Updated 23 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

366new WordPress flaws this week

393,576entries in the database

24,322 results · page 167 of 487

Dec 20, 2025Flex Store Users: Privilege EscalationCVE-2025-13619 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can be exploited with the 'fs_type' parameter if the Flex Store Seller plugin is also activated.
Product
Flex Store Users
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Flex Store Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Dec 20, 2025Pure WC Variation Swatches: Does not have an authorization checkCVE-2025-12820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.
Product
Pure WC Variation Swatches
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Pure WC Variation Swatches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Dec 19, 2025Image Photo Gallery Final Tiles Grid: Authorization bypassCVE-2025-14455 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete, modify, or clone galleries created by any user, including administrators.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information including user IDs, display names, and email addresses of all users on the site via the get_bank_accounts AJAX action. Passwords are not exposed.
Product
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program
Affected
up to 2.9.7.1
What to do
Affects up to 2.9.7.1. Update myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2025Appointment Booking Calendar — Simply Schedule Appointments Booking: Sensitive Information ExposureCVE-2025-13754 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.16. This is due to the plugin exposing its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication, which leaks plugin settings including staff names, business names, and configuration data that are not publicly displayed on the booking form. This makes it possible for unauthenticated attackers to extract private business configuration. In premium versions with integrations configured, this might also expose other sensitive data including API keys for external services.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.9.16
What to do
Affects up to 1.6.9.16. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 19, 2025Ocean Modal Window: Is vulnerable to Remote Code Execution via the modal display logicCVE-2025-13307 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under user-controlled conditions that Editors and Administrators can set (edit_pages capability). The conditions are then executed as part of an eval statement executed on every site page. This leads to remote code execution.
Product
Ocean Modal Window
Fixed in
2.3.3
What to do
Update Ocean Modal Window to 2.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Dec 18, 2025Post Grid and Gutenberg Blocks: Missing AuthorizationCVE-2025-66058 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.
Product
Post Grid and Gutenberg Blocks
Affected
up to 2.3.17
What to do
Affects up to 2.3.17. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64355 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12.
Product
JetElements For Elementor
Affected
up to 2.7.12
What to do
Affects up to 2.7.12. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Radius Blocks: Authorization Bypass Through User-Controlled KeyCVE-2025-64282 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Blocks: from n/a through <= 2.2.1.
Product
Radius Blocks
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Radius Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Tuturn: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-64236 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a before 3.6.
Product
Tuturn
Fixed in
3.6
What to do
Update Tuturn to 3.6 or newer.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Tuturn: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-64235 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows Path Traversal.This issue affects Tuturn: from n/a before 3.6.
Product
Tuturn
Fixed in
3.6
What to do
Update Tuturn to 3.6 or newer.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Post Grid and Gutenberg Blocks: Authorization Bypass Through User-Controlled KeyCVE-2025-63043 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.
Product
Post Grid and Gutenberg Blocks
Affected
up to 2.3.23
What to do
Affects up to 2.3.23. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Sermon Manager: Missing AuthorizationCVE-2025-63002 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sermon Manager: from n/a through <= 2.30.0.
Product
Sermon Manager
Affected
up to 2.30.0
What to do
Affects up to 2.30.0. Update Sermon Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP AI CoPilot: Insertion of Sensitive Information Into Sent DataCVE-2025-62998 · WordPress plugins & themes · reported by PatchstackMedium 5
Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.
Product
WP AI CoPilot
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update WP AI CoPilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Sparkle FSE: Missing AuthorizationCVE-2025-62961 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sparkle FSE: from n/a through <= 1.0.9.
Product
Sparkle FSE
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Sparkle FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Construction Light: Missing AuthorizationCVE-2025-62960 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Light: from n/a through <= 1.6.7.
Product
Construction Light
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update Construction Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Sweet Energy Efficiency: Unauthorized access, modification, and loss of dataCVE-2025-14618 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sweet Energy Efficiency plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on the 'sweet_energy_efficiency_action' AJAX handler in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with subscriber level access and above, to read, modify, and delete arbitrary graphs.
Product
Sweet Energy Efficiency
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Sweet Energy Efficiency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025Hummingbird Performance: Sensitive Information ExposureCVE-2025-14437 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
Product
Hummingbird Performance
Affected
up to 3.18.0
What to do
Affects up to 3.18.0. Update Hummingbird Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2025HUSKY – Products Filter Professional for WooCommerce: Insecure Direct Object ReferenceCVE-2025-13110 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.
Product
HUSKY – Products Filter Professional for WooCommerce
Affected
up to 1.3.7.3
What to do
Affects up to 1.3.7.3. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025Demo Importer Plus: Unauthorized modification of data, loss of data, and privilege escalationCVE-2025-14364 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full site reset, dropping all database tables except users/usermeta and re-running wp_install(), which also assigns the Administrator role to the attacking subscriber account.
Product
Demo Importer Plus
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Demo Importer Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2025Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery: Local File InclusionCVE-2025-13641 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote code execution if combined with arbitrary file upload capabilities.
Product
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Affected
up to 3.59.12
What to do
Affects up to 3.59.12. Update Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025Inset: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-6326 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Inset inset allows PHP Local File Inclusion.This issue affects Inset: from n/a through <= 1.18.0.
Product
Inset
