Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 30 of 86
Dec 23, 2025Chakra test: Missing AuthorizationCVE-2025-68557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vikas Ratudi Chakra test chakra-test allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chakra test: from n/a through <= 1.0.1.
- Product
- Chakra test
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Chakra test to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025HAPPY: Missing AuthorizationCVE-2025-68556 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.9.
- Product
- HAPPY
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025PowerPack Pro for Elementor: Missing AuthorizationCVE-2024-24844 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Pro for Elementor: from n/a through 2.10.6.
- Product
- PowerPack Pro for Elementor
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update PowerPack Pro for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025Frontend Post Submission Manager Lite: Missing AuthorizationCVE-2025-14080 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, allowing them to change post titles, content, excerpts, and remove post authors.
- Product
- Frontend Post Submission Manager Lite
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Frontend Post Submission Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2025HappyFiles Pro: Missing AuthorizationCVE-2023-25446 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HappyFiles Pro: from n/a through 1.8.1.
- Product
- HappyFiles Pro
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update HappyFiles Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025HappyFiles Pro: Missing AuthorizationCVE-2023-25445 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in HappyFiles HappyFiles Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HappyFiles Pro: from n/a through 1.8.1.
- Product
- HappyFiles Pro
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update HappyFiles Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025Magazine Edge: Missing AuthorizationCVE-2023-25068 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mapro Collins Magazine Edge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Edge: from n/a through 1.13.
- Product
- Magazine Edge
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update Magazine Edge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2025The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cCVE-2025-7782 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cs_update_application_status_callback' function in all versions up to, and including, 7.7. This makes it possible for authenticated attackers, with Candidate-level access and above, to inject cross-site scripting into the 'status' parameter of applied jobs for any user.
- Affected
- up to 7.7
- What to do
- Affects up to 7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Dec 19, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information including user IDs, display names, and email addresses of all users on the site via the get_bank_accounts AJAX action. Passwords are not exposed.
- Product
- myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program
- Affected
- up to 2.9.7.1
- What to do
- Affects up to 2.9.7.1. Update myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025Post Grid and Gutenberg Blocks: Missing AuthorizationCVE-2025-66058 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.
- Product
- Post Grid and Gutenberg Blocks
- Affected
- up to 2.3.17
- What to do
- Affects up to 2.3.17. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Tuturn: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-64236 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a before 3.6.
- Product
- Tuturn
- Fixed in
- 3.6
- What to do
- Update Tuturn to 3.6 or newer.
Dec 18, 2025Sermon Manager: Missing AuthorizationCVE-2025-63002 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sermon Manager: from n/a through <= 2.30.0.
- Product
- Sermon Manager
- Affected
- up to 2.30.0
- What to do
- Affects up to 2.30.0. Update Sermon Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Sparkle FSE: Missing AuthorizationCVE-2025-62961 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sparkle FSE: from n/a through <= 1.0.9.
- Product
- Sparkle FSE
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Sparkle FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Construction Light: Missing AuthorizationCVE-2025-62960 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Light: from n/a through <= 1.6.7.
- Product
- Construction Light
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Construction Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Easy Form: Missing AuthorizationCVE-2025-66117 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form: from n/a through <= 2.7.8.
- Product
- Easy Form
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Easy Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Offload, AI & Optimize with Cloudflare Images: Missing AuthorizationCVE-2025-66104 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anton Vanyukov Offload, AI & Optimize with Cloudflare Images cf-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Offload, AI & Optimize with Cloudflare Images: from n/a through <= 1.9.5.
- Product
- Offload, AI & Optimize with Cloudflare Images
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update Offload, AI & Optimize with Cloudflare Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025RestroPress: Missing AuthorizationCVE-2025-66100 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.3.5.
- Product
- RestroPress
- Affected
- up to 3.2.3.5
- What to do
- Affects up to 3.2.3.5. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PropertyHive: Missing AuthorizationCVE-2025-66088 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.
- Product
- PropertyHive
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025wpForo Forum: Missing AuthorizationCVE-2025-66070 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.10.
- Product
- wpForo Forum
- Affected
- up to 2.4.10
- What to do
- Affects up to 2.4.10. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025InstaWP Connect: Missing AuthorizationCVE-2025-66068 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.1.9.
- Product
- InstaWP Connect
- Affected
- up to 0.1.1.9
- What to do
- Affects up to 0.1.1.9. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025LearnPress: Missing AuthorizationCVE-2025-66054 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.9.4.
- Product
- LearnPress
- Affected
- up to 4.2.9.4
- What to do
- Affects up to 4.2.9.4. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025ListingPro: Missing AuthorizationCVE-2025-64378 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10.
- Product
- ListingPro
- What to do
- Update ListingPro to the newest version.
Dec 18, 2025WP Social Ninja: Missing AuthorizationCVE-2025-64375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mahmudul Hasan Arif WP Social Ninja wp-social-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Ninja: from n/a through <= 3.20.1.
- Product
- WP Social Ninja
- Affected
- up to 3.20.1
- What to do
- Affects up to 3.20.1. Update WP Social Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Email marketing for WordPress by GetResponse Official: Missing AuthorizationCVE-2025-64273 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
- Product
- Email marketing for WordPress by GetResponse Official
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Email marketing for WordPress by GetResponse Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Timetics: Missing AuthorizationCVE-2025-64268 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.44.
- Product
- Timetics
- Affected
- up to 1.0.44
- What to do
- Affects up to 1.0.44. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WooCommerce Recover Abandoned Cart: Missing AuthorizationCVE-2025-64222 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart: from n/a through <= 24.6.0.
