Vulnerability database

24,297 results · page 150 of 486

• Jan 22, 2026Verdure: Authorization Bypass Through User-Controlled KeyCVE-2026-22430 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verdure: from n/a through <= 1.6.

  Product

  Verdure

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Verdure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Sweet Jane: Authorization Bypass Through User-Controlled KeyCVE-2026-22426 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sweet Jane: from n/a through <= 1.2.

  Product

  Sweet Jane

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Sweet Jane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Dolcino: Authorization Bypass Through User-Controlled KeyCVE-2026-22411 · WordPress plugins & themes · reported by PatchstackLow 3.8

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dolcino: from n/a through <= 1.6.

  Product

  Dolcino

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Dolcino to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Justicia: Authorization Bypass Through User-Controlled KeyCVE-2026-22409 · WordPress plugins & themes · reported by PatchstackLow 3.8

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justicia: from n/a through <= 1.2.

  Product

  Justicia

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Justicia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Roam: Authorization Bypass Through User-Controlled KeyCVE-2026-22407 · WordPress plugins & themes · reported by PatchstackLow 3.8

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Roam: from n/a through <= 2.1.1.

  Product

  Roam

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Roam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Overton: Authorization Bypass Through User-Controlled KeyCVE-2026-22406 · WordPress plugins & themes · reported by PatchstackLow 3.8

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through <= 1.3.

  Product

  Overton

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Overton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Innovio: Authorization Bypass Through User-Controlled KeyCVE-2026-22404 · WordPress plugins & themes · reported by PatchstackLow 3.8

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.

  Product

  Innovio

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Innovio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Triply: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22402 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Triply triply allows PHP Local File Inclusion.This issue affects Triply: from n/a through <= 2.4.7.

  Product

  Triply

  Affected

  up to 2.4.7

  What to do

  Affects up to 2.4.7. Update Triply to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Freshio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22401 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Freshio freshio allows PHP Local File Inclusion.This issue affects Freshio: from n/a through <= 2.4.2.

  Product

  Freshio

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update Freshio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Holmes: Authorization Bypass Through User-Controlled KeyCVE-2026-22400 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Holmes: from n/a through <= 1.7.

  Product

  Holmes

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Holmes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Fleur: Authorization Bypass Through User-Controlled KeyCVE-2026-22398 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fleur: from n/a through <= 2.0.

  Product

  Fleur

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Fleur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Fiorello: Authorization Bypass Through User-Controlled KeyCVE-2026-22396 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1.0.

  Product

  Fiorello

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Fiorello to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Curly: Authorization Bypass Through User-Controlled KeyCVE-2026-22393 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Curly: from n/a through <= 3.3.

  Product

  Curly

  Affected

  up to 3.3

  What to do

  Affects up to 3.3. Update Curly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Cocco: Authorization Bypass Through User-Controlled KeyCVE-2026-22391 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through <= 1.5.1.

  Product

  Cocco

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Cocco to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Owl Carousel WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22388 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Owl Carousel WP owl-carousel-wp allows Stored XSS.This issue affects Owl Carousel WP: from n/a through <= 2.2.2.

  Product

  Owl Carousel WP

  Affected

  up to 2.2.2

  What to do

  Affects up to 2.2.2. Update Owl Carousel WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026teachPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22353 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winkm89 teachPress teachpress allows Stored XSS.This issue affects teachPress: from n/a through <= 9.0.12.

  Product

  teachPress

  Affected

  up to 9.0.12

  What to do

  Affects up to 9.0.12. Update teachPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Menu In Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22349 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linux4me2 Menu In Post menu-in-post allows DOM-Based XSS.This issue affects Menu In Post: from n/a through <= 1.4.1.

  Product

  Menu In Post

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Menu In Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Civic Cookie Control: Missing AuthorizationCVE-2026-22348 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Civic Cookie Control: from n/a through <= 1.53.

  Product

  Civic Cookie Control

  Affected

  up to 1.53

  What to do

  Affects up to 1.53. Update Civic Cookie Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Carousel Horizontal Posts Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22347 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider carousel-horizontal-posts-content-slider allows DOM-Based XSS.This issue affects Carousel Horizontal Posts Content Slider: from n/a through <= 3.3.2.

  Product

  Carousel Horizontal Posts Content Slider

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Carousel Horizontal Posts Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Grand Spa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69321 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This issue affects Grand Spa: from n/a through <= 3.5.5.

  Product

  Grand Spa

  Affected

  up to 3.5.5

  What to do

  Affects up to 3.5.5. Update Grand Spa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Grand Magazine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69320 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected XSS.This issue affects Grand Magazine: from n/a through <= 3.5.7.

  Product

  Grand Magazine

  Affected

  up to 3.5.7

  What to do

  Affects up to 3.5.7. Update Grand Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Beaver Builder: Improper Control of Generation of Code ('Code Injection')CVE-2025-69319 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Generation of Code ('Code Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Code Injection.This issue affects Beaver Builder: from n/a through <= 2.9.4.1.