Affected
up to 1.18.0
What to do
Affects up to 1.18.0. Update Inset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Easy Invoice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-6324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based XSS.This issue affects Easy Invoice: from n/a through <= 2.0.9.
Product
Easy Invoice
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP ERP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67546 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs WP ERP erp allows Retrieve Embedded Sensitive Data.This issue affects WP ERP: from n/a through <= 1.16.6.
Product
WP ERP
Affected
up to 1.16.6
What to do
Affects up to 1.16.6. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Hostel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66119 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.9.
Product
Hostel
Affected
up to 1.1.5.9
What to do
Affects up to 1.1.5.9. Update Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Sprout Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66118 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through <= 3.2.1.
Product
Sprout Clients
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Sprout Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Easy Form: Missing AuthorizationCVE-2025-66117 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form: from n/a through <= 2.7.8.
Product
Easy Form
Affected
up to 2.7.8
What to do
Affects up to 2.7.8. Update Easy Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Ultimate Member Widgets for Elementor: Insertion of Sensitive Information Into Sent DataCVE-2025-66116 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in UserElements Ultimate Member Widgets for Elementor ultimate-member-widgets-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Ultimate Member Widgets for Elementor: from n/a through <= 2.3.
Product
Ultimate Member Widgets for Elementor
Affected
up to 2.3
What to do
Affects up to 2.3. Update Ultimate Member Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Offload, AI & Optimize with Cloudflare Images: Missing AuthorizationCVE-2025-66104 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anton Vanyukov Offload, AI & Optimize with Cloudflare Images cf-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Offload, AI & Optimize with Cloudflare Images: from n/a through <= 1.9.5.
Product
Offload, AI & Optimize with Cloudflare Images
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update Offload, AI & Optimize with Cloudflare Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025FV Antispam: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66102 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Antispam fv-antispam allows Reflected XSS.This issue affects FV Antispam: from n/a through <= 2.7.
Product
FV Antispam
Affected
up to 2.7
What to do
Affects up to 2.7. Update FV Antispam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025RestroPress: Missing AuthorizationCVE-2025-66100 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.3.5.
Product
RestroPress
Affected
up to 3.2.3.5
What to do
Affects up to 3.2.3.5. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PropertyHive: Missing AuthorizationCVE-2025-66088 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.
Product
PropertyHive
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Hotel Booking Lite: Improper Control of Generation of Code ('Code Injection')CVE-2025-66078 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.
Product
Hotel Booking Lite
Affected
up to 5.2.3
What to do
Affects up to 5.2.3. Update Hotel Booking Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025wpForo Forum: Missing AuthorizationCVE-2025-66070 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.10.
Product
wpForo Forum
Affected
up to 2.4.10
What to do
Affects up to 2.4.10. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025InstaWP Connect: Missing AuthorizationCVE-2025-66068 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.1.9.
Product
InstaWP Connect
Affected
up to 0.1.1.9
What to do
Affects up to 0.1.1.9. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025LearnPress: Missing AuthorizationCVE-2025-66054 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.9.4.
Product
LearnPress
Affected
up to 4.2.9.4
What to do
Affects up to 4.2.9.4. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025ListingPro: Missing AuthorizationCVE-2025-64378 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10.
Product
ListingPro
What to do
Update ListingPro to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025ListingPro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64377 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10.
Product
ListingPro
What to do
Update ListingPro to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025ListingPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through < 2.9.10.
Product
ListingPro
What to do
Update ListingPro to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025WP Social Ninja: Missing AuthorizationCVE-2025-64375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mahmudul Hasan Arif WP Social Ninja wp-social-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Ninja: from n/a through <= 3.20.1.
Product
WP Social Ninja
Affected
up to 3.20.1
What to do
Affects up to 3.20.1. Update WP Social Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Traveler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64373 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Traveler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64372 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64371 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025All In One SEO Pack: Insertion of Sensitive Information Into Sent DataCVE-2025-64295 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1.
Product
All In One SEO Pack
Affected
up to 4.8.6.1
What to do
Affects up to 4.8.6.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Email marketing for WordPress by GetResponse Official: Missing AuthorizationCVE-2025-64273 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
Product
Email marketing for WordPress by GetResponse Official
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Email marketing for WordPress by GetResponse Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Email marketing for WordPress by GetResponse Official: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64272 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Retrieve Embedded Sensitive Data.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
Product
Email marketing for WordPress by GetResponse Official
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Email marketing for WordPress by GetResponse Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Masteriyo - LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64270 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects Masteriyo - LMS: from n/a through <= 2.0.3.
Product
Masteriyo - LMS
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Timetics: Missing AuthorizationCVE-2025-64268 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.44.
Product
Timetics
Affected
up to 1.0.44
What to do
Affects up to 1.0.44. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Booking and Rental Manager: Deserialization of Untrusted DataCVE-2025-64266 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.
Product
Booking and Rental Manager
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025ANAC XML Bandi di Gara: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64260 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Milesi ANAC XML Bandi di Gara avcp allows Reflected XSS.This issue affects ANAC XML Bandi di Gara: from n/a through <= 7.7.
Product
ANAC XML Bandi di Gara
Affected
up to 7.7
What to do
Affects up to 7.7. Update ANAC XML Bandi di Gara to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.