Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,251 results · page 275 of 826
Oct 29, 2025SmartMag: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64216 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeSphere SmartMag smart-mag allows PHP Local File Inclusion.This issue affects SmartMag: from n/a through <= 10.3.0.
- Product
- SmartMag
- Affected
- up to 10.3.0
- What to do
- Affects up to 10.3.0. Update SmartMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025MasterStudy LMS Pro: Missing AuthorizationCVE-2025-64212 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
- Product
- MasterStudy LMS Pro
- What to do
- Update MasterStudy LMS Pro to the newest version.
Oct 29, 2025Masterstudy Elementor Widgets: Missing AuthorizationCVE-2025-64211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Masterstudy Elementor Widgets: Missing AuthorizationCVE-2025-64210 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Jannah - Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64208 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah - Extensions jannah-extensions allows DOM-Based XSS.This issue affects Jannah - Extensions: from n/a through <= 1.1.4.
- Product
- Jannah - Extensions
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Jannah - Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025SmartMag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64204 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This issue affects SmartMag: from n/a through <= 10.3.1.
- Product
- SmartMag
- Affected
- up to 10.3.1
- What to do
- Affects up to 10.3.1. Update SmartMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Sahifa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64202 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue affects Sahifa: from n/a through < 5.8.6.
- Product
- Sahifa
- What to do
- Update Sahifa to the newest version.
Oct 29, 2025PowerPress Podcasting: Cross-Site Request Forgery (CSRF)CVE-2025-64201 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through <= 11.13.12.
- Product
- PowerPress Podcasting
- Affected
- up to 11.13.12
- What to do
- Affects up to 11.13.12. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Email Template Customizer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64200 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.17.
- Product
- Email Template Customizer for WooCommerce
- Affected
- up to 1.2.17
- What to do
- Affects up to 1.2.17. Update Email Template Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025wpresidence: Missing AuthorizationCVE-2025-64199 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through <= 5.3.2.
- Product
- wpresidence
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update wpresidence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Rehub: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64197 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through < 19.9.9.1.
- Product
- Rehub
- What to do
- Update Rehub to the newest version.
Oct 29, 2025Eduma: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64195 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Eduma eduma allows PHP Local File Inclusion.This issue affects Eduma: from n/a through <= 5.7.6.
- Product
- Eduma
- Affected
- up to 5.7.6
- What to do
- Affects up to 5.7.6. Update Eduma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Eduma: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64194 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affects Eduma: from n/a through <= 5.7.6.
- Product
- Eduma
- Affected
- up to 5.7.6
- What to do
- Affects up to 5.7.6. Update Eduma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025hpb seo plugin for: Cross-Site Request Forgery (CSRF)CVE-2025-60075 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS.This issue affects hpb seo plugin for WordPress: from n/a through <= 3.0.1.
- Product
- hpb seo plugin for
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update hpb seo plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Super Store Finder: Cross-Site Request Forgery (CSRF)CVE-2025-58939 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super Store Finder: from n/a through <= 7.5.
- Product
- Super Store Finder
- Affected
- up to 7.5
- What to do
- Affects up to 7.5. Update Super Store Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Blog Designer PRO: Missing AuthorizationCVE-2025-58711 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blog Designer PRO: from n/a through <= 3.4.8.
- Product
- Blog Designer PRO
- Affected
- up to 3.4.8
- What to do
- Affects up to 3.4.8. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025WooCommerce: Sensitive Information ExposureCVE-2023-7320 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to extract sensitive user information including PII(Personal Identifiable Information).
- Product
- WooCommerce
- Affected
- up to 7.8.2
- What to do
- Affects up to 7.8.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 29, 2025Doppler Forms: Registers an AJAX action install_extension without verifying user capabilities or using a nonceCVE-2025-9544 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
- Product
- Doppler Forms
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49042 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.
- Product
- WooCommerce
- Affected
- up to 10.0.2
- What to do
- Affects up to 10.0.2. Update WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Anti-Malware Security and Brute-Force Firewall: Arbitrary File ReadCVE-2025-11705 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Anti-Malware Security and Brute-Force Firewall
- Affected
- up to 4.23.81
- What to do
- Affects up to 4.23.81. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Oct 29, 2025Facebook for WooCommerce: Missing AuthorizationCVE-2025-64296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
- Product
- Facebook for WooCommerce
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Facebook for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Popup box: Cross-Site Request Forgery (CSRF)CVE-2025-57931 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 5.5.4.
- Product
- Popup box
- Affected
- up to 5.5.4
- What to do
- Affects up to 5.5.4. Update Popup box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2025WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecCVE-2025-4665 · WordPress plugins & themes · reported by mandiant-cve@google.comCritical 9.6
WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Oct 28, 2025HUSKY – Products Filter Professional for WooCommerce: Blind SQL InjectionCVE-2025-11735 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- HUSKY – Products Filter Professional for WooCommerce
- Affected
- up to 1.3.7.1
- What to do
- Affects up to 1.3.7.1. Update HUSKY – Products Filter Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 27, 2025IDonate: Does not have authorisation and CSRFCVE-2025-11154 · WordPress plugins & themes · reported by WPScanMedium 5.4
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.
- Product
- IDonate
- Fixed in
- 2.1.13
- What to do
- Update IDonate to 2.1.13 or newer.
