n/a through <= 3.5.4.
- Product
- Age Gate
- Affected
- up to 3.5.4
- What to do
- Affects up to 3.5.4. Update Age Gate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Rich Table of Contents: Missing AuthorizationCVE-2025-31004 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Croover.inc Rich Table of Contents rich-table-of-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rich Table of Contents: from n/a through <= 1.4.0.
- Product
- Rich Table of Contents
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Rich Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Squeeze: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31003 · WordPress plugins & themes · reported by PatchstackLow 2.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitive Data.This issue affects Squeeze: from n/a through <= 1.6.
- Product
- Squeeze
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025Live Forms: Missing AuthorizationCVE-2025-32279 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <= 4.8.5.
- Product
- Live Forms
- Affected
- up to 4.8.5
- What to do
- Affects up to 4.8.5. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025m1.DownloadList: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32164 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows Retrieve Embedded Sensitive Data.This issue affects m1.DownloadList: from n/a through <= 0.24.
- Product
- m1.DownloadList
- Affected
- up to 0.24
- What to do
- Affects up to 0.24. Update m1.DownloadList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025MelaPress Login Security and MelaPress Login Security Premium: Unauthorized loss of dataCVE-2025-2876 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MelaPress Login Security and MelaPress Login Security Premium plugins for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'monitor_admin_actions' function in version 2.1.0. This makes it possible for unauthenticated attackers to delete any user.
- Product
- MelaPress Login Security and MelaPress Login Security Premium
- What to do
- Update MelaPress Login Security and MelaPress Login Security Premium to the newest version.
Full record and what to do →NVD recordmelapress.complugins.trac.wordpress.org
Apr 8, 2025Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: Unauthorized access and modification of dataCVE-2025-2568 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayu_blocks_get_toggle_switch_values_callback' and 'vayu_blocks_save_toggle_switch_callback' function in versions 1.0.4 to 1.2.1. This makes it possible for unauthenticated attackers to read plugin options and update any option with a key name ending in '_value'.
- Product
- Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
- Affected
- 1.0.4 to 1.2.1
- What to do
- Affects 1.0.4 to 1.2.1. Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2025Motors – Car Dealership & Classified Listings: Unauthorized modification of dataCVE-2025-3437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in the ajax_actions.php file in all versions up to, and including, 1.4.66. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute several initial set-up actions.
- Product
- Motors – Car Dealership & Classified Listings
- Affected
- up to 1.4.66
- What to do
- Affects up to 1.4.66. Update Motors – Car Dealership & Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 5, 2025MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy: Unauthorized loss of dataCVE-2025-2789 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_table_rate_shipping_row function in all versions up to, and including, 4.2.19. This makes it possible for unauthenticated attackers to delete Table Rates that can impact the shipping cost calculations.
- Product
- MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy
- Affected
- up to 4.2.19
- What to do
- Affects up to 4.2.19. Update MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 5, 2025Lafka: Unauthorized accessCVE-2025-1233 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versions up to, and including, 7.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the theme option that overrides the site.
- Product
- Lafka
- Affected
- up to 7.1.0
- What to do
- Affects up to 7.1.0. Update Lafka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Apr 5, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13776 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 4, 2025Email Notifications for Updates: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the awun_import_settings() function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26741 is likely a duplicate of this issue.
- Product
- Email Notifications for Updates
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Email Notifications for Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2025RepairBuddy: Missing AuthorizationCVE-2025-32277 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through <= 3.8213.
- Product
- RepairBuddy
- Affected
- up to 3.8213
- What to do
- Affects up to 3.8213. Update RepairBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Simple Website Logo: Missing AuthorizationCVE-2025-32258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in InfoGiants Simple Website Logo simple-website-logo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Website Logo: from n/a through <= 1.1.
- Product
- Simple Website Logo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Simple Website Logo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025SurveyJS: Missing AuthorizationCVE-2025-32256 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in devsoftbaltic SurveyJS surveyjs allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SurveyJS: from n/a through <= 1.12.20.
- Product
- SurveyJS
- Affected
- up to 1.12.20
- What to do
- Affects up to 1.12.20. Update SurveyJS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025StaffList: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList stafflist allows Retrieve Embedded Sensitive Data.This issue affects StaffList: from n/a through <= 3.2.7.
- Product
- StaffList
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update StaffList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025WPBookit: Missing AuthorizationCVE-2025-32254 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBookit: from n/a through <= 1.0.7.
- Product
- WPBookit
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update WPBookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Course Booking System: Missing AuthorizationCVE-2025-32253 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ComMotion Course Booking System course-booking-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Course Booking System: from n/a through <= 6.1.
- Product
- Course Booking System
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Course Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025WP Genealogy – Your Family History Website: Missing AuthorizationCVE-2025-32252 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Black and White WP Genealogy – Your Family History Website wpgenealogy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Genealogy – Your Family History Website: from n/a through <= 0.1.9.
- Product
- WP Genealogy – Your Family History Website
- Affected
- up to 0.1.9
- What to do
- Affects up to 0.1.9. Update WP Genealogy – Your Family History Website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Jetpack Feedback Exporter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32251 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in J. Tyler Wiest Jetpack Feedback Exporter jetpack-feedback-exporter allows Retrieve Embedded Sensitive Data.This issue affects Jetpack Feedback Exporter: from n/a through <= 1.23.
- Product
- Jetpack Feedback Exporter
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update Jetpack Feedback Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 20251-Click Backup & Restore Database: Missing AuthorizationCVE-2025-32246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database 1-click-backup-restore-database-by-sunbytes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1-Click Backup & Restore Database: from n/a through <= 1.0.3.
- Product
- 1-Click Backup & Restore Database
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update 1-Click Backup & Restore Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Social Share Buttons & Analytics Plugin – GetSocial.io: Missing AuthorizationCVE-2025-32239 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joao Romao Social Share Buttons & Analytics Plugin – GetSocial.io wp-share-buttons-analytics-by-getsocial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Buttons & Analytics Plugin – GetSocial.io: from n/a through <= 4.5.
- Product
- Social Share Buttons & Analytics Plugin – GetSocial.io
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update Social Share Buttons & Analytics Plugin – GetSocial.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-32237 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
- Product
- MasterStudy LMS
- Affected
- up to 3.5.28
- What to do
- Affects up to 3.5.28. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025MP3 Audio Player for Music, Radio & Podcast by Sonaar: Missing AuthorizationCVE-2025-32235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.9.4.
- Product
- MP3 Audio Player for Music, Radio & Podcast by Sonaar
- Affected
- up to 5.9.4
- What to do
- Affects up to 5.9.4. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025AdMail – Multilingual Back in-Stock Notifier for WooCommerce: Missing AuthorizationCVE-2025-32234 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aleswebs AdMail – Multilingual Back in-Stock Notifier for WooCommerce admail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdMail – Multilingual Back in-Stock Notifier for WooCommerce: from n/a through <= 1.7.0.
- Product
- AdMail – Multilingual Back in-Stock Notifier for WooCommerce
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update AdMail – Multilingual Back in-Stock Notifier for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Revive.so: Missing AuthorizationCVE-2025-32233 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.3.
- Product
- Revive.so
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Revive.so to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.