Vulnerability database

41,188 results · page 234 of 824

• Dec 31, 2025Conformer for Elementor: Missing AuthorizationCVE-2025-66148 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conformer for Elementor: from n/a through <= 1.0.7.

  Product

  Conformer for Elementor

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Conformer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Logger for Elementor: Missing AuthorizationCVE-2025-66146 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logger for Elementor: from n/a through <= 1.0.9.

  Product

  Logger for Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Logger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Worker for WPBakery: Missing AuthorizationCVE-2025-66145 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Worker for WPBakery worker-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for WPBakery: from n/a through <= 1.1.1.

  Product

  Worker for WPBakery

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Worker for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Worker for Elementor: Missing AuthorizationCVE-2025-66144 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for Elementor: from n/a through <= 1.0.10.

  Product

  Worker for Elementor

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Worker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Sala: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52739 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Sala allows Reflected XSS.This issue affects Sala: from n/a through 1.1.3.

  Product

  Sala

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Sala to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50053 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.

  Product

  Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App

  Affected

  up to 0.8.8.8

  What to do

  Affects up to 0.8.8.8. Update Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025ZoomSounds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47566 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomSounds allows Reflected XSS.This issue affects ZoomSounds: from n/a through 6.91.

  Product

  ZoomSounds

  Affected

  up to 6.91

  What to do

  Affects up to 6.91. Update ZoomSounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Bloggie: Cross-Site Request Forgery (CSRF)CVE-2025-31054 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Themefy Bloggie allows Reflected XSS.This issue affects Bloggie: from n/a through 2.0.8.

  Product

  Bloggie

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Bloggie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30628 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.

  Product

  Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Pro Bulk Watermark Plugin for: Path Traversal: '.../...//'CVE-2025-28973 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through <= 2.0.

  Product

  Pro Bulk Watermark Plugin for

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Pro Bulk Watermark Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Mediabay - WordPress Media Library Folders: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28949 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.

  Product

  Mediabay - WordPress Media Library Folders

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025ZD Scribd iPaper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23757 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proloy Chakroborty ZD Scribd iPaper zd-scribd-ipaper allows Reflected XSS.This issue affects ZD Scribd iPaper: from n/a through <= 1.0.

  Product

  ZD Scribd iPaper

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update ZD Scribd iPaper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025ZhinaTwitterWidget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23719 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zckevin ZhinaTwitterWidget zhina-twitter-widget allows Reflected XSS.This issue affects ZhinaTwitterWidget: from n/a through <= 1.0.

  Product

  ZhinaTwitterWidget

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update ZhinaTwitterWidget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025En Masse: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23707 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matamko En Masse en-masse-wp allows Reflected XSS.This issue affects En Masse: from n/a through <= 1.0.

  Product

  En Masse

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update En Masse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Zielke Design Project Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23705 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry Zielke Zielke Design Project Gallery zielke-design-project-gallery allows Reflected XSS.This issue affects Zielke Design Project Gallery: from n/a through <= 2.5.0.

  Product

  Zielke Design Project Gallery

  Affected

  up to 2.5.0

  What to do

  Affects up to 2.5.0. Update Zielke Design Project Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025custom-post-edit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23667 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christopher Churchill custom-post-edit front-end-post-edit allows Reflected XSS.This issue affects custom-post-edit: from n/a through <= 1.0.4.

  Product

  custom-post-edit

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update custom-post-edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Headinger for Elementor: Missing AuthorizationCVE-2025-66153 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headinger for Elementor: from n/a through <= 1.1.4.

  Product

  Headinger for Elementor

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Headinger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Criptopayer for Elementor: Missing AuthorizationCVE-2025-66152 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Criptopayer for Elementor: from n/a through <= 1.0.1.

  Product

  Criptopayer for Elementor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Criptopayer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Countdowner for Elementor: Missing AuthorizationCVE-2025-66151 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Countdowner for Elementor: from n/a through <= 1.0.4.

  Product

  Countdowner for Elementor

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Countdowner for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Appender: Missing AuthorizationCVE-2025-66150 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appender: from n/a through <= 1.1.1.

  Product

  Appender

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Appender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025UnGrabber: Missing AuthorizationCVE-2025-66149 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove UnGrabber ungrabber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnGrabber: from n/a through <= 3.1.3.

  Product

  UnGrabber

  Affected

  up to 3.1.3

  What to do

  Affects up to 3.1.3. Update UnGrabber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Cooked: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62989 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.

  Product

  Cooked

  Affected

  up to 1.11.3

  What to do

  Affects up to 1.11.3. Update Cooked to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Behance Portfolio Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59135 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.

  Product

  Behance Portfolio Manager

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Accessibility Press: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49355 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ikaes Accessibility Press ilogic-accessibility allows Stored XSS.This issue affects Accessibility Press: from n/a through <= 1.0.2.

  Product

  Accessibility Press

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Accessibility Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Dashboard Beacon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49337 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in janhenckens Dashboard Beacon wp-dashboard-beacon allows Stored XSS.This issue affects Dashboard Beacon: from n/a through <= 1.2.0.

  Product

  Dashboard Beacon

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Dashboard Beacon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025LIVE TV: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23608 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omar Mohamed Mohamoud LIVE TV live-tv allows Reflected XSS.This issue affects LIVE TV: from n/a through <= 1.2.

  Product

  LIVE TV

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update LIVE TV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Select Graphist for Elementor Graphist for Elementor: Missing AuthorizationCVE-2025-66160 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Select Graphist for Elementor Graphist for Elementor graphist-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Select Graphist for Elementor Graphist for Elementor: from n/a through <= 1.2.10.

