Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

24,297 results · page 157 of 486

Jan 8, 2026Wellspring: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67934 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wellspring wellspring allows PHP Local File Inclusion.This issue affects Wellspring: from n/a through < 2.8.
Product
Wellspring
Fixed in
2.8
What to do
Update Wellspring to 2.8 or newer.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Taskbuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67933 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected XSS.This issue affects Taskbuilder: from n/a through <= 4.0.9.
Product
Taskbuilder
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Listeo Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67932 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through < 2.0.19.
Product
Listeo Core
What to do
Update Listeo Core to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026BulletProof Security: Insertion of Sensitive Information Into Sent DataCVE-2025-67931 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.This issue affects BulletProof Security: from n/a through <= 6.9.
Product
BulletProof Security
Affected
up to 6.9
What to do
Affects up to 6.9. Update BulletProof Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026eHive Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67930 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vernon Systems Limited eHive Search ehive-search allows Reflected XSS.This issue affects eHive Search: from n/a through <= 2.5.0.
Product
eHive Search
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update eHive Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Automotive Listings: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67928 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issue affects Automotive Listings: from n/a through <= 18.6.
Product
Automotive Listings
Affected
up to 18.6
What to do
Affects up to 18.6. Update Automotive Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Link Whisper Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67927 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.8.8.
Product
Link Whisper Free
Affected
up to 0.8.8
What to do
Affects up to 0.8.8. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Fluent Support: Missing AuthorizationCVE-2025-67926 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.10.4.
Product
Fluent Support
Affected
up to 1.10.4
What to do
Affects up to 1.10.4. Update Fluent Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Corpkit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67925 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Corpkit corpkit allows PHP Local File Inclusion.This issue affects Corpkit: from n/a through <= 2.0.
Product
Corpkit
Affected
up to 2.0
What to do
Affects up to 2.0. Update Corpkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Grand Restaurant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67922 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a through < 7.0.9.
Product
Grand Restaurant
Fixed in
7.0.9
What to do
Update Grand Restaurant to 7.0.9 or newer.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Lobo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67921 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through < 2.8.6.
Product
Lobo
What to do
Update Lobo to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Neo Ocular: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67920 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Neo Ocular neoocular allows PHP Local File Inclusion.This issue affects Neo Ocular: from n/a through < 1.2.
Product
Neo Ocular
What to do
Update Neo Ocular to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Woffice Core: Authorization Bypass Through User-Controlled KeyCVE-2025-67919 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.
Product
Woffice Core
Affected
up to 5.4.30
What to do
Affects up to 5.4.30. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Woffice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67918 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through <= 5.4.30.
Product
Woffice
Affected
up to 5.4.30
What to do
Affects up to 5.4.30. Update Woffice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Traveler: Missing AuthorizationCVE-2025-67917 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
Product
Traveler
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Jobify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67916 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue affects Jobify: from n/a through <= 4.3.0.
Product
Jobify
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update Jobify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Timetics: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-67915 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.
Product
Timetics
Affected
up to 1.0.46
What to do
Affects up to 1.0.46. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Aruba HiSpeed Cache: Missing AuthorizationCVE-2025-67913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Aruba HiSpeed Cache: from n/a through < 3.0.3.
Product
Aruba HiSpeed Cache
What to do
Update Aruba HiSpeed Cache to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Newsletters: Deserialization of Untrusted DataCVE-2025-67911 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.
Product
Newsletters
Affected
up to 4.11
What to do
Affects up to 4.11. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Famous - Responsive Image And Video Grid Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin famous_grid_image_and_video_gallery allows Reflected XSS.This issue affects Famous - Responsive Image And Video Grid Gallery WordPress Plugin: from n/a through <= 1.4.
Product
Famous - Responsive Image And Video Grid Gallery
Affected
up to 1.4
What to do
Affects up to 1.4. Update Famous - Responsive Image And Video Grid Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026CountDown With Image or Video Background: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27002 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup CountDown With Image or Video Background countdown-with-background allows Reflected XSS.This issue affects CountDown With Image or Video Background: from n/a through <= 1.5.
Product
CountDown With Image or Video Background
Affected
up to 1.5
What to do
Affects up to 1.5. Update CountDown With Image or Video Background to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Felan Framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23993 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <= 1.1.3.
Product
Felan Framework
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Felan Framework: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-23504 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.
Product
Felan Framework
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Workreap (theme's plugin): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22728 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.
Product
Workreap (theme's plugin)
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Workreap (theme's plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026WP Virtual Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22725 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Stored XSS.This issue affects WP Virtual Assistant: from n/a through <= 3.1.
Product
WP Virtual Assistant
Affected
up to 3.1
What to do
Affects up to 3.1. Update WP Virtual Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026WP Attractive Donations System - Easy Stripe & Paypal donations: Missing AuthorizationCVE-2025-22715 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.
