Vulnerability database

24,297 results · page 153 of 486

• Jan 22, 2026onepay Payment Gateway For WooCommerce: Missing AuthorizationCVE-2025-68016 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooCommerce: from n/a through <= 1.1.2.

  Product

  onepay Payment Gateway For WooCommerce

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update onepay Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Event Tickets with Ticket Scanner: Improper Control of Generation of Code ('Code Injection')CVE-2025-68015 · WordPress plugins & themes · reported by PatchstackCritical 9

  Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.5.

  Product

  Event Tickets with Ticket Scanner

  Affected

  up to 2.8.5

  What to do

  Affects up to 2.8.5. Update Event Tickets with Ticket Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Payment Gateway Authorize.Net CIM for WooCommerce: Missing AuthorizationCVE-2025-68013 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.

  Product

  Payment Gateway Authorize.Net CIM for WooCommerce

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update Payment Gateway Authorize.Net CIM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026CodeColorer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68012 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmytro Shteflyuk CodeColorer codecolorer allows Stored XSS.This issue affects CodeColorer: from n/a through <= 0.10.1.

  Product

  CodeColorer

  Affected

  up to 0.10.1

  What to do

  Affects up to 0.10.1. Update CodeColorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026GLS Shipping for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68011 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GLS GLS Shipping for WooCommerce gls-shipping-for-woocommerce allows Reflected XSS.This issue affects GLS Shipping for WooCommerce: from n/a through <= 1.4.0.

  Product

  GLS Shipping for WooCommerce

  Affected

  up to 1.4.0

  What to do

  Affects up to 1.4.0. Update GLS Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Netgsm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68010 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through <= 2.9.63.

  Product

  Netgsm

  Affected

  up to 2.9.63

  What to do

  Affects up to 2.9.63. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Slider Templates: Missing AuthorizationCVE-2025-68009 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3.

  Product

  Slider Templates

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Slider Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68008 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: from n/a through <= 1.3.

  Product

  WP Mail

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Event Espresso 4 Decaf: Missing AuthorizationCVE-2025-68007 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.37.decaf.

  Product

  Event Espresso 4 Decaf

  Affected

  up to 5.0.37.decaf

  What to do

  Affects up to 5.0.37.decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Booking Ultra Pro: Insertion of Sensitive Information Into Sent DataCVE-2025-68006 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through <= 1.1.23.

  Product

  Booking Ultra Pro

  Affected

  up to 1.1.23

  What to do

  Affects up to 1.1.23. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026My Post Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68004 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kapil Chugh My Post Order my-posts-order allows Reflected XSS.This issue affects My Post Order: from n/a through <= 1.2.1.1.

  Product

  My Post Order

  Affected

  up to 1.2.1.1

  What to do

  Affects up to 1.2.1.1. Update My Post Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Shown Connector: Missing AuthorizationCVE-2025-68003 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.

  Product

  Shown Connector

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update Shown Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Lawyer Directory: Missing AuthorizationCVE-2025-67967 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.

  Product

  Lawyer Directory

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Homey Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67964 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.

  Product

  Homey Core

  Affected

  up to 2.4.3

  What to do

  Affects up to 2.4.3. Update Homey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Movie Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-67963 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5.

  Product

  Movie Booking

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update Movie Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67960 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through <= 1.7.06.

  Product

  WorkScout-Core

  Affected

  up to 1.7.06

  What to do

  Affects up to 1.7.06. Update WorkScout-Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WorkScout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67959 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScout: from n/a through <= 4.1.07.

  Product

  WorkScout

  Affected

  up to 4.1.07

  What to do

  Affects up to 4.1.07. Update WorkScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026TaxCloud for WooCommerce: Missing AuthorizationCVE-2025-67958 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TaxCloud for WooCommerce: from n/a through <= 8.3.8.

  Product

  TaxCloud for WooCommerce

  Affected

  up to 8.3.8

  What to do

  Affects up to 8.3.8. Update TaxCloud for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Listivo Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67957 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File Inclusion.This issue affects Listivo Core: from n/a through <= 2.3.77.

  Product

  Listivo Core

  Affected

  up to 2.3.77

  What to do

  Affects up to 2.3.77. Update Listivo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026User Registration: Missing AuthorizationCVE-2025-67956 · WordPress plugins & themes · reported by PatchstackHigh 8.2

  Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.6.

  Product

  User Registration

  Affected

  up to 4.4.6

  What to do

  Affects up to 4.4.6. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026MyHome Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67955 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP MyHome Core myhome-core allows PHP Local File Inclusion.This issue affects MyHome Core: from n/a through <= 4.1.0.

  Product

  MyHome Core

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Salon booking system: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67954 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.

