Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 28 of 86
Dec 31, 2025Hide: Missing AuthorizationCVE-2025-62115 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide Plugins: from n/a through <= 1.0.4.
- Product
- Hide
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Signature Add-On for Gravity Forms: Missing AuthorizationCVE-2025-62099 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Signature Add-On for Gravity Forms: from n/a through <= 1.8.6.
- Product
- Signature Add-On for Gravity Forms
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Signature Add-On for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Easy Upload Files During Checkout: Missing AuthorizationCVE-2025-62078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Upload Files During Checkout: from n/a through <= 3.0.0.
- Product
- Easy Upload Files During Checkout
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Easy Upload Files During Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Direct Payments WP: Missing AuthorizationCVE-2025-49339 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Digages Direct Payments WP direct-payments-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Direct Payments WP: from n/a through <= 1.3.2.
- Product
- Direct Payments WP
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Direct Payments WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025All in One Accessibility: Missing AuthorizationCVE-2025-63004 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Skynet Technologies USA LLC All in One Accessibility all-in-one-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All in One Accessibility: from n/a through <= 1.15.
- Product
- All in One Accessibility
- Affected
- up to 1.15
- What to do
- Affects up to 1.15. Update All in One Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025GS Portfolio for Envato: Missing AuthorizationCVE-2025-62755 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Portfolio for Envato: from n/a through <= 1.4.2.
- Product
- GS Portfolio for Envato
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update GS Portfolio for Envato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Vireo: Missing AuthorizationCVE-2025-62751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in extendthemes Vireo vireo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vireo: from n/a through <= 1.0.24.
- Product
- Vireo
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update Vireo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Featured Image Generator: Missing AuthorizationCVE-2025-62747 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Aum Watcharapon Featured Image Generator featured-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image Generator: from n/a through <= 1.3.4.
- Product
- Featured Image Generator
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Featured Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: Missing AuthorizationCVE-2025-62154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One: from n/a through <= 1.1.7.
- Product
- AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025History Timeline: Missing AuthorizationCVE-2025-62150 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themesawesome History Timeline timeline-awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects History Timeline: from n/a through <= 1.0.6.
- Product
- History Timeline
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update History Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Tasty Recipes Lite: Missing AuthorizationCVE-2025-62132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.
- Product
- Tasty Recipes Lite
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Tasty Recipes Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Tasty Recipes Lite: Missing AuthorizationCVE-2025-62131 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.
- Product
- Tasty Recipes Lite
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Tasty Recipes Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Accordion Slider Gallery: Missing AuthorizationCVE-2025-62130 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdiscover Accordion Slider Gallery accordion-slider-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider Gallery: from n/a through <= 2.7.
- Product
- Accordion Slider Gallery
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Accordion Slider Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025RestroPress: Missing AuthorizationCVE-2025-62129 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.7.
- Product
- RestroPress
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Trash Duplicate and 301 Redirect: Missing AuthorizationCVE-2025-62122 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in solwininfotech Trash Duplicate and 301 Redirect trash-duplicate-and-301-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trash Duplicate and 301 Redirect: from n/a through <= 1.9.1.
- Product
- Trash Duplicate and 301 Redirect
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Trash Duplicate and 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025AI Copilot: Missing AuthorizationCVE-2025-62116 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in quadlayers AI Copilot ai-copilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Copilot: from n/a through <= 1.5.2.
- Product
- AI Copilot
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update AI Copilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Wiremo: Missing AuthorizationCVE-2025-62092 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wiremo Wiremo woo-reviews-by-wiremo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wiremo: from n/a through <= 1.4.99.
- Product
- Wiremo
- Affected
- up to 1.4.99
- What to do
- Affects up to 1.4.99. Update Wiremo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Sticky Notes for WP Dashboard: Missing AuthorizationCVE-2025-62087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.
- Product
- Sticky Notes for WP Dashboard
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Sticky Notes for WP Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP Export Categories & Taxonomies: Missing AuthorizationCVE-2025-62079 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Damian WP Export Categories & Taxonomies wp-export-categories-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Export Categories & Taxonomies: from n/a through <= 1.0.3.
- Product
- WP Export Categories & Taxonomies
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WP Export Categories & Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Orders Chat for WooCommerce: Missing AuthorizationCVE-2025-49356 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mykola Lukin Orders Chat for WooCommerce orders-chat-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orders Chat for WooCommerce: from n/a through <= 1.2.0.
- Product
- Orders Chat for WooCommerce
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Orders Chat for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Flowbox: Missing AuthorizationCVE-2025-49338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Flowbox Flowbox flowbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flowbox: from n/a through <= 1.1.6.
- Product
- Flowbox
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Flowbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025EasyTest – Simplify A/B Testing: Missing AuthorizationCVE-2025-63031 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.
- Product
- EasyTest – Simplify A/B Testing
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update EasyTest – Simplify A/B Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Simple Like Page: Missing AuthorizationCVE-2025-63022 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in topdevs.net Simple Like Page simple-facebook-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Like Page: from n/a through <= 1.5.3.
