Vulnerability database

41,188 results · page 248 of 824

• Dec 16, 2025Spoter for Elementor: Missing AuthorizationCVE-2025-66162 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spoter for Elementor: from n/a through <= 1.04.

  Product

  Spoter for Elementor

  Affected

  up to 1.04

  What to do

  Affects up to 1.04. Update Spoter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Grider for Elementor: Missing AuthorizationCVE-2025-66161 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grider for Elementor: from n/a through <= 1.0.8.

  Product

  Grider for Elementor

  Affected

  up to 1.0.8

  What to do

  Affects up to 1.0.8. Update Grider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Coder for Elementor: Missing AuthorizationCVE-2025-66147 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Coder for Elementor coder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coder for Elementor: from n/a through <= 1.0.13.

  Product

  Coder for Elementor

  Affected

  up to 1.0.13

  What to do

  Affects up to 1.0.13. Update Coder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025FileBird Pro: Missing AuthorizationCVE-2025-66134 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FileBird Pro: from n/a through <= 6.5.1.

  Product

  FileBird Pro

  Affected

  up to 6.5.1

  What to do

  Affects up to 6.5.1. Update FileBird Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66133 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.7.

  Product

  WP Cookie Notice for GDPR, CCPA & ePrivacy Consent

  Affected

  up to 4.0.7

  What to do

  Affects up to 4.0.7. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025FAPI Member: Authorization Bypass Through User-Controlled KeyCVE-2025-66132 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in FAPI Business s.r.o. FAPI Member fapi-member allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAPI Member: from n/a through <= 2.2.30.

  Product

  FAPI Member

  Affected

  up to 2.2.30

  What to do

  Affects up to 2.2.30. Update FAPI Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Yaad Sarig Payment Gateway For WC: Missing AuthorizationCVE-2025-66131 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yaad Sarig Payment Gateway For WC: from n/a through <= 2.2.11.

  Product

  Yaad Sarig Payment Gateway For WC

  Affected

  up to 2.2.11

  What to do

  Affects up to 2.2.11. Update Yaad Sarig Payment Gateway For WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WP Views Counter: Missing AuthorizationCVE-2025-66130 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Views Counter: from n/a through <= 2.1.2.

  Product

  WP Views Counter

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update WP Views Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Pochipp: Missing AuthorizationCVE-2025-66129 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through <= 1.18.0.

  Product

  Pochipp

  Affected

  up to 1.18.0

  What to do

  Affects up to 1.18.0. Update Pochipp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Sendinblue for WooCommerce: Missing AuthorizationCVE-2025-66128 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendinblue for WooCommerce: from n/a through <= 4.0.49.

  Product

  Sendinblue for WooCommerce

  Affected

  up to 4.0.49

  What to do

  Affects up to 4.0.49. Update Sendinblue for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Essential Real Estate: Missing AuthorizationCVE-2025-66127 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.

  Product

  Essential Real Estate

  Affected

  up to 5.3.2

  What to do

  Affects up to 5.3.2. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Fix Media Library: Insertion of Sensitive Information Into Sent DataCVE-2025-66126 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in wowpress.host Fix Media Library wow-media-library-fix allows Retrieve Embedded Sensitive Data.This issue affects Fix Media Library: from n/a through <= 2.0.

  Product

  Fix Media Library

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Fix Media Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Ultimate Auction: Insertion of Sensitive Information Into Sent DataCVE-2025-66125 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Insertion of Sensitive Information Into Sent Data vulnerability in Nitesh Ultimate Auction ultimate-auction allows Retrieve Embedded Sensitive Data.This issue affects Ultimate Auction : from n/a through <= 4.3.3.

  Product

  Ultimate Auction

  Affected

  up to 4.3.3

  What to do

  Affects up to 4.3.3. Update Ultimate Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Leaky Paywall: Missing AuthorizationCVE-2025-66124 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leaky Paywall: from n/a through <= 4.22.6.

  Product

  Leaky Paywall

  Affected

  up to 4.22.6

  What to do

  Affects up to 4.22.6. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Stylish Price List: Missing AuthorizationCVE-2025-66122 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Design Stylish Price List stylish-price-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stylish Price List: from n/a through <= 7.2.2.

  Product

  Stylish Price List

  Affected

  up to 7.2.2

  What to do

  Affects up to 7.2.2. Update Stylish Price List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025SiteGround Security: Missing AuthorizationCVE-2025-66121 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through <= 1.5.8.

  Product

  SiteGround Security

  Affected

  up to 1.5.8

  What to do

  Affects up to 1.5.8. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025CatFolders: Missing AuthorizationCVE-2025-66120 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CatFolders: from n/a through <= 2.5.3.

  Product

  CatFolders

  Affected

  up to 2.5.3

  What to do

  Affects up to 2.5.3. Update CatFolders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WP Compress for MainWP: Missing AuthorizationCVE-2025-64639 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.50.17.

  Product

  WP Compress for MainWP

  Affected

  up to 6.50.17

  What to do

  Affects up to 6.50.17. Update WP Compress for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025OnPay.io for WooCommerce: Missing AuthorizationCVE-2025-64638 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47.

  Product

  OnPay.io for WooCommerce

  Affected

  up to 1.0.47

  What to do

  Affects up to 1.0.47. Update OnPay.io for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Feeds for YouTube: Missing AuthorizationCVE-2025-64635 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Feeds for YouTube: from n/a through <= 2.4.0.

  Product

  Feeds for YouTube

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update Feeds for YouTube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Avada: Missing AuthorizationCVE-2025-64634 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through <= 7.13.2.

  Product

  Avada

  Affected

  up to 7.13.2

  What to do

  Affects up to 7.13.2. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Norebro Extra: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-64633 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This issue affects Norebro Extra: from n/a through <= 1.6.8.

  Product

  Norebro Extra

  Affected

  up to 1.6.8

  What to do

  Affects up to 1.6.8. Update Norebro Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Google XML Sitemaps: Missing AuthorizationCVE-2025-64632 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google XML Sitemaps: from n/a through <= 4.1.22.

  Product

  Google XML Sitemaps

  Affected

  up to 4.1.22

  What to do

  Affects up to 4.1.22. Update Google XML Sitemaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WCFM Marketplace: Missing AuthorizationCVE-2025-64631 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.

  Product

  WCFM Marketplace

  Affected

  up to 3.7.1

  What to do

  Affects up to 3.7.1. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Business Directory: Missing AuthorizationCVE-2025-64630 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.19.

  Product

  Business Directory

  Affected

  up to 6.4.19

  What to do

  Affects up to 6.4.19. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Health Check & Troubleshooting: Path Traversal: '.../...//'CVE-2025-64253 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Path Traversal: '.../...//' vulnerability in WordPress.org Health Check & Troubleshooting health-check allows Path Traversal.This issue affects Health Check & Troubleshooting: from n/a through <= 1.7.1.

  Product

  Health Check & Troubleshooting

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Health Check & Troubleshooting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Ultimate Learning Pro: Missing AuthorizationCVE-2025-64251 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Missing Authorization vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Learning Pro: from n/a through <= 3.9.3.

  Product

  Ultimate Learning Pro

  Affected

  up to 3.9.3

  What to do

  Affects up to 3.9.3. Update Ultimate Learning Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Directorist: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-64250 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wpWax Directorist directorist allows Phishing.This issue affects Directorist: from n/a through <= 8.6.6.

  Product

  Directorist

  Affected

  up to 8.6.6

  What to do

  Affects up to 8.6.6. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Protect WP Admin: Missing AuthorizationCVE-2025-64249 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protect WP Admin: from n/a through <= 4.1.

  Product

  Protect WP Admin

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update Protect WP Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Request a Quote: Missing AuthorizationCVE-2025-64248 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.

  Product

  Request a Quote

  Affected

  up to 2.5.3

  What to do

  Affects up to 2.5.3. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Read More & Accordion: Missing AuthorizationCVE-2025-64247 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through <= 3.5.5.1.

  Product

  Read More & Accordion

  Affected

  up to 3.5.5.1

  What to do

  Affects up to 3.5.5.1. Update Read More & Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Accessibility by AudioEye: Missing AuthorizationCVE-2025-64246 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through <= 1.0.49.

  Product

  Accessibility by AudioEye

  Affected

  up to 1.0.49

  What to do

  Affects up to 1.0.49. Update Accessibility by AudioEye to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Import external attachments: Missing AuthorizationCVE-2025-64245 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through <= 1.5.12.

  Product

  Import external attachments

  Affected

  up to 1.5.12

  What to do

  Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Restrict Elementor Widgets, Columns and Sections: Missing AuthorizationCVE-2025-64244 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Elementor Widgets, Columns and Sections: from n/a through <= 1.12.

  Product

  Restrict Elementor Widgets, Columns and Sections

  Affected

  up to 1.12

  What to do

  Affects up to 1.12. Update Restrict Elementor Widgets, Columns and Sections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Directory Pro: Missing AuthorizationCVE-2025-64243 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

  Product

  Directory Pro

  Affected

  up to 2.5.6

  What to do

  Affects up to 2.5.6. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Easy Property Listings: Missing AuthorizationCVE-2025-64242 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.22.

  Product

  Easy Property Listings

  Affected

  up to 3.5.22

  What to do

  Affects up to 3.5.22. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WP Coupons and Deals: Missing AuthorizationCVE-2025-64241 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Coupons and Deals: from n/a through <= 3.2.4.

  Product

  WP Coupons and Deals

  Affected

  up to 3.2.4

  What to do

  Affects up to 3.2.4. Update WP Coupons and Deals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Freshchat: Cross-Site Request Forgery (CSRF)CVE-2025-64240 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a through <= 2.3.4.

  Product

  Freshchat

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update Freshchat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025RTL Tester: Cross-Site Request Forgery (CSRF)CVE-2025-64239 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Yoav Farhi RTL Tester rtl-tester allows Cross Site Request Forgery.This issue affects RTL Tester: from n/a through <= 1.2.

  Product

  RTL Tester

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update RTL Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WPS Bidouille: Missing AuthorizationCVE-2025-64238 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through <= 1.33.1.

  Product

  WPS Bidouille

  Affected

  up to 1.33.1

  What to do

  Affects up to 1.33.1. Update WPS Bidouille to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Quick Interest Slider: Cross-Site Request Forgery (CSRF)CVE-2025-64237 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Graham Quick Interest Slider quick-interest-slider allows Cross Site Request Forgery.This issue affects Quick Interest Slider: from n/a through <= 3.1.5.

  Product

  Quick Interest Slider

  Affected

  up to 3.1.5

  What to do

  Affects up to 3.1.5. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Listify: Cross-Site Request Forgery (CSRF)CVE-2025-59009 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Listify listify allows Cross Site Request Forgery.This issue affects Listify: from n/a through <= 3.2.5.

  Product

  Listify

  Affected

  up to 3.2.5

  What to do

  Affects up to 3.2.5. Update Listify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Salient Core: Missing AuthorizationCVE-2025-59001 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8.

  Product

  Salient Core

  Affected

  up to 3.0.8

  What to do

  Affects up to 3.0.8. Update Salient Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WP Attractive Donations System - Easy Stripe & Paypal donations: Cross-Site Request Forgery (CSRF)CVE-2025-58999 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Cross Site Request Forgery.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.

  Product

  WP Attractive Donations System - Easy Stripe & Paypal donations

  Affected

  up to 1.25

  What to do

  Affects up to 1.25. Update WP Attractive Donations System - Easy Stripe & Paypal donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025CM On Demand Search And Replace: Missing AuthorizationCVE-2025-54045 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.5.

  Product

  CM On Demand Search And Replace

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025SKT Page Builder: Missing AuthorizationCVE-2025-54005 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SKT Page Builder: from n/a through <= 4.9.

  Product

  SKT Page Builder

  Affected

  up to 4.9

  What to do

  Affects up to 4.9. Update SKT Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025WCFM – Frontend Manager for WooCommerce: Missing AuthorizationCVE-2025-54004 · WordPress plugins & themes · reported by PatchstackLow 2.7

  Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through <= 6.7.24.

  Product

  WCFM – Frontend Manager for WooCommerce

  Affected

  up to 6.7.24

  What to do

  Affects up to 6.7.24. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Traveler Option Tree: Insertion of Sensitive Information Into Sent DataCVE-2025-49300 · WordPress plugins & themes · reported by PatchstackLow 2.7

  Insertion of Sensitive Information Into Sent Data vulnerability in Shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through 2.8.

  Product

  Traveler Option Tree

  Affected

  up to 2.8

  What to do

  Affects up to 2.8. Update Traveler Option Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 16, 2025Fancy Product Designer: Server-Side Request ForgeryCVE-2025-13231 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This makes it possible for unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.

  Product

  Fancy Product Designer

  Affected

  up to 6.4.8

  What to do

  Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com

• Dec 16, 2025Fancy Product Designer: Information Disclosure and PHAR DeserializationCVE-2025-13439 · WordPress plugins & themes · reported by WordfenceMedium 5.9

  The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.

  Product

  Fancy Product Designer

  Affected

  up to 6.4.8

  What to do

  Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.