Vulnerability database

24,322 results · page 177 of 487

• Dec 9, 2025Contact Form by BestWebSoft: Missing AuthorizationCVE-2025-63056 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in bestwebsoft Contact Form by BestWebSoft contact-form-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by BestWebSoft: from n/a through <= 4.3.6.

  Product

  Contact Form by BestWebSoft

  Affected

  up to 4.3.6

  What to do

  Affects up to 4.3.6. Update Contact Form by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Master Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63055 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.

  Product

  Master Addons for Elementor

  Affected

  up to 2.0.9.9.4

  What to do

  Affects up to 2.0.9.9.4. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Quiz And Survey Master: Missing AuthorizationCVE-2025-63054 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.2.

  Product

  Quiz And Survey Master

  Affected

  up to 10.3.2

  What to do

  Affects up to 10.3.2. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025SimpLy Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63052 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Stored XSS.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.1.

  Product

  SimpLy Gallery

  Affected

  up to 3.3.2.1

  What to do

  Affects up to 3.3.2.1. Update SimpLy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025REHub Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63050 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam REHub Framework rehub-framework allows Stored XSS.This issue affects REHub Framework: from n/a through < 19.9.9.7.

  Product

  REHub Framework

  What to do

  Update REHub Framework to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ListingPro Lead Form: Missing AuthorizationCVE-2025-63049 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.

  Product

  ListingPro Lead Form

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update ListingPro Lead Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ListingPro Lead Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63048 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows DOM-Based XSS.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.

  Product

  ListingPro Lead Form

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update ListingPro Lead Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ListingPro: Missing AuthorizationCVE-2025-63047 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.

  Product

  ListingPro

  Affected

  up to 2.9.9

  What to do

  Affects up to 2.9.9. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ListingPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63046 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro-plugin allows DOM-Based XSS.This issue affects ListingPro: from n/a through <= 2.9.9.

  Product

  ListingPro

  Affected

  up to 2.9.9

  What to do

  Affects up to 2.9.9. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Master Slider Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63045 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider Pro masterslider allows DOM-Based XSS.This issue affects Master Slider Pro: from n/a through <= 3.7.12.

  Product

  Master Slider Pro

  Affected

  up to 3.7.12

  What to do

  Affects up to 3.7.12. Update Master Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Xpro Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63044 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows DOM-Based XSS.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.19.1.

  Product

  Xpro Elementor Addons

  Affected

  up to 1.4.19.1

  What to do

  Affects up to 1.4.19.1. Update Xpro Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Tutor LMS Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63042 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through <= 3.0.1.

  Product

  Tutor LMS Elementor Addons

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Ronneby Theme Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63037 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows DOM-Based XSS.This issue affects Ronneby Theme Core: from n/a through <= 1.5.68.

  Product

  Ronneby Theme Core

  Affected

  up to 1.5.68

  What to do

  Affects up to 1.5.68. Update Ronneby Theme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Ronneby Theme Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63036 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows PHP Local File Inclusion.This issue affects Ronneby Theme Core: from n/a through <= 1.5.68.

  Product

  Ronneby Theme Core

  Affected

  up to 1.5.68

  What to do

  Affects up to 1.5.68. Update Ronneby Theme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WPLMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63035 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

  Product

  WPLMS

  Affected

  up to 1.9.9.5.4

  What to do

  Affects up to 1.9.9.5.4. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Page View Count: Missing AuthorizationCVE-2025-63034 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Steve Truman Page View Count page-views-count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page View Count: from n/a through <= 2.9.0.

  Product

  Page View Count

  Affected

  up to 2.9.0

  What to do

  Affects up to 2.9.0. Update Page View Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Make Section & Column Clickable For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63033 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyadh Ahmed Make Section & Column Clickable For Elementor make-section-column-clickable-elementor allows Stored XSS.This issue affects Make Section & Column Clickable For Elementor: from n/a through <= 2.4.

  Product

  Make Section & Column Clickable For Elementor

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update Make Section & Column Clickable For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Traveler: Missing AuthorizationCVE-2025-63028 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.

  Product

  Traveler

  Affected

  up to 3.2.6

  What to do

  Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Xagio SEO: Missing AuthorizationCVE-2025-63025 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Xagio SEO Xagio SEO xagio-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xagio SEO: from n/a through <= 7.1.0.37.

  Product

  Xagio SEO

  Affected

  up to 7.1.0.37

  What to do

  Affects up to 7.1.0.37. Update Xagio SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-63024 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.3.1.

  Product

  Order Delivery Date for WooCommerce

  Affected

  up to 4.3.1

  What to do

  Affects up to 4.3.1. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Payment Gateway for PayPal on WooCommerce: Missing AuthorizationCVE-2025-63023 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Easy Payment Payment Gateway for PayPal on WooCommerce woo-paypal-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway for PayPal on WooCommerce: from n/a through <= 9.0.53.

  Product

  Payment Gateway for PayPal on WooCommerce

  Affected

  up to 9.0.53

  What to do

  Affects up to 9.0.53. Update Payment Gateway for PayPal on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WooCommerce Payment Gateway - Paysera: Missing AuthorizationCVE-2025-63015 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through <= 3.10.0.

  Product

  WooCommerce Payment Gateway - Paysera

  Affected

  up to 3.10.0

  What to do

  Affects up to 3.10.0. Update WooCommerce Payment Gateway - Paysera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP Hotel Booking: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63013 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedded Sensitive Data.This issue affects WP Hotel Booking: from n/a through <= 2.2.7.

  Product

  WP Hotel Booking

  Affected

  up to 2.2.7

  What to do

  Affects up to 2.2.7. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP Hotel Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63011 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows DOM-Based XSS.This issue affects WP Hotel Booking: from n/a through <= 2.2.8.

  Product

  WP Hotel Booking

  Affected

  up to 2.2.8

  What to do

  Affects up to 2.2.8. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP Google Analytics Events: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63009 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows Retrieve Embedded Sensitive Data.This issue affects WP Google Analytics Events: from n/a through <= 2.8.2.

  Product

  WP Google Analytics Events

  Affected

  up to 2.8.2

  What to do

  Affects up to 2.8.2. Update WP Google Analytics Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP ERP: Missing AuthorizationCVE-2025-63008 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.16.7.

  Product

  WP ERP

  Affected

  up to 1.16.7

  What to do

  Affects up to 1.16.7. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025EventPrime: Insertion of Sensitive Information Into Sent DataCVE-2025-63007 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.4.1.

  Product

  EventPrime

  Affected

  up to 4.2.4.1

  What to do

  Affects up to 4.2.4.1. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025EventPrime: Missing AuthorizationCVE-2025-63006 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.4.1.

  Product

  EventPrime

  Affected

  up to 4.2.4.1

  What to do

  Affects up to 4.2.4.1. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025North - Required: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63003 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North - Required Plugin north-plugin allows PHP Local File Inclusion.This issue affects North - Required Plugin: from n/a through <= 1.4.2.

  Product

  North - Required

  Affected

  up to 1.4.2

  What to do

  Affects up to 1.4.2. Update North - Required to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Litho Addons: Missing AuthorizationCVE-2025-62999 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through <= 3.5.

  Product

  Litho Addons

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update Litho Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP EasyCart: Insertion of Sensitive Information Into Sent DataCVE-2025-62997 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Retrieve Embedded Sensitive Data.This issue affects WP EasyCart: from n/a through <= 5.8.11.

  Product

  WP EasyCart

  Affected

  up to 5.8.11

  What to do

  Affects up to 5.8.11. Update WP EasyCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Custom Layouts – Post + Product grids made easy: Missing AuthorizationCVE-2025-62996 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Code Amp Custom Layouts – Post + Product grids made easy custom-layouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Layouts – Post + Product grids made easy: from n/a through <= 1.4.12.

  Product

  Custom Layouts – Post + Product grids made easy

  Affected

  up to 1.4.12

  What to do

  Affects up to 1.4.12. Update Custom Layouts – Post + Product grids made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025MultiParcels Shipping For WooCommerce: Missing AuthorizationCVE-2025-62995 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through <= 1.30.12.

  Product

  MultiParcels Shipping For WooCommerce

  Affected

  up to 1.30.12

  What to do

  Affects up to 1.30.12. Update MultiParcels Shipping For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP AI CoPilot: Insertion of Sensitive Information Into Sent DataCVE-2025-62994 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.

  Product

  WP AI CoPilot

  Affected

  up to 1.2.7

  What to do

  Affects up to 1.2.7. Update WP AI CoPilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Notification for Telegram: Missing AuthorizationCVE-2025-62993 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through <= 3.5.1.

  Product

  Notification for Telegram

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP Flashy Marketing Automation: Cross-Site Request Forgery (CSRF)CVE-2025-62873 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Flashyapp WP Flashy Marketing Automation wp-flashy-marketing-automation allows Cross Site Request Forgery.This issue affects WP Flashy Marketing Automation: from n/a through <= 2.0.8.

  Product

  WP Flashy Marketing Automation

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update WP Flashy Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Eupago Gateway For Woocommerce: Missing AuthorizationCVE-2025-62870 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Eupago Eupago Gateway For Woocommerce eupago-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eupago Gateway For Woocommerce: from n/a through <= 4.7.1.

  Product

  Eupago Gateway For Woocommerce

  Affected

  up to 4.7.1

  What to do

  Affects up to 4.7.1. Update Eupago Gateway For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Gravitec.net – Web Push Notifications: Missing AuthorizationCVE-2025-62869 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Gravitec.net - Web Push Notifications Gravitec.net – Web Push Notifications gravitec-net-web-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gravitec.net – Web Push Notifications: from n/a through <= 2.9.17.

  Product

  Gravitec.net – Web Push Notifications

  Affected

  up to 2.9.17

  What to do

  Affects up to 2.9.17. Update Gravitec.net – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Ergonet Cache: Missing AuthorizationCVE-2025-62867 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ergonet Cache: from n/a through <= 1.0.13.

  Product

  Ergonet Cache

  Affected

  up to 1.0.13

  What to do

  Affects up to 1.0.13. Update Ergonet Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Post Cloner: Missing AuthorizationCVE-2025-62865 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Evan Herman Post Cloner post-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Cloner: from n/a through <= 1.0.0.

  Product

  Post Cloner

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Post Cloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025WP-CRM System: Missing AuthorizationCVE-2025-62740 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.6.

  Product

  WP-CRM System

  Affected

  up to 3.4.6

  What to do

  Affects up to 3.4.6. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Formstack Online Forms: Missing AuthorizationCVE-2025-62738 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in mmattax Formstack Online Forms formstack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formstack Online Forms: from n/a through <= 2.0.2.

  Product

  Formstack Online Forms

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update Formstack Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Image Cleanup: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62737 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in opicron Image Cleanup image-cleanup allows Retrieve Embedded Sensitive Data.This issue affects Image Cleanup: from n/a through <= 1.9.2.

  Product

  Image Cleanup

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Image Cleanup: Missing AuthorizationCVE-2025-62736 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in opicron Image Cleanup image-cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Cleanup: from n/a through <= 1.9.2.

  Product

  Image Cleanup

  Affected

  up to 1.9.2

  What to do

  Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025User Spam Remover: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62735 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Joel User Spam Remover user-spam-remover allows Retrieve Embedded Sensitive Data.This issue affects User Spam Remover: from n/a through <= 1.1.

  Product

  User Spam Remover

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update User Spam Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Quick Interest Slider: Missing AuthorizationCVE-2025-62153 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Graham Quick Interest Slider quick-interest-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Interest Slider: from n/a through <= 3.1.7.

  Product

  Quick Interest Slider

  Affected

  up to 3.1.7

  What to do

  Affects up to 3.1.7. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ConveyThis: Missing AuthorizationCVE-2025-62152 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.2.

  Product

  ConveyThis

  Affected

  up to 269.2

  What to do

  Affects up to 269.2. Update ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Virtuaria PagBank / PagSeguro para Woocommerce: Missing AuthorizationCVE-2025-62151 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Virtuaria Virtuaria PagBank / PagSeguro para Woocommerce virtuaria-pagseguro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virtuaria PagBank / PagSeguro para Woocommerce: from n/a through <= 3.6.3.

  Product

  Virtuaria PagBank / PagSeguro para Woocommerce

  Affected

  up to 3.6.3

  What to do

  Affects up to 3.6.3. Update Virtuaria PagBank / PagSeguro para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025Geo Controller: Insertion of Sensitive Information Into Sent DataCVE-2025-62109 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.

  Product

  Geo Controller

  Affected

  up to 8.9.4

  What to do

  Affects up to 8.9.4. Update Geo Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 9, 2025ThemeRain Core: Missing AuthorizationCVE-2025-62100 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in themerain ThemeRain Core themerain-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeRain Core: from n/a through <= 1.1.9.

  Product

  ThemeRain Core

  Affected

  up to 1.1.9

  What to do

  Affects up to 1.1.9. Update ThemeRain Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.