- Product
- Simple Like Page
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Simple Like Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025QuadLayers TikTok Feed: Missing AuthorizationCVE-2025-63016 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in quadlayers QuadLayers TikTok Feed wp-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QuadLayers TikTok Feed: from n/a through <= 4.6.5.
- Product
- QuadLayers TikTok Feed
- Affected
- up to 4.6.5
- What to do
- Affects up to 4.6.5. Update QuadLayers TikTok Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Hotel Booking: Missing AuthorizationCVE-2025-63001 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Booking: from n/a through <= 3.8.
- Product
- Hotel Booking
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP Attachments: Missing AuthorizationCVE-2025-62888 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attachments: from n/a through <= 5.2.
- Product
- WP Attachments
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update WP Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Realbig: Missing AuthorizationCVE-2025-62147 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nikmelnik Realbig realbig-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Realbig: from n/a through <= 1.1.3.
- Product
- Realbig
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Realbig to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025DMCA Protection Badge: Missing AuthorizationCVE-2025-62145 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NewClarity DMCA Protection Badge dmca-badge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DMCA Protection Badge: from n/a through <= 2.2.0.
- Product
- DMCA Protection Badge
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update DMCA Protection Badge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Wawp: Missing AuthorizationCVE-2025-62141 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Information Technology Wawp automation-web-platform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wawp: from n/a through <= 4.4.
- Product
- Wawp
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update Wawp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Add Custom Codes: Missing AuthorizationCVE-2025-62108 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Custom Codes: from n/a through <= 4.80.
- Product
- Add Custom Codes
- Affected
- up to 4.80
- What to do
- Affects up to 4.80. Update Add Custom Codes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Portfolio Gallery: Missing AuthorizationCVE-2025-62098 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.
- Product
- Portfolio Gallery
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Serial Codes Generator and Validator with WooCommerce Support: Missing AuthorizationCVE-2025-62091 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serial Codes Generator and Validator with WooCommerce Support: from n/a through <= 2.8.2.
- Product
- Serial Codes Generator and Validator with WooCommerce Support
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update Serial Codes Generator and Validator with WooCommerce Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Live Shopping & Shoppable Videos For WooCommerce: Missing AuthorizationCVE-2025-62081 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
- Product
- Live Shopping & Shoppable Videos For WooCommerce
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Live Shopping & Shoppable Videos For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Reuters Direct: Missing AuthorizationCVE-2025-49349 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Reuters News Agency Reuters Direct reuters-direct allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reuters Direct: from n/a through <= 3.0.0.
- Product
- Reuters Direct
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Reuters Direct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Core Web Vitals & PageSpeed Booster: Missing AuthorizationCVE-2025-62144 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mohammed Kaludi Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through <= 1.0.28.
- Product
- Core Web Vitals & PageSpeed Booster
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Core Web Vitals & PageSpeed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025WP Advanced PDF: Missing AuthorizationCVE-2025-62138 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Advanced PDF: from n/a through <= 1.1.7.
- Product
- WP Advanced PDF
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update WP Advanced PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025SiteLock Security – WP Hardening, Login Security & Malware Scans: Missing AuthorizationCVE-2025-62128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through <= 5.0.1.
- Product
- SiteLock Security – WP Hardening, Login Security & Malware Scans
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update SiteLock Security – WP Hardening, Login Security & Malware Scans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025ShopMagic: Missing AuthorizationCVE-2025-69093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.
- Product
- ShopMagic
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Demo Importer Plus: Missing AuthorizationCVE-2025-69091 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.
- Product
- Demo Importer Plus
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Demo Importer Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Arcane: Missing AuthorizationCVE-2025-69031 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.
- Product
- Arcane
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update Arcane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025weForms: Missing AuthorizationCVE-2025-69028 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.
- Product
- weForms
- Affected
- up to 1.6.25
- What to do
- Affects up to 1.6.25. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Product Delivery Date for WooCommerce – Lite: Missing AuthorizationCVE-2025-69027 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.
- Product
- Product Delivery Date for WooCommerce – Lite
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Product Delivery Date for WooCommerce – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025BizPrint: Missing AuthorizationCVE-2025-69024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.
- Product
- BizPrint
- Affected
- up to 4.6.7
- What to do
- Affects up to 4.6.7. Update BizPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Discussion Board: Missing AuthorizationCVE-2025-69023 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.
- Product
- Discussion Board
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025HR Management Lite: Missing AuthorizationCVE-2025-69022 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.
- Product
- HR Management Lite
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update HR Management Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Shortcodes and extra features for Phlox: Missing AuthorizationCVE-2025-69016 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.
- Product
- Shortcodes and extra features for Phlox
- Affected
- up to 2.17.22
- What to do
- Affects up to 2.17.22. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Crowdsignal Forms: Missing AuthorizationCVE-2025-69015 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.
- Product
- Crowdsignal Forms
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Crowdsignal Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Stratum: Missing AuthorizationCVE-2025-69013 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.
- Product
- Stratum
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Stratum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Event Organiser: Missing AuthorizationCVE-2025-69012 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.
- Product
- Event Organiser
- Affected
- up to 3.12.8
- What to do
- Affects up to 3.12.8. Update Event Organiser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.