Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

24,297 results · page 156 of 486

Jan 13, 2026WP Duplicate Page: Unauthorized modification of dataCVE-2025-14001 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, pages, and WooCommerce HPOS orders even when their role is explicitly excluded from the plugin's "Allowed User Roles" setting, potentially exposing sensitive information and allowing duplicate fulfillment of WooCommerce orders.
Product
WP Duplicate Page
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP Duplicate Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 13, 2026E-xact | Hosted Payment |: Is vulnerable to arbitrary file deletion due to insufficient file path validationCVE-2025-14829 · WordPress plugins & themes · reported by WPScanCritical 9.1
The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
Product
E-xact | Hosted Payment |
Affected
up to 2.0
What to do
Affects up to 2.0. Update E-xact | Hosted Payment | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 13, 2026Dreamer Blog: Is vulnerable to arbitrary installations due to a missing capability checkCVE-2025-10915 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.
Product
Dreamer Blog
Affected
up to 1.2
What to do
Affects up to 1.2. Update Dreamer Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jan 10, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2025-14976 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.8. This is due to missing or incorrect nonce validation on the 'process_row_actions' function with the 'delete' action. This makes it possible for unauthenticated attackers to delete arbitrary post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected
up to 4.4.8
What to do
Affects up to 4.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2026miniOrange OTP Verification and SMS Notification for WooCommerce: Unauthorized modification of dataCVE-2025-14948 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `enable_wc_sms_notification` AJAX action in all versions up to, and including, 4.3.8. This makes it possible for unauthenticated attackers to enable or disable SMS notification settings for WooCommerce orders.
Product
miniOrange OTP Verification and SMS Notification for WooCommerce
Affected
up to 4.3.8
What to do
Affects up to 4.3.8. Update miniOrange OTP Verification and SMS Notification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2026Blog2Social: Social Media Auto Post & Scheduler: Sensitive Information ExposureCVE-2025-14943 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. This is due to a misconfigured authorization check on the 'getShipItemFullText' function which only verifies that a user has the 'read' capability (Subscriber-level) and a valid nonce, but fails to verify whether the user has permission to access the specific post being requested. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password-protected, private, or draft posts.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.7.2
What to do
Affects up to 8.7.2. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026the Login Widget: AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code executionCVE-2020-36875 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.
Product
the Login Widget
What to do
Update the Login Widget to the newest version.
Full record and what to do →NVD record accessally.com wpscan.com
Jan 9, 2026WP Page Permalink Extension: Missing AuthorizationCVE-2025-14172 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the `cwpp_trigger_flush_rewrite_rules` function hooked to `wp_ajax_cwpp_trigger_flush_rewrite_rules`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to flush the site's rewrite rules via the `action` parameter.
Product
WP Page Permalink Extension
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update WP Page Permalink Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026MG AdvancedOptions: Reflected Cross-Site ScriptingCVE-2025-13892 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MG AdvancedOptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MG AdvancedOptions
Affected
up to 1.2
What to do
Affects up to 1.2. Update MG AdvancedOptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Top Position Google Finance: Reflected Cross-Site ScriptingCVE-2025-13895 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Top Position Google Finance plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Top Position Google Finance
Affected
up to 0.1.0
What to do
Affects up to 0.1.0. Update Top Position Google Finance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Frontend Admin by DynamiApps: Missing authorization to unauthorized data modification and deletionCVE-2025-14741 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.25
What to do
Affects up to 3.28.25. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026Eventin – Event Manager, Events Calendar, Event Tickets and Registrations: Unauthorized modification of dataCVE-2025-14657 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded.
Product
Eventin – Event Manager, Events Calendar, Event Tickets and Registrations
Affected
up to 4.0.51
What to do
Affects up to 4.0.51. Update Eventin – Event Manager, Events Calendar, Event Tickets and Registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Booking Calendar: Sensitive Information ExposureCVE-2025-14146 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIMELINE_NAV` AJAX action. This is due to the nonce verification being conditionally disabled by default (`booking_is_nonce_at_front_end` option is `'Off'` by default). When the `booking_is_show_popover_in_timeline_front_end` option is enabled (which is the default in demo installations and can be enabled by administrators), it is possible for unauthenticated attackers to extract sensitive booking data including customer names, email addresses, phone numbers, and booking details.