Product
WP Attractive Donations System - Easy Stripe & Paypal donations
Affected
up to 1.25
What to do
Affects up to 1.25. Update WP Attractive Donations System - Easy Stripe & Paypal donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026WooCommerce Orders & Customers Exporter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22713 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.
Product
WooCommerce Orders & Customers Exporter
Affected
up to 5.4
What to do
Affects up to 5.4. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Typify: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22712 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a through <= 3.0.2.
Product
Typify
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Typify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Mitech: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22708 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through <= 2.3.4.
Product
Mitech
Affected
up to 2.3.4
What to do
Affects up to 2.3.4. Update Mitech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Moody: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22707 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.This issue affects Moody: from n/a through <= 2.7.3.
Product
Moody
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update Moody to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Atlas: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22509 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMRW-studio Atlas atlas allows PHP Local File Inclusion.This issue affects Atlas: from n/a through <= 2.1.0.
Product
Atlas
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Atlas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Navian: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-14431 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.This issue affects Navian: from n/a through <= 1.5.4.
Product
Navian
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Navian to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Brook: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-14430 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.
Product
Brook
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Brook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026AeroLand: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-14429 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through <= 1.6.6.
Product
AeroLand
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update AeroLand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Blockons: Missing AuthorizationCVE-2025-14360 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: from n/a through <= 1.2.19.
Product
Blockons
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update Blockons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Oshine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-14359 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local File Inclusion. This issue affects Oshine: from n/a before 7.3.0.
Product
Oshine
Fixed in
7.3.0
What to do
Update Oshine to 7.3.0 or newer.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026REHub Framework: Missing AuthorizationCVE-2025-14358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: from n/a through <= 19.9.5.
Product
REHub Framework
Affected
up to 19.9.5
What to do
Affects up to 19.9.5. Update REHub Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Real Estate Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-13504 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4.
Product
Real Estate Pro
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Real Estate Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026ListingHub: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-12551 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This issue affects ListingHub: from n/a through 1.2.6.
Product
ListingHub
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update ListingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026OchaHouse: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-12550 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse ochahouse allows PHP Local File Inclusion.This issue affects OchaHouse: from n/a through <= 2.2.8.
Product
OchaHouse
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update OchaHouse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Rozy - Flower Shop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-12549 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allows PHP Local File Inclusion.This issue affects Rozy - Flower Shop: from n/a through <= 1.2.25.
Product
Rozy - Flower Shop
Affected
up to 1.2.25
What to do
Affects up to 1.2.25. Update Rozy - Flower Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026Tutor LMS – eLearning and online course solution: Unauthorized access of dataCVE-2025-13679 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate order IDs and exfiltrate sensitive data (PII), such as student name, email address, phone number, and billing address.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026WP Cost Estimation: Arbitrary file uploads and deletionCVE-2019-25296 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to, and including, 9.642. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additionally, the attacker can also delete files on the server such as database configuration files, subsequently uploading their own database files.
Product
WP Cost Estimation
Affected
up to 9.642
What to do
Affects up to 9.642. Update WP Cost Estimation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com acunetix.com
Jan 7, 2026WP Cost Estimation: Upload Directory TraversalCVE-2019-25295 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the uploadFormFiles function. This allows attackers to overwrite any file with a whitelisted type on an affected site.
Product
WP Cost Estimation
Fixed in
9.660
What to do
Update WP Cost Estimation to 9.660 or newer.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jan 7, 2026DZS Video Gallery: Deserialization of Untrusted DataCVE-2025-47552 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through 12.37.
Product
DZS Video Gallery
Affected
up to 12.37
What to do
Affects up to 12.37. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026WidgetKit Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46494 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue affects WidgetKit Pro: from n/a through 1.13.1.
Product
WidgetKit Pro
Affected
up to 1.13.1
What to do
Affects up to 1.13.1. Update WidgetKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026The Plus Addons for Elementor Pro: Missing AuthorizationCVE-2025-46434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a through < 6.3.7.
Product
The Plus Addons for Elementor Pro
What to do
Update The Plus Addons for Elementor Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026WPCHURCH: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32303 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.
Product
WPCHURCH
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update WPCHURCH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026iPaymu Payment Gateway for WooCommerce: Missing AuthenticationCVE-2026-0656 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function. This is due to the plugin not validating webhook request authenticity through signature verification or origin checks. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid by sending crafted POST requests to the webhook endpoint without any payment occurring, as well as enumerate order IDs and obtain valid order keys via GET requests, exposing customer order PII including names, addresses, and purchased products.
Product
iPaymu Payment Gateway for WooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update iPaymu Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Oneline Lite: Missing AuthorizationCVE-2025-69344 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.
Product
Oneline Lite
Affected
up to 6.6
What to do
Affects up to 6.6. Update Oneline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.