- Product
- WooCommerce Recover Abandoned Cart
- Affected
- up to 24.6.0
- What to do
- Affects up to 24.6.0. Update WooCommerce Recover Abandoned Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025MasterStudy LMS Pro: Missing AuthorizationCVE-2025-64214 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
- Product
- MasterStudy LMS Pro
- What to do
- Update MasterStudy LMS Pro to the newest version.
Dec 18, 2025Masterstudy: Missing AuthorizationCVE-2025-64209 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in StylemixThemes Masterstudy masterstudy allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy: from n/a through < 4.8.122.
- Product
- Masterstudy
- What to do
- Update Masterstudy to the newest version.
Dec 18, 2025XStore: Missing AuthorizationCVE-2025-64192 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.
- Product
- XStore
- What to do
- Update XStore to the newest version.
Dec 18, 2025ListingPro: Missing AuthorizationCVE-2025-63039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.
- Product
- ListingPro
- Affected
- up to 2.9.9
- What to do
- Affects up to 2.9.9. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WebinarIgnition: Missing AuthorizationCVE-2025-60088 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarIgnition: from n/a through <= 4.06.04.
- Product
- WebinarIgnition
- Affected
- up to 4.06.04
- What to do
- Affects up to 4.06.04. Update WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Voting Contest: Missing AuthorizationCVE-2025-60086 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Matt WP Voting Contest wp-voting-contest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Voting Contest: from n/a through <= 5.8.
- Product
- WP Voting Contest
- Affected
- up to 5.8
- What to do
- Affects up to 5.8. Update WP Voting Contest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Parallax Section block: Missing AuthorizationCVE-2025-60079 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Parallax Section block: from n/a through <= 1.0.9.
- Product
- Parallax Section block
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Parallax Section block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025YayPricing: Missing AuthorizationCVE-2025-60077 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in YayCommerce YayPricing yaypricing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects YayPricing: from n/a through <= 3.5.3.
- Product
- YayPricing
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update YayPricing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025IDonatePro: Missing AuthorizationCVE-2025-60045 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects IDonatePro: from n/a through <= 2.1.11.
- Product
- IDonatePro
- Affected
- up to 2.1.11
- What to do
- Affects up to 2.1.11. Update IDonatePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025IDonatePro: Missing AuthorizationCVE-2025-58938 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonatePro: from n/a through <= 2.1.9.
- Product
- IDonatePro
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update IDonatePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Javo Core: Missing AuthorizationCVE-2025-58877 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.529.
- Product
- Javo Core
- Affected
- up to 3.0.0.529
- What to do
- Affects up to 3.0.0.529. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025PostX: Missing AuthorizationCVE-2025-54751 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 4.1.36.
- Product
- PostX
- Affected
- up to 4.1.36
- What to do
- Affects up to 4.1.36. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025miniOrange's Google Authenticator: Missing AuthorizationCVE-2025-54745 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.
- Product
- miniOrange's Google Authenticator
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update miniOrange's Google Authenticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Download After Email: Missing AuthorizationCVE-2025-54743 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through 2.1.5-2.1.6.
- Product
- Download After Email
- Affected
- up to 2.1.5-2.1.6
- What to do
- Affects up to 2.1.5-2.1.6. Update Download After Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Super Blank: Missing AuthorizationCVE-2025-54741 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Tyler Moore Super Blank super-blank allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Blank: from n/a through <= 1.2.0.
- Product
- Super Blank
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Super Blank to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Login Page Customizer – Customizer Login Page, Admin Page, Custom Design: Missing AuthorizationCVE-2025-49902 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in A WP Life Login Page Customizer – Customizer Login Page, Admin Page, Custom Design customizer-login-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Page Customizer – Customizer Login Page, Admin Page, Custom Design: from n/a through <= 2.1.1.
- Product
- Login Page Customizer – Customizer Login Page, Admin Page, Custom Design
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Login Page Customizer – Customizer Login Page, Admin Page, Custom Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Get Cash: Missing AuthorizationCVE-2025-49041 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in The African Boss Get Cash get-cash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Get Cash: from n/a through <= 3.2.3.
- Product
- Get Cash
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Get Cash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Huger for Elementor: Missing AuthorizationCVE-2025-68088 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Huger for Elementor huger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Huger for Elementor: from n/a through <= 1.1.5.
- Product
- Huger for Elementor
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Huger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Modalier for Elementor: Missing AuthorizationCVE-2025-68087 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Modalier for Elementor modalier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modalier for Elementor: from n/a through <= 1.0.6.
- Product
- Modalier for Elementor
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Modalier for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Reformer for Elementor: Missing AuthorizationCVE-2025-68086 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reformer for Elementor: from n/a through <= 1.0.6.
- Product
- Reformer for Elementor
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Reformer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Buttoner for Elementor: Missing AuthorizationCVE-2025-68085 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Buttoner for Elementor buttoner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Buttoner for Elementor: from n/a through <= 1.0.6.
- Product
- Buttoner for Elementor
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Buttoner for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Ultimate Auction: Missing AuthorizationCVE-2025-68084 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Nitesh Ultimate Auction ultimate-auction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Auction : from n/a through <= 4.3.3.
- Product
- Ultimate Auction
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update Ultimate Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Watu Quiz: Missing AuthorizationCVE-2025-67976 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.
- Product
- Watu Quiz
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Homey Core: Missing AuthorizationCVE-2025-67965 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.
- Product
- Homey Core
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Homey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.