Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,154 results · page 15 of 44
Feb 3, 2026UsersWP: Cross-Site Request Forgery (CSRF)CVE-2026-25015 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53.
- Product
- UsersWP
- Affected
- up to 1.2.53
- What to do
- Affects up to 1.2.53. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Extensions For CF7: Authorization Bypass Through User-Controlled KeyCVE-2026-24991 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.
- Product
- Extensions For CF7
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Extensions For CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Simple Membership WP user Import: Cross-Site Request Forgery (CSRF)CVE-2026-24986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wp.insider Simple Membership WP user Import simple-membership-wp-user-import allows Cross Site Request Forgery.This issue affects Simple Membership WP user Import: from n/a through <= 1.9.1.
- Product
- Simple Membership WP user Import
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Simple Membership WP user Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 2, 2026User Profile Builder: Does not have a proper password reset processCVE-2025-15030 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
- Product
- User Profile Builder
- Fixed in
- 3.15.2
- What to do
- Update User Profile Builder to 3.15.2 or newer.
Jan 28, 2026Simple User Registration: Privilege escalationCVE-2026-0844 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
- Product
- Simple User Registration
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2026New User Approve: Unauthorized access of data and modification of dataCVE-2026-0832 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to approve or deny user accounts, retrieve sensitive user information including emails and roles, and force logout of privileged users.
- Product
- New User Approve
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2026User Activity Log: Does not properly handle failed login attempts in some casesCVE-2025-13471 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrary options to 1 (for example to enable User Registration when it has been turned off)
- Product
- User Activity Log
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2026User Submitted Posts – Enable Users to Submit Posts from the Front End: Stored Cross-Site ScriptingCVE-2026-0800 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom fields in all versions up to, and including, 20251210 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- User Submitted Posts – Enable Users to Submit Posts from the Front End
- Affected
- up to 20251210
- What to do
- Affects up to 20251210. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 24, 2026Alex User Counter: Cross-Site Request ForgeryCVE-2026-1070 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alex User Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0. This is due to missing nonce validation on the alex_user_counter_function() function. This makes it possible for unauthenticated attackers to update the plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Alex User Counter
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update Alex User Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026Ultimate Reviews: Authorization Bypass Through User-Controlled KeyCVE-2026-24634 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Reviews: from n/a through <= 3.2.16.
- Product
- Ultimate Reviews
- Affected
- up to 3.2.16
- What to do
- Affects up to 3.2.16. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Rosebud: Authorization Bypass Through User-Controlled KeyCVE-2026-24631 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rosebud: from n/a through <= 1.4.
- Product
- Rosebud
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Rosebud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026NextMove Lite: Authorization Bypass Through User-Controlled KeyCVE-2026-24599 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.
- Product
- NextMove Lite
- Affected
- up to 2.23.0
- What to do
- Affects up to 2.23.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Job Portal: Authorization Bypass Through User-Controlled KeyCVE-2026-24379 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.3.
- Product
- WP Job Portal
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026User Registration: Missing AuthorizationCVE-2026-24353 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.9.
- Product
- User Registration
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Verdure: Authorization Bypass Through User-Controlled KeyCVE-2026-22430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verdure: from n/a through <= 1.6.
- Product
- Verdure
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Verdure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Sweet Jane: Authorization Bypass Through User-Controlled KeyCVE-2026-22426 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sweet Jane: from n/a through <= 1.2.
- Product
- Sweet Jane
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Sweet Jane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Dolcino: Authorization Bypass Through User-Controlled KeyCVE-2026-22411 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dolcino: from n/a through <= 1.6.
- Product
- Dolcino
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Dolcino to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Justicia: Authorization Bypass Through User-Controlled KeyCVE-2026-22409 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justicia: from n/a through <= 1.2.
- Product
- Justicia
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Justicia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Roam: Authorization Bypass Through User-Controlled KeyCVE-2026-22407 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Roam: from n/a through <= 2.1.1.
- Product
- Roam
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Roam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Overton: Authorization Bypass Through User-Controlled KeyCVE-2026-22406 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through <= 1.3.
- Product
- Overton
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Overton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Innovio: Authorization Bypass Through User-Controlled KeyCVE-2026-22404 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.
- Product
- Innovio
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Innovio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Holmes: Authorization Bypass Through User-Controlled KeyCVE-2026-22400 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Holmes: from n/a through <= 1.7.
- Product
- Holmes
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Holmes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Fleur: Authorization Bypass Through User-Controlled KeyCVE-2026-22398 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fleur: from n/a through <= 2.0.
- Product
- Fleur
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Fleur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Fiorello: Authorization Bypass Through User-Controlled KeyCVE-2026-22396 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1.0.
- Product
- Fiorello
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Fiorello to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Curly: Authorization Bypass Through User-Controlled KeyCVE-2026-22393 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Curly: from n/a through <= 3.3.
- Product
- Curly
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Curly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Cocco: Authorization Bypass Through User-Controlled KeyCVE-2026-22391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through <= 1.5.1.
- Product
- Cocco
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Cocco to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Final User: Incorrect Privilege AssignmentCVE-2025-69293 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <= 1.2.5.
- Product
- Final User
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Final User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Final User: Missing AuthorizationCVE-2025-69187 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through <= 1.2.5.
- Product
- Final User
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Final User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026User Registration: Missing AuthorizationCVE-2025-67956 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.6.