  Product

  Beaver Builder

  Affected

  up to 2.9.4.1

  What to do

  Affects up to 2.9.4.1. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026JobWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69318 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak JobWP jobwp allows Stored XSS.This issue affects JobWP: from n/a through <= 2.4.5.

  Product

  JobWP

  Affected

  up to 2.4.5

  What to do

  Affects up to 2.4.5. Update JobWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026CarSpot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69317 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: from n/a through < 2.4.6.

  Product

  CarSpot

  What to do

  Update CarSpot to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69316 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through <= 1.0.4.2.

  Product

  TableOn

  Affected

  up to 1.0.4.2

  What to do

  Affects up to 1.0.4.2. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2025-69315 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.15.

  Product

  Simply Schedule Appointments

  Affected

  up to 1.6.9.15

  What to do

  Affects up to 1.6.9.15. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Werkstatt: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69314 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through < 4.8.3.

  Product

  Werkstatt

  What to do

  Update Werkstatt to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026PostX: Missing AuthorizationCVE-2025-69313 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 5.0.3.

  Product

  PostX

  Affected

  up to 5.0.3

  What to do

  Affects up to 5.0.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Broadstreet Ads: Missing AuthorizationCVE-2025-69311 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.

  Product

  Broadstreet Ads

  Affected

  up to 1.52.1

  What to do

  Affects up to 1.52.1. Update Broadstreet Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Premium Addons for Elementor: Missing AuthorizationCVE-2025-69300 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.63.

  Product

  Premium Addons for Elementor

  Affected

  up to 4.11.63

  What to do

  Affects up to 4.11.63. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Membership: Missing AuthorizationCVE-2025-69193 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.4.

  Product

  WP Membership

  Affected

  up to 1.6.4

  What to do

  Affects up to 1.6.4. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Real Estate Pro: Missing AuthorizationCVE-2025-69192 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Pro: from n/a through <= 2.1.5.

  Product

  Real Estate Pro

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Real Estate Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026ListingHub: Missing AuthorizationCVE-2025-69191 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingHub: from n/a through <= 1.2.7.

  Product

  ListingHub

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update ListingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Listihub: Missing AuthorizationCVE-2025-69190 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through <= 1.0.6.

  Product

  Listihub

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Listihub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026fitness-trainer: Missing AuthorizationCVE-2025-69188 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fitness-trainer: from n/a through <= 1.7.1.

  Product

  fitness-trainer

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update fitness-trainer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Final User: Missing AuthorizationCVE-2025-69187 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through <= 1.2.5.

  Product

  Final User

  Affected

  up to 1.2.5

  What to do

  Affects up to 1.2.5. Update Final User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-69186 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

  Product

  Hospital Doctor Directory

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Hotel Listing: Missing AuthorizationCVE-2025-69185 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.

  Product

  Hotel Listing

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update Hotel Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Institutions Directory: Missing AuthorizationCVE-2025-69184 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3.4.

  Product

  Institutions Directory

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Institutions Directory: Incorrect Privilege AssignmentCVE-2025-69182 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institutions Directory: from n/a through <= 1.3.4.

  Product

  Institutions Directory

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Lawyer Directory: Missing AuthorizationCVE-2025-69181 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.4.

  Product

  Lawyer Directory

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Ultra Portfolio: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69180 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through <= 6.7.

  Product

  Ultra Portfolio

  Affected

  up to 6.7

  What to do

  Affects up to 6.7. Update Ultra Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Test Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69102 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflected XSS.This issue affects WP Test Email: from n/a through <= 1.1.7.

  Product

  WP Test Email

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update WP Test Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Workreap Core: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-69101 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from n/a through <= 3.4.1.

  Product

  Workreap Core

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update Workreap Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026North: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69100 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North north-wp allows PHP Local File Inclusion.This issue affects North: from n/a through <= 5.7.5.

  Product

  North

  Affected

  up to 5.7.5

  What to do

  Affects up to 5.7.5. Update North to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026North: Deserialization of Untrusted DataCVE-2025-69099 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5.

  Product

  North

  Affected

  up to 5.7.5

  What to do

  Affects up to 5.7.5. Update North to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Hide My WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69098 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWave Hide My WP hide_my_wp allows Reflected XSS.This issue affects Hide My WP: from n/a through <= 6.2.12.

  Product

  Hide My WP

  Affected

  up to 6.2.12

  What to do

  Affects up to 6.2.12. Update Hide My WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WPLMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69097 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

  Product

  WPLMS

  Affected

  up to 1.9.9.5.4

  What to do

  Affects up to 1.9.9.5.4. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Reservation: Missing AuthorizationCVE-2025-69095 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.

  Product

  Reservation

  Affected

  up to 1.7

  What to do

  Affects up to 1.7. Update Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Sound | Musical Instruments Online Store: Deserialization of Untrusted DataCVE-2025-69079 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.

  Product

  Sound | Musical Instruments Online Store

  Affected

  up to 1.6.9

  What to do

  Affects up to 1.6.9. Update Sound | Musical Instruments Online Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.