Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 37 of 126
Jan 23, 2026Edwiser Bridge: Missing AuthorizationCVE-2026-24570 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Edwiser Bridge: from n/a through <= 4.3.2.
- Product
- Edwiser Bridge
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Edwiser Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Media Library File Size: Missing AuthorizationCVE-2026-24569 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sully Media Library File Size media-library-file-size allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Library File Size: from n/a through <= 1.6.7.
- Product
- Media Library File Size
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Media Library File Size to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP Travel: Missing AuthorizationCVE-2026-24568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 11.1.0.
- Product
- WP Travel
- Affected
- up to 11.1.0
- What to do
- Affects up to 11.1.0. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Anything Order by Terms: Missing AuthorizationCVE-2026-24567 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Anything Order by Terms: from n/a through <= 1.4.0.
- Product
- Anything Order by Terms
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Anything Order by Terms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026iNET Webkit: Missing AuthorizationCVE-2026-24566 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iNET Webkit: from n/a through <= 1.2.4.
- Product
- iNET Webkit
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update iNET Webkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026LifePress: Missing AuthorizationCVE-2026-24563 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LifePress: from n/a through <= 2.2.1.
- Product
- LifePress
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update LifePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Ryviu – Product Reviews for WooCommerce: Missing AuthorizationCVE-2026-24562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ryviu Ryviu – Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ryviu – Product Reviews for WooCommerce: from n/a through <= 3.1.26.
- Product
- Ryviu – Product Reviews for WooCommerce
- Affected
- up to 3.1.26
- What to do
- Affects up to 3.1.26. Update Ryviu – Product Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026FluentBoards: Missing AuthorizationCVE-2026-24561 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.1.
- Product
- FluentBoards
- Affected
- up to 1.91.1
- What to do
- Affects up to 1.91.1. Update FluentBoards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Cloudinary: Missing AuthorizationCVE-2026-24560 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cloudinary Cloudinary cloudinary-image-management-and-manipulation-in-the-cloud-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cloudinary: from n/a through <= 3.3.2.
- Product
- Cloudinary
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Cloudinary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026ElementCamp: Missing AuthorizationCVE-2026-24556 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementCamp: from n/a through <= 2.3.2.
- Product
- ElementCamp
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update ElementCamp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Fraud Prevention For Woocommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24553 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects Fraud Prevention For Woocommerce: from n/a through <= 2.3.2.
- Product
- Fraud Prevention For Woocommerce
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Fraud Prevention For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Monetag Official: Missing AuthorizationCVE-2026-24551 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
- Product
- Monetag Official
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Monetag Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026HD Quiz: Missing AuthorizationCVE-2026-24544 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Harmonic Design HD Quiz hd-quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz: from n/a through <= 2.0.9.
- Product
- HD Quiz
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update HD Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Materialis Companion: Missing AuthorizationCVE-2026-24543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52.
- Product
- Materialis Companion
- Affected
- up to 1.3.52
- What to do
- Affects up to 1.3.52. Update Materialis Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Download After Email: Missing AuthorizationCVE-2026-24541 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through <= 2.1.9.
- Product
- Download After Email
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update Download After Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Integrate Google Drive: Missing AuthorizationCVE-2026-24540 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through <= 1.5.6.
- Product
- Integrate Google Drive
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Protección de datos – RGPD: Missing AuthorizationCVE-2026-24539 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ABCdatos Protección de datos – RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protección de datos – RGPD: from n/a through <= 0.68.
- Product
- Protección de datos – RGPD
- Affected
- up to 0.68
- What to do
- Affects up to 0.68. Update Protección de datos – RGPD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Webpushr: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0.
- Product
- Webpushr
- Affected
- up to 4.38.0
- What to do
- Affects up to 4.38.0. Update Webpushr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Automatic Featured Images from Videos: Missing AuthorizationCVE-2026-24535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7.
- Product
- Automatic Featured Images from Videos
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Booter: Missing AuthorizationCVE-2026-24534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in uPress Booter booter-bots-crawlers-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booter: from n/a through <= 1.5.7.
- Product
- Booter
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Booter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026SiteLock Security – WP Hardening, Login Security & Malware Scans: Missing AuthorizