Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

354new WordPress flaws this week

393,576entries in the database

24,322 results · page 175 of 487

Dec 9, 2025TrueBooker: Missing AuthorizationCVE-2025-67581 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.0.
Product
TrueBooker
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Constant Contact + WooCommerce: Missing AuthorizationCVE-2025-67580 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= 2.4.1.
Product
Constant Contact + WooCommerce
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Constant Contact + WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025User Extra Fields: Missing AuthorizationCVE-2025-67579 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.
Product
User Extra Fields
Affected
up to 16.8
What to do
Affects up to 16.8. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP Email Capture: Missing AuthorizationCVE-2025-67578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Email Capture: from n/a through <= 3.12.4.
Product
WP Email Capture
Affected
up to 3.12.4
What to do
Affects up to 3.12.4. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Easy Form Builder: Missing AuthorizationCVE-2025-67577 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.
Product
Easy Form Builder
Affected
up to 3.8.20
What to do
Affects up to 3.8.20. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Simple Link Directory: Missing AuthorizationCVE-2025-67576 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through <= 8.8.3.
Product
Simple Link Directory
Affected
up to 8.8.3
What to do
Affects up to 8.8.3. Update Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Sitewide Notice WP: Missing AuthorizationCVE-2025-67575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sitewide Notice WP: from n/a through <= 2.4.1.
Product
Sitewide Notice WP
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Sitewide Notice WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2025-67574 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.30.
Product
Booking calendar, Appointment Booking System
Affected
up to 3.2.30
What to do
Affects up to 3.2.30. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Sailing: Missing AuthorizationCVE-2025-67573 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sailing: from n/a through < 4.4.6.
Product
Sailing
What to do
Update Sailing to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025PenNews: Missing AuthorizationCVE-2025-67572 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PenNews: from n/a through < 6.7.4.
Product
PenNews
What to do
Update PenNews to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WPFunnels: Missing AuthorizationCVE-2025-67571 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.
Product
WPFunnels
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WPForms Google Sheet Connector: Missing AuthorizationCVE-2025-67570 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.
Product
WPForms Google Sheet Connector
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025AdForest: Missing AuthorizationCVE-2025-67569 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdForest: from n/a through <= 6.0.11.
Product
AdForest
Affected
up to 6.0.11
What to do
Affects up to 6.0.11. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Basel: Missing AuthorizationCVE-2025-67568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: from n/a through <= 5.9.1.
Product
Basel
Affected
up to 5.9.1
What to do
Affects up to 5.9.1. Update Basel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Sober: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67567 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This issue affects Sober: from n/a through <= 3.5.11.
Product
Sober
Affected
up to 3.5.11
What to do
Affects up to 3.5.11. Update Sober to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Woffice Core: Missing AuthorizationCVE-2025-67566 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.
Product
Woffice Core
Affected
up to 5.4.30
What to do
Affects up to 5.4.30. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Rehub: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67565 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.
Product
Rehub
Affected
up to 19.9.9.1
What to do
Affects up to 19.9.9.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Pixel Manager for WooCommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects Pixel Manager for WooCommerce: from n/a through <= 1.51.1.
Product
Pixel Manager for WooCommerce
Affected
up to 1.51.1
What to do
Affects up to 1.51.1. Update Pixel Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Post SMTP: Missing AuthorizationCVE-2025-67563 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 3.6.1.
Product
Post SMTP
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Image Caption Hover Pro: Missing AuthorizationCVE-2025-67562 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Caption Hover Pro: from n/a through < 20.0.
Product
Image Caption Hover Pro
What to do
Update Image Caption Hover Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Debug Log Viewer: Missing AuthorizationCVE-2025-67561 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Oleksandr Lysyi Debug Log Viewer debug-log-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Log Viewer: from n/a through <= 2.0.3.
Product
Debug Log Viewer
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Debug Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Listdom: Missing AuthorizationCVE-2025-67560 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listdom: from n/a through <= 5.0.1.
Product
Listdom
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update Listdom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Missing AuthorizationCVE-2025-67559 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Rencontre: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67558 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS.This issue affects Rencontre: from n/a through <= 3.13.7.
Product
Rencontre
Affected
up to 3.13.7
What to do
Affects up to 3.13.7. Update Rencontre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP eBay Product Feeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67557 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Stored XSS.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.9.
Product
WP eBay Product Feeds
Affected
up to 3.4.9
What to do
Affects up to 3.4.9. Update WP eBay Product Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Advanced FAQ Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67556 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows Stored XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.
Product
Advanced FAQ Manager
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025UseStrict's Calendly Embedder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67555 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in useStrict UseStrict's Calendly Embedder cal-embedder-lite allows Stored XSS.This issue affects UseStrict's Calendly Embedder: from n/a through <= 1.1.7.2.
Product
UseStrict's Calendly Embedder
Affected
up to 1.1.7.2
What to do
Affects up to 1.1.7.2. Update UseStrict's Calendly Embedder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Cookie Notice & Compliance for GDPR / CCPA: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67554 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Humanityco Cookie Notice & Compliance for GDPR / CCPA cookie-notice allows Stored XSS.This issue affects Cookie Notice & Compliance for GDPR / CCPA: from n/a through <= 2.5.8.