Product
Booking Calendar
Affected
up to 10.14.10
What to do
Affects up to 10.14.10. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized course completionCVE-2025-13935 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized course enrollmentCVE-2025-13934 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the `course_enrollment()` AJAX handler. This makes it possible for authenticated attackers, with subscriber level access and above, to enroll themselves in any course without going through the proper purchase flow.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026WP Table Builder – Drag & Drop Table Builder: Unauthorized modification of dataCVE-2025-13753 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check on the save_table() function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new wptb-table posts.
Product
WP Table Builder – Drag & Drop Table Builder
Affected
up to 2.0.19
What to do
Affects up to 2.0.19. Update WP Table Builder – Drag & Drop Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized modification and deletion of dataCVE-2025-13628 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler' and 'coupon_permanent_delete' functions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with subscriber level access and above, to delete, activate, deactivate, or trash arbitrary coupons.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026BetterDocs: Sensitive Information ExposureCVE-2025-14980 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data including the OpenAI API key stored in plugin settings.
Product
BetterDocs
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jan 9, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Authorization bypassCVE-2025-14782 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with access to the Forminator dashboard, to export sensitive form submission data including personally identifiable information.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.49.1
What to do
Affects up to 1.49.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2025-14736 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.29
What to do
Affects up to 3.28.29. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Schedule Post Changes With PublishPress Future: Authorization bypassCVE-2025-14718 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to create, update, delete, and publish malicious workflows that may automatically delete any post upon publication or update, including posts created by administrators.
Product
Schedule Post Changes With PublishPress Future
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update Schedule Post Changes With PublishPress Future to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026weDocs: Sensitive Information ExposureCVE-2025-14574 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including third party services API keys.
Product
weDocs
Affected
up to 2.1.15
What to do
Affects up to 2.1.15. Update weDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2026Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Cross-Site Request ForgeryCVE-2025-13749 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.0. This is due to missing nonce validation on the "wbcr_upm_change_flag" function. This makes it possible for unauthenticated attackers to disable plugin/theme update notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jan 9, 2026Japanized for WooCommerce: Unauthorized modification of dataCVE-2025-14886 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `order` REST API endpoint in all versions up to, and including, 2.7.17. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processed/completed.
Product
Japanized for WooCommerce
Affected
up to 2.7.17
What to do
Affects up to 2.7.17. Update Japanized for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2026Block Slider: Missing AuthorizationCVE-2026-22522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Munir Kamal Block Slider block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Block Slider: from n/a through <= 2.2.3.
Product
Block Slider
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Block Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Handmade Framework: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22521 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Framework handmade-framework allows PHP Local File Inclusion.This issue affects Handmade Framework: from n/a through <= 3.9.
Product
Handmade Framework
Affected
up to 3.9
What to do
Affects up to 3.9. Update Handmade Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026MediaPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22519 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This issue affects MediaPress: from n/a through <= 1.6.2.
Product
MediaPress
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update MediaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026X Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22518 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows DOM-Based XSS.This issue affects X Addons for Elementor: from n/a through <= 1.0.23.
Product
X Addons for Elementor
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update X Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026GA4WP: Google Analytics for: Missing AuthorizationCVE-2026-22517 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through <= 2.10.0.
Product
GA4WP: Google Analytics for
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update GA4WP: Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Docket Cache: Missing AuthorizationCVE-2026-22492 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nawawi Jamili Docket Cache docket-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Docket Cache: from n/a through <= 24.07.04.
Product
Docket Cache
Affected
up to 24.07.04
What to do
Affects up to 24.07.04. Update Docket Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Bulk Landing Page Creator for WordPress LPagery: Missing AuthorizationCVE-2026-22490 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Landing Page Creator for WordPress LPagery: from n/a through <= 2.4.9.
