Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,274 results · page 27 of 86

Jan 8, 2026Blockons: Missing AuthorizationCVE-2025-14360 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: from n/a through <= 1.2.19.
Product
Blockons
Affected
up to 1.2.19
What to do
Affects up to 1.2.19. Update Blockons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 8, 2026REHub Framework: Missing AuthorizationCVE-2025-14358 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: from n/a through <= 19.9.5.
Product
REHub Framework
Affected
up to 19.9.5
What to do
Affects up to 19.9.5. Update REHub Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026The Plus Addons for Elementor Pro: Missing AuthorizationCVE-2025-46434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a through < 6.3.7.
Product
The Plus Addons for Elementor Pro
What to do
Update The Plus Addons for Elementor Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026iPaymu Payment Gateway for WooCommerce: Missing AuthenticationCVE-2026-0656 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function. This is due to the plugin not validating webhook request authenticity through signature verification or origin checks. This makes it possible for unauthenticated attackers to mark WooCommerce orders as paid by sending crafted POST requests to the webhook endpoint without any payment occurring, as well as enumerate order IDs and obtain valid order keys via GET requests, exposing customer order PII including names, addresses, and purchased products.
Product
iPaymu Payment Gateway for WooCommerce
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update iPaymu Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Oneline Lite: Missing AuthorizationCVE-2025-69344 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.
Product
Oneline Lite
Affected
up to 6.6
What to do
Affects up to 6.6. Update Oneline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026JetEngine: Missing AuthorizationCVE-2025-69333 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.
Product
JetEngine
Affected
up to 3.8.1.1
What to do
Affects up to 3.8.1.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium: Do not sanitize and escape a parameter before using it in a SQL statementCVE-2025-14719 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks
Product
Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium
Fixed in
4.26.0
What to do
Update Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium to 4.26.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 7, 2026Quote Comments: Missing AuthorizationCVE-2025-14370 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorization checks in the quotecomments_add_admin function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options via the 'action' parameter.
Product
Quote Comments
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Quote Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Missing AuthorizationCVE-2025-13722 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.7. This is due to missing capability checks on the `fluentform_ai_create_form` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary forms via the publicly exposed AI builder.
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 6, 2026Breeze: Missing AuthorizationCVE-2025-69364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.
Product
Breeze
Affected
up to 2.2.21
What to do
Affects up to 2.2.21. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Responsive Addons for Elementor: Missing AuthorizationCVE-2025-69363 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Addons for Elementor: from n/a through <= 2.0.8.
Product
Responsive Addons for Elementor
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Post Expirator: Missing AuthorizationCVE-2025-69361 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through <= 4.9.3.
Product
Post Expirator
Affected
up to 4.9.3
What to do
Affects up to 4.9.3. Update Post Expirator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Creator LMS: Missing AuthorizationCVE-2025-69359 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.
Product
Creator LMS
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Creator LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Tickera: Missing AuthorizationCVE-2025-69355 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.4.
Product
Tickera
Affected
up to 3.5.6.4
What to do
Affects up to 3.5.6.4. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Better Business Reviews: Missing AuthorizationCVE-2025-69354 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.
Product
Better Business Reviews
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update Better Business Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Proxy & VPN Blocker: Missing AuthorizationCVE-2025-69353 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Proxy & VPN Blocker: from n/a through <= 3.5.3.
Product
Proxy & VPN Blocker
Affected
up to 3.5.3
What to do
Affects up to 3.5.3. Update Proxy & VPN Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026The Events Calendar: Missing AuthorizationCVE-2025-69352 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2.
Product
The Events Calendar
Affected
up to 6.15.12.2
What to do
Affects up to 6.15.12.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026RSS Feed Widget: Missing AuthorizationCVE-2025-69349 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Fahad Mahmood RSS Feed Widget rss-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RSS Feed Widget: from n/a through <= 3.0.2.
Product
RSS Feed Widget
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update RSS Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026The Events Calendar Countdown Addon: Missing AuthorizationCVE-2025-69348 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar Countdown Addon: from n/a through <= 1.4.15.
Product
The Events Calendar Countdown Addon
Affected
up to 1.4.15
What to do
Affects up to 1.4.15. Update The Events Calendar Countdown Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026AffiliateX: Missing AuthorizationCVE-2025-69346 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPCenter AffiliateX affiliatex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AffiliateX: from n/a through <= 1.3.9.3.
Product
AffiliateX
Affected
up to 1.3.9.3
What to do
Affects up to 1.3.9.3. Update AffiliateX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Post and Page Builder by BoldGrid: Missing AuthorizationCVE-2025-69345 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.
Product
Post and Page Builder by BoldGrid
Affected
up to 1.27.9
What to do
Affects up to 1.27.9. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026WeDesignTech Ultimate Booking Addon: Missing AuthorizationCVE-2025-69341 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.
Product
WeDesignTech Ultimate Booking Addon
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WeDesignTech Ultimate Booking Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Ultimate Store Kit Elementor Addons: Missing AuthorizationCVE-2025-69336 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.9.4.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Theater for: Missing AuthorizationCVE-2025-69331 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.19.
Product
Theater for
Affected
up to 0.19
What to do
Affects up to 0.19. Update Theater for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Car Rental Manager: Missing AuthorizationCVE-2025-69327 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.0.9.