  Product

  Salon booking system

  Affected

  up to 10.30.3

  What to do

  Affects up to 10.30.3. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Grand Tour: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67952 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through < 5.6.2.

  Product

  Grand Tour

  What to do

  Update Grand Tour to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Hostiko: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67949 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko: from n/a through < 94.3.6.

  Product

  Hostiko

  What to do

  Update Hostiko to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026AdForest Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67947 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle AdForest Elementor adforest-elementor allows Reflected XSS.This issue affects AdForest Elementor: from n/a through <= 3.0.11.

  Product

  AdForest Elementor

  Affected

  up to 3.0.11

  What to do

  Affects up to 3.0.11. Update AdForest Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026AdForest: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67946 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through <= 6.0.11.

  Product

  AdForest

  Affected

  up to 6.0.11

  What to do

  Affects up to 6.0.11. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026MailerLite – WooCommerce integration: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67945 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2.

  Product

  MailerLite – WooCommerce integration

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update MailerLite – WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Nelio AB Testing: Improper Control of Generation of Code ('Code Injection')CVE-2025-67944 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.1.8.

  Product

  Nelio AB Testing

  Affected

  up to 8.1.8

  What to do

  Affects up to 8.1.8. Update Nelio AB Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026My auctions allegro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67943 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.32.

  Product

  My auctions allegro

  Affected

  up to 3.6.32

  What to do

  Affects up to 3.6.32. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Peach Payments Gateway: Missing AuthorizationCVE-2025-67942 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.

  Product

  Peach Payments Gateway

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update Peach Payments Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026The Aisle: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67941 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle theaisle allows PHP Local File Inclusion.This issue affects The Aisle: from n/a through < 2.9.1.

  Product

  The Aisle

  What to do

  Update The Aisle to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Powerlift: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67940 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through < 3.2.1.

  Product

  Powerlift

  What to do

  Update Powerlift to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Tickera: Missing AuthorizationCVE-2025-67939 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.2.

  Product

  Tickera

  Affected

  up to 3.5.6.2

  What to do

  Affects up to 3.5.6.2. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Biagiotti: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67938 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Biagiotti biagiotti allows PHP Local File Inclusion.This issue affects Biagiotti: from n/a through < 3.5.2.

  Product

  Biagiotti

  What to do

  Update Biagiotti to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67923 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.

  Product

  JetEngine

  Affected

  up to 3.7.7

  What to do

  Affects up to 3.7.7. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Anon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67620 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CleverSoft Anon anon2x allows Reflected XSS.This issue affects Anon: from n/a through <= 2.2.10.

  Product

  Anon

  Affected

  up to 2.2.10

  What to do

  Affects up to 2.2.10. Update Anon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Kids Heaven: Deserialization of Untrusted DataCVE-2025-67619 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.

  Product

  Kids Heaven

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Kids Heaven to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Consult Aid: Deserialization of Untrusted DataCVE-2025-67617 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.

  Product

  Consult Aid

  Affected

  up to 1.4.3

  What to do

  Affects up to 1.4.3. Update Consult Aid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Mella: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67616 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through <= 1.2.29.

  Product

  Mella

  Affected

  up to 1.2.29

  What to do

  Affects up to 1.2.29. Update Mella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Myour: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67615 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through <= 1.5.1.

  Product

  Myour

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Myour to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026TheNa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67614 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree TheNa thena allows Reflected XSS.This issue affects TheNa: from n/a through <= 1.5.5.

  Product

  TheNa

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update TheNa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Crumber: Missing AuthorizationCVE-2025-66143 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through <= 1.0.10.

  Product

  Crumber

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Crumber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Comparimager for Elementor: Missing AuthorizationCVE-2025-66142 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comparimager for Elementor: from n/a through <= 1.0.1.

  Product

  Comparimager for Elementor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Comparimager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Scroller: Missing AuthorizationCVE-2025-66141 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a through <= 2.0.2.

  Product

  Scroller

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Uper for Elementor: Missing AuthorizationCVE-2025-66140 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.

  Product

  Uper for Elementor

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Uper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Audier For Elementor: Missing AuthorizationCVE-2025-66139 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.

  Product

  Audier For Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Audier For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Motionger for Elementor: Missing AuthorizationCVE-2025-66138 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motionger for Elementor: from n/a through <= 2.0.4.

  Product

  Motionger for Elementor

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Motionger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Searcher for Elementor: Missing AuthorizationCVE-2025-66137 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.

  Product

  Searcher for Elementor

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Searcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Carter for Elementor: Missing AuthorizationCVE-2025-66136 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2.

  Product

  Carter for Elementor

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Carter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Imager for Elementor: Missing AuthorizationCVE-2025-66135 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4.

  Product

  Imager for Elementor

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Imager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.