Product
Cookie Notice & Compliance for GDPR / CCPA
Affected
up to 2.5.8
What to do
Affects up to 2.5.8. Update Cookie Notice & Compliance for GDPR / CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Advanced FAQ Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67553 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows DOM-Based XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.
Product
Advanced FAQ Manager
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Walker Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67552 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WalkerWP Walker Core walker-core allows DOM-Based XSS.This issue affects Walker Core: from n/a through <= 1.3.17.
Product
Walker Core
Affected
up to 1.3.17
What to do
Affects up to 1.3.17. Update Walker Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Wappointment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wappointment team Wappointment wappointment allows Stored XSS.This issue affects Wappointment: from n/a through <= 2.6.9.
Product
Wappointment
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update Wappointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Donation Thermometer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67550 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through <= 2.2.6.
Product
Donation Thermometer
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update Donation Thermometer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025oik: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67549 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows DOM-Based XSS.This issue affects oik: from n/a through <= 4.15.3.
Product
oik
Affected
up to 4.15.3
What to do
Affects up to 4.15.3. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP Delicious: Missing AuthorizationCVE-2025-67548 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.1.
Product
WP Delicious
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025FireBox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67545 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS.This issue affects FireBox: from n/a through <= 3.1.0-free.
Product
FireBox
Affected
up to 3.1.0-free
What to do
Affects up to 3.1.0-free. Update FireBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Shopkeeper Extender: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67544 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Shopkeeper Extender shopkeeper-extender allows Stored XSS.This issue affects Shopkeeper Extender: from n/a through < 7.0.
Product
Shopkeeper Extender
What to do
Update Shopkeeper Extender to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Essential Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67543 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Essential Widgets essential-widgets allows Stored XSS.This issue affects Essential Widgets: from n/a through <= 2.2.2.
Product
Essential Widgets
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Essential Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Multi-Step Checkout for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67542 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SilkyPress Multi-Step Checkout for WooCommerce wp-multi-step-checkout allows DOM-Based XSS.This issue affects Multi-Step Checkout for WooCommerce: from n/a through <= 2.33.
Product
Multi-Step Checkout for WooCommerce
Affected
up to 2.33
What to do
Affects up to 2.33. Update Multi-Step Checkout for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP-ShowHide: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-ShowHide wp-showhide allows Stored XSS.This issue affects WP-ShowHide: from n/a through <= 1.05.
Product
WP-ShowHide
Affected
up to 1.05
What to do
Affects up to 1.05. Update WP-ShowHide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Animation Addons for Elementor: Missing AuthorizationCVE-2025-67540 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animation Addons for Elementor: from n/a through <= 2.4.5.
Product
Animation Addons for Elementor
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update Animation Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Select Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Select Core select-core allows DOM-Based XSS.This issue affects Select Core: from n/a through < 2.6.
Product
Select Core
What to do
Update Select Core to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025JNews Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67538 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews Gallery jnews-gallery allows Stored XSS.This issue affects JNews Gallery: from n/a through < 12.0.1.
Product
JNews Gallery
What to do
Update JNews Gallery to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025ThirstyAffiliates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67537 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Stored XSS.This issue affects ThirstyAffiliates: from n/a through <= 3.11.8.
Product
ThirstyAffiliates
Affected
up to 3.11.8
What to do
Affects up to 3.11.8. Update ThirstyAffiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025LearnPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XSS.This issue affects LearnPress: from n/a through <= 4.2.9.4.
Product
LearnPress
Affected
up to 4.2.9.4
What to do
Affects up to 4.2.9.4. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP Maps: Deserialization of Untrusted DataCVE-2025-67535 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.
Product
WP Maps
Affected
up to 4.8.6
What to do
Affects up to 4.8.6. Update WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Themify Portfolio Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67533 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Portfolio Post themify-portfolio-post allows Stored XSS.This issue affects Themify Portfolio Post: from n/a through <= 1.3.0.
Product
Themify Portfolio Post
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Themify Portfolio Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Hara: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67532 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.17.
Product
Hara
Affected
up to 1.2.17
What to do
Affects up to 1.2.17. Update Hara to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Turitor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67531 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in trippleS Turitor turitor allows PHP Local File Inclusion.This issue affects Turitor: from n/a through < 1.5.3.
Product
Turitor
What to do
Update Turitor to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Besa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67530 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.15.
Product
Besa
Affected
up to 2.3.15
What to do
Affects up to 2.3.15. Update Besa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Fashion: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67529 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opal_WP Fashion fashion2 allows PHP Local File Inclusion.This issue affects Fashion: from n/a through < 5.3.0.
Product
Fashion
What to do
Update Fashion to the newest version.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.