Product
Bulk Landing Page Creator for WordPress LPagery
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Bulk Landing Page Creator for WordPress LPagery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Image Slider Slideshow: Authorization Bypass Through User-Controlled KeyCVE-2026-22489 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Wptexture Image Slider Slideshow image-slider-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider Slideshow: from n/a through <= 1.8.
Product
Image Slider Slideshow
Affected
up to 1.8
What to do
Affects up to 1.8. Update Image Slider Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Dashboard Welcome for Beaver Builder: Missing AuthorizationCVE-2026-22488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Welcome for Beaver Builder: from n/a through <= 1.0.8.
Product
Dashboard Welcome for Beaver Builder
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Dashboard Welcome for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Speed Kit: Missing AuthorizationCVE-2026-22487 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in baqend Speed Kit baqend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Speed Kit: from n/a through <= 2.0.2.
Product
Speed Kit
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Speed Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Re Gallery: Missing AuthorizationCVE-2026-22486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Re Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Re Gallery: from n/a through 1.18.9.
Product
Re Gallery
Affected
up to 1.18.9
What to do
Affects up to 1.18.9. Update Re Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Zorka: Missing AuthorizationCVE-2026-0676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: from n/a through <= 1.5.7.
Product
Zorka
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Zorka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Campaign Monitor for: Missing AuthorizationCVE-2026-0674 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Campaign Monitor for WordPress: from n/a through 2.9.1.
Product
Campaign Monitor for
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Campaign Monitor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Easy Media Download: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-69169 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-download allows Reflection Injection.This issue affects Easy Media Download: from n/a through <= 1.1.11.
Product
Easy Media Download
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update Easy Media Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Scroll rss excerpt: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68892 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Scroll rss excerpt scroll-rss-excerpt allows Reflected XSS.This issue affects Scroll rss excerpt: from n/a through <= 5.0.
Product
Scroll rss excerpt
Affected
up to 5.0
What to do
Affects up to 5.0. Update Scroll rss excerpt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026WP App Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68891 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Sutana WP App Bar wp-app-bar allows Reflected XSS.This issue affects WP App Bar: from n/a through <= 1.5.
Product
WP App Bar
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP App Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026e-shops: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68890 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This issue affects e-shops: from n/a through <= 1.0.4.
Product
e-shops
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update e-shops to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Pinpoll: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68889 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue affects Pinpoll: from n/a through <= 4.0.0.
Product
Pinpoll
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Pinpoll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026WP-BusinessDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68887 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Reflected XSS.This issue affects WP-BusinessDirectory: from n/a through <= 4.0.1.
Product
WP-BusinessDirectory
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Flaming Password Reset: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68875 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jcaruso001 Flaming Password Reset flaming-password-reset allows Stored XSS.This issue affects Flaming Password Reset: from n/a through <= 1.0.3.
Product
Flaming Password Reset
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Flaming Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Visitor Stats Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68874 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows Reflected XSS.This issue affects Visitor Stats Widget: from n/a through <= 1.5.0.
Product
Visitor Stats Widget
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Visitor Stats Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026PRIMER by chloédigital: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68873 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chloédigital PRIMER by chloédigital primer-by-chloedigital allows Reflected XSS.This issue affects PRIMER by chloédigital: from n/a through <= 1.0.25.
Product
PRIMER by chloédigital
Affected
up to 1.0.25
What to do
Affects up to 1.0.25. Update PRIMER by chloédigital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Effect Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68867 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affects Effect Maker: from n/a through <= 1.2.1.
Product
Effect Maker
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Effect Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Hendon: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67937 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Hendon hendon allows PHP Local File Inclusion.This issue affects Hendon: from n/a through < 1.7.
Product
Hendon
Fixed in
1.7
What to do
Update Hendon to 1.7 or newer.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Curly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67936 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly curly allows PHP Local File Inclusion.This issue affects Curly: from n/a through < 3.3.
Product
Curly
Fixed in
3.3
What to do
Update Curly to 3.3 or newer.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Optimize: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67935 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Optimize optimizewp allows PHP Local File Inclusion.This issue affects Optimize: from n/a through < 2.4.
Product
Optimize
Fixed in
2.4
What to do
Update Optimize to 2.4 or newer.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.