Product
Car Rental Manager
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Car Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026InWave Jobs: Missing AuthorizationCVE-2025-39477 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Sfwebservice InWave Jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWave Jobs: from n/a through 3.5.8.
Product
InWave Jobs
Affected
up to 3.5.8
What to do
Affects up to 3.5.8. Update InWave Jobs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026LoginWP - Pro: Missing AuthorizationCVE-2025-46255 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Marketing Fire LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a through 4.0.8.5.
Product
LoginWP - Pro
Affected
up to 4.0.8.5
What to do
Affects up to 4.0.8.5. Update LoginWP - Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026LoginWP - Pro: Missing AuthorizationCVE-2025-39561 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Marketing Fire, LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LoginWP - Pro: from n/a through 4.0.8.5.
Product
LoginWP - Pro
Affected
up to 4.0.8.5
What to do
Affects up to 4.0.8.5. Update LoginWP - Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026Sell Downloads: Missing AuthorizationCVE-2025-68850 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sell Downloads: from n/a through <= 1.1.12.
Product
Sell Downloads
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update Sell Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026Follow My Blog Post: Missing AuthorizationCVE-2025-68547 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Follow My Blog Post: from n/a through <= 2.4.0.
Product
Follow My Blog Post
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Follow My Blog Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026AnyWhere Elementor Pro: Missing AuthorizationCVE-2025-31046 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.
Product
AnyWhere Elementor Pro
Affected
up to 2.29
What to do
Affects up to 2.29. Update AnyWhere Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 5, 2026Team: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-14124 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
Team
Fixed in
5.0.11
What to do
Update Team to 5.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Dec 31, 2025Conformer for Elementor: Missing AuthorizationCVE-2025-66148 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conformer for Elementor: from n/a through <= 1.0.7.
Product
Conformer for Elementor
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Conformer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Logger for Elementor: Missing AuthorizationCVE-2025-66146 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logger for Elementor: from n/a through <= 1.0.9.
Product
Logger for Elementor
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Logger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Worker for WPBakery: Missing AuthorizationCVE-2025-66145 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Worker for WPBakery worker-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for WPBakery: from n/a through <= 1.1.1.
Product
Worker for WPBakery
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Worker for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Worker for Elementor: Missing AuthorizationCVE-2025-66144 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for Elementor: from n/a through <= 1.0.10.
Product
Worker for Elementor
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Worker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Headinger for Elementor: Missing AuthorizationCVE-2025-66153 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headinger for Elementor: from n/a through <= 1.1.4.
Product
Headinger for Elementor
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Headinger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Criptopayer for Elementor: Missing AuthorizationCVE-2025-66152 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Criptopayer for Elementor: from n/a through <= 1.0.1.
Product
Criptopayer for Elementor
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Criptopayer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Countdowner for Elementor: Missing AuthorizationCVE-2025-66151 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Countdowner for Elementor: from n/a through <= 1.0.4.
Product
Countdowner for Elementor
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Countdowner for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Appender: Missing AuthorizationCVE-2025-66150 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Appender appender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appender: from n/a through <= 1.1.1.
Product
Appender
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Appender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025UnGrabber: Missing AuthorizationCVE-2025-66149 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove UnGrabber ungrabber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnGrabber: from n/a through <= 3.1.3.
Product
UnGrabber
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update UnGrabber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Select Graphist for Elementor Graphist for Elementor: Missing AuthorizationCVE-2025-66160 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Select Graphist for Elementor Graphist for Elementor graphist-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Select Graphist for Elementor Graphist for Elementor: from n/a through <= 1.2.10.
Product
Select Graphist for Elementor Graphist for Elementor
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Select Graphist for Elementor Graphist for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Walker for Elementor: Missing AuthorizationCVE-2025-66159 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Walker for Elementor walker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Walker for Elementor: from n/a through <= 1.1.6.
Product
Walker for Elementor
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Walker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Gmaper for Elementor: Missing AuthorizationCVE-2025-66158 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmaper for Elementor: from n/a through <= 1.0.9.
Product
Gmaper for Elementor
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Gmaper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Sliper for Elementor: Missing AuthorizationCVE-2025-66157 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Sliper for Elementor sliper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sliper for Elementor: from n/a through <= 1.0.10.
Product
Sliper for Elementor
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Sliper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Watcher for Elementor: Missing AuthorizationCVE-2025-66156 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through <= 1.0.9.
Product
Watcher for Elementor
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Watcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Questionar for Elementor: Missing AuthorizationCVE-2025-66155 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Questionar for Elementor questionar-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Questionar for Elementor: from n/a through <= 1.1.7.
Product
Questionar for Elementor
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Questionar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Couponer for Elementor: Missing AuthorizationCVE-2025-66154 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Couponer for Elementor: from n/a through <= 1.1.7.
Product
Couponer for Elementor
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Couponer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025WP Custom Admin Interface: Missing AuthorizationCVE-2025-63038 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.40.
Product
WP Custom Admin Interface
Affected
up to 7.40
What to do
Affects up to 7.40. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025AnyComment: Missing AuthorizationCVE-2025-62874 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Alexander AnyComment anycomment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyComment: from n/a through <= 0.3.6.
Product
AnyComment
Affected
up to 0.3.6
What to do
Affects up to 0.3.6. Update AnyComment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.