- Product
- User Registration
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-47555 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
- Product
- Tutor LMS
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026LA-Studio Element Kit for Elementor: Administrative User CreationCVE-2026-0920 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.5.6.3
- What to do
- Affects up to 1.5.6.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 17, 2026User Registration Using Contact Form 7: Unauthorized access of dataCVE-2025-12825 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_form_data' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings which includes Facebook app secrets.
- Product
- User Registration Using Contact Form 7
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update User Registration Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2026User Submitted Posts – Enable Users to Submit Posts from the Front End: Stored Cross-Site ScriptingCVE-2026-0913 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'usp_access' shortcode in all versions up to, and including, 20260110 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- User Submitted Posts – Enable Users to Submit Posts from the Front End
- Affected
- up to 20260110
- What to do
- Affects up to 20260110. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2026Shield: Blocks Bots, Protects Users, and Prevents Security Breaches: Insecure Direct Object ReferenceCVE-2025-15370 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9 via the MfaGoogleAuthToggle class due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable Google Authenticator for any user.
- Product
- Shield: Blocks Bots, Protects Users, and Prevents Security Breaches
- Affected
- up to 21.0.9
- What to do
- Affects up to 21.0.9. Update Shield: Blocks Bots, Protects Users, and Prevents Security Breaches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 10, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2025-14976 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.8. This is due to missing or incorrect nonce validation on the 'process_row_actions' function with the 'delete' action. This makes it possible for unauthenticated attackers to delete arbitrary post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected
- up to 4.4.8
- What to do
- Affects up to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2026Image Slider Slideshow: Authorization Bypass Through User-Controlled KeyCVE-2026-22489 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Wptexture Image Slider Slideshow image-slider-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider Slideshow: from n/a through <= 1.8.
- Product
- Image Slider Slideshow
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Image Slider Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Woffice Core: Authorization Bypass Through User-Controlled KeyCVE-2025-67919 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.
- Product
- Woffice Core
- Affected
- up to 5.4.30
- What to do
- Affects up to 5.4.30. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026Simple User Meta Editor: Stored Cross-Site ScriptingCVE-2025-14888 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Simple User Meta Editor
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Simple User Meta Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2026Latest Registered Users: Unauthorized user data exportCVE-2025-13493 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rnd_handle_form_submit function hooked to both admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. This makes it possible for unauthenticated attackers to export complete user details (excluding passwords and sensitive tokens) in CSV format via the 'action' parameter.
- Product
- Latest Registered Users
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Latest Registered Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2026Guest posting / Frontend Posting / Front Editor – WP Front User Submit: Unauthorized modification of dataCVE-2025-13419 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bfe/v1/revert' REST API endpoint in all versions up to, and including, 5.0.0. This makes it possible for unauthenticated attackers to delete arbitrary media attachments.
- Product
- Guest posting / Frontend Posting / Front Editor – WP Front User Submit
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Guest posting / Frontend Posting / Front Editor – WP Front User Submit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2026User Activity Log: A limited options updateCVE-2025-11877 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. This makes it possible for unauthenticated attackers to push select site options from 0 to a non-zero value, allowing them to reopen registration or corrupt options like 'wp_user_roles', breaking wp-admin access. CVE-2025-13471 appears to be a duplicate of this CVE.
- Product
- User Activity Log
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update User Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 5, 2026Five Star Restaurant Reservations: Authorization Bypass Through User-Controlled KeyCVE-2025-68044 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.4.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026Team: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-14124 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Team
- Fixed in
- 5.0.11
- What to do
- Update Team to 5.0.11 or newer.
Jan 1, 2026The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulneraCVE-2025-14047 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission – WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'Frontend_Form_Ajax::submit_post' function in all versions up to, and including, 4.2.4. This makes it possible for unauthenticated attackers to delete attachment.
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 1, 2026Comments: Does not properly validate user's identityCVE-2025-13820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet.
- Product
- Comments
- Fixed in
- 7.6.40
- What to do
- Update Comments to 7.6.40 or newer.
Dec 31, 2025Order Cancellation & Returns for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2025-49352 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.
- Product
- Order Cancellation & Returns for WooCommerce
- Affected
- up to 1.1.11
- What to do
- Affects up to 1.1.11. Update Order Cancellation & Returns for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025MyD Delivery: Authorization Bypass Through User-Controlled KeyCVE-2025-49334 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1.
- Product
- MyD Delivery
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update MyD Delivery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Master Addons for Elementor: Authorization Bypass Through User-Controlled KeyCVE-2025-63053 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.
- Product
- Master Addons for Elementor
- Affected
- up to 2.0.9.9.4
- What to do
- Affects up to 2.0.9.9.4. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Maximum Products per User for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62096 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Maximum Products per User for WooCommerce maximum-products-per-user-for-woocommerce allows Stored XSS.This issue affects Maximum Products per User for WooCommerce: from n/a through <= 4.4.3.
- Product
- Maximum Products per User for WooCommerce
- Affected
- up to 4.4.3
- What to do
- Affects up to 4.4.3. Update Maximum Products per User for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025User Specific Content: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62749 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bainternet User Specific Content user-specific-content allows DOM-Based XSS.This issue affects User Specific Content: from n/a through <= 1.0.6.
- Product
- User Specific Content
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update User Specific Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.