Oct 26, 2025Entrada: Cross-Site Request Forgery (CSRF)CVE-2025-58918 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Waituk Entrada theme allows Cross Site Request Forgery.This issue affects Entrada: from n/a through 5.7.7.
- Product
- Entrada
- Affected
- up to 5.7.7
- What to do
- Affects up to 5.7.7. Update Entrada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Ultimate Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48088 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through < 3.21.1.
- Product
- Ultimate Addons for WPBakery Page Builder
- What to do
- Update Ultimate Addons for WPBakery Page Builder to the newest version.
Oct 26, 2025Slider Templates: Server-Side Request Forgery (SSRF)CVE-2025-62988 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Codeless Slider Templates slider-templates allows Server Side Request Forgery.This issue affects Slider Templates: from n/a through <= 1.0.3.
- Product
- Slider Templates
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Slider Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Builderall Builder for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62987 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Stored XSS.This issue affects Builderall Builder for WordPress: from n/a through <= 3.0.1.
- Product
- Builderall Builder for
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Builderall Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025FanBridge signup: Cross-Site Request Forgery (CSRF)CVE-2025-62986 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in FanBridge FanBridge signup fanbridge-signup allows Stored XSS.This issue affects FanBridge signup: from n/a through <= 0.6.
- Product
- FanBridge signup
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update FanBridge signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Simple Pull Quote: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62985 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in llamaman Simple Pull Quote simple-pull-quote allows Stored XSS.This issue affects Simple Pull Quote: from n/a through <= 1.6.3.
- Product
- Simple Pull Quote
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Simple Pull Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP AdCenter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62984 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.6.1.
- Product
- WP AdCenter
- Affected
- up to 2.6.1
- What to do
- Affects up to 2.6.1. Update WP AdCenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Posts By Tag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62983 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu Posts By Tag posts-by-tag allows Stored XSS.This issue affects Posts By Tag: from n/a through <= 3.2.1.
- Product
- Posts By Tag
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Posts By Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Dynamic User Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dynamic User Directory: from n/a through <= 2.3.
- Product
- Dynamic User Directory
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Dynamic User Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP Gravity Forms Zoho CRM and Bigin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-62981 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.8.
- Product
- WP Gravity Forms Zoho CRM and Bigin
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Persian Admnin Fonts: Missing AuthorizationCVE-2025-62980 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Persian Admnin Fonts: from n/a through <= 4.1.03.
- Product
- Persian Admnin Fonts
- Affected
- up to 4.1.03
- What to do
- Affects up to 4.1.03. Update Persian Admnin Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025ACF to REST API: Insertion of Sensitive Information Into Sent DataCVE-2025-62979 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue affects ACF to REST API: from n/a through <= 3.3.4.
- Product
- ACF to REST API
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update ACF to REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025KiotViet Sync: Missing AuthorizationCVE-2025-62978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.
- Product
- KiotViet Sync
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025百度站长SEO合集(支持百度/神马/Bing/头条推送): Missing AuthorizationCVE-2025-62977 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 沃之涛 百度站长SEO合集(支持百度/神马/Bing/头条推送) baiduseo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 百度站长SEO合集(支持百度/神马/Bing/头条推送): from n/a through <= 2.1.4.
- Product
- 百度站长SEO合集(支持百度/神马/Bing/头条推送)
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update 百度站长SEO合集(支持百度/神马/Bing/头条推送) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Sendle Shipping: Missing AuthorizationCVE-2025-62976 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sendle Shipping: from n/a through <= 6.02.
- Product
- Sendle Shipping
- Affected
- up to 6.02
- What to do
- Affects up to 6.02. Update Sendle Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Raychat: Cross-Site Request Forgery (CSRF)CVE-2025-62975 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in raychat Raychat raychat allows Cross Site Request Forgery.This issue affects Raychat: from n/a through <= 2.2.1.
- Product
- Raychat
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Raychat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Headline Analyzer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62974 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Stored XSS.This issue affects Headline Analyzer: from n/a through <= 1.3.7.
- Product
- Headline Analyzer
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Headline Analyzer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025BuddyForms: Missing AuthorizationCVE-2025-62973 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.
- Product
- BuddyForms
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WebinarPress: Missing AuthorizationCVE-2025-62972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.
- Product
- WebinarPress
- Affected
- up to 1.33.28
- What to do
- Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Attesa Extra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62971 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrestaProject Attesa Extra attesa-extra allows Stored XSS.This issue affects Attesa Extra: from n/a through <= 1.4.7.
- Product
- Attesa Extra
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Attesa Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Link Whisper Free: Missing AuthorizationCVE-2025-62970 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
- Product
- Link Whisper Free
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025NextMove Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Stored XSS.This issue affects NextMove Lite: from n/a through <= 2.23.0.
- Product
- NextMove Lite
- Affected
- up to 2.23.0
- What to do
- Affects up to 2.23.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP Last Modified Info: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62968 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Stored XSS.This issue affects WP Last Modified Info: from n/a through <= 1.9.2.
- Product
- WP Last Modified Info
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update WP Last Modified Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025DirectoryPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62967 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows DOM-Based XSS.This issue affects DirectoryPress: from n/a through <= 3.6.25.
- Product
- DirectoryPress
- Affected
- up to 3.6.25
- What to do
- Affects up to 3.6.25. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025GoCache: Missing AuthorizationCVE-2025-62966 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apiki GoCache gocache-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoCache: from n/a through <= 1.3.6.
- Product
- GoCache
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update GoCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.