  Product

  Select Graphist for Elementor Graphist for Elementor

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update Select Graphist for Elementor Graphist for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Walker for Elementor: Missing AuthorizationCVE-2025-66159 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Walker for Elementor walker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Walker for Elementor: from n/a through <= 1.1.6.

  Product

  Walker for Elementor

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Walker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Gmaper for Elementor: Missing AuthorizationCVE-2025-66158 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmaper for Elementor: from n/a through <= 1.0.9.

  Product

  Gmaper for Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Gmaper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Sliper for Elementor: Missing AuthorizationCVE-2025-66157 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Sliper for Elementor sliper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sliper for Elementor: from n/a through <= 1.0.10.

  Product

  Sliper for Elementor

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Sliper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Watcher for Elementor: Missing AuthorizationCVE-2025-66156 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through <= 1.0.9.

  Product

  Watcher for Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Watcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Questionar for Elementor: Missing AuthorizationCVE-2025-66155 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Questionar for Elementor questionar-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Questionar for Elementor: from n/a through <= 1.1.7.

  Product

  Questionar for Elementor

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Questionar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Couponer for Elementor: Missing AuthorizationCVE-2025-66154 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Couponer for Elementor: from n/a through <= 1.1.7.

  Product

  Couponer for Elementor

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Couponer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025WP Custom Admin Interface: Missing AuthorizationCVE-2025-63038 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.40.

  Product

  WP Custom Admin Interface

  Affected

  up to 7.40

  What to do

  Affects up to 7.40. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Valenti Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63021 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based XSS.This issue affects Valenti Engine: from n/a through <= 1.0.3.

  Product

  Valenti Engine

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Valenti Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025AnyComment: Missing AuthorizationCVE-2025-62874 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Alexander AnyComment anycomment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyComment: from n/a through <= 0.3.6.

  Product

  AnyComment

  Affected

  up to 0.3.6

  What to do

  Affects up to 0.3.6. Update AnyComment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025WP Gmail SMTP: Cross-Site Request Forgery (CSRF)CVE-2025-62123 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.

  Product

  WP Gmail SMTP

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update WP Gmail SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Hide: Missing AuthorizationCVE-2025-62115 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide Plugins: from n/a through <= 1.0.4.

  Product

  Hide

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Co-marquage service-public.fr: Cross-Site Request Forgery (CSRF)CVE-2025-62113 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in emendo_seb Co-marquage service-public.fr co-marquage-service-public allows Cross Site Request Forgery.This issue affects Co-marquage service-public.fr: from n/a through <= 0.5.77.

  Product

  Co-marquage service-public.fr

  Affected

  up to 0.5.77

  What to do

  Affects up to 0.5.77. Update Co-marquage service-public.fr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Pardakht Delkhah: Cross-Site Request Forgery (CSRF)CVE-2025-62101 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Omid Shamloo Pardakht Delkhah pardakht-delkhah allows Cross Site Request Forgery.This issue affects Pardakht Delkhah: from n/a through <= 3.0.0.

  Product

  Pardakht Delkhah

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Pardakht Delkhah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Signature Add-On for Gravity Forms: Missing AuthorizationCVE-2025-62099 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Signature Add-On for Gravity Forms: from n/a through <= 1.8.6.

  Product

  Signature Add-On for Gravity Forms

  Affected

  up to 1.8.6

  What to do

  Affects up to 1.8.6. Update Signature Add-On for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025WordPress & WooCommerce Scraper Plugin, Import Data from Any Site: Server-Side Request Forgery (SSRF)CVE-2025-62088 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site wp_scraper allows Server Side Request Forgery.This issue affects WordPress & WooCommerce Scraper Plugin, Import Data from Any Site: from n/a through <= 1.0.7.

  Product

  WordPress & WooCommerce Scraper Plugin, Import Data from Any Site

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update WordPress & WooCommerce Scraper Plugin, Import Data from Any Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025BoomDevs WordPress Coming Soon: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62083 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs allows Retrieve Embedded Sensitive Data.This issue affects BoomDevs WordPress Coming Soon: from n/a through <= 1.0.4.

  Product

  BoomDevs WordPress Coming Soon

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update BoomDevs WordPress Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Easy Upload Files During Checkout: Missing AuthorizationCVE-2025-62078 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Upload Files During Checkout: from n/a through <= 3.0.0.

  Product

  Easy Upload Files During Checkout

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Easy Upload Files During Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Genemy: Server-Side Request Forgery (SSRF)CVE-2025-59138 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Server-Side Request Forgery (SSRF) vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from n/a through <= 1.6.6.

  Product

  Genemy

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update Genemy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Order Cancellation & Returns for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2025-49352 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.

  Product

  Order Cancellation & Returns for WooCommerce

  Affected

  up to 1.1.11

  What to do

  Affects up to 1.1.11. Update Order Cancellation & Returns for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Direct Payments WP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-49340 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2.

  Product

  Direct Payments WP

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Direct Payments WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Direct Payments WP: Missing AuthorizationCVE-2025-49339 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Digages Direct Payments WP direct-payments-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Direct Payments WP: from n/a through <= 1.3.2.

  Product

  Direct Payments WP

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update Direct Payments WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Post Snippets: Cross-Site Request Forgery (CSRF)CVE-2025-63040 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Post Snippets post-snippets allows Cross Site Request Forgery.This issue affects Post Snippets: from n/a through <= 4.0.11.

  Product

  Post Snippets

  Affected

  up to 4.0.11

  What to do

  Affects up to 4.0.11. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Gmedia Photo Gallery: Cross-Site Request Forgery (CSRF)CVE-2025-63014 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Cross Site Request Forgery.This issue affects Gmedia Photo Gallery: from n/a through <= 1.25.0.

  Product

  Gmedia Photo Gallery

  Affected

  up to 1.25.0

  What to do

  Affects up to 1.25.0. Update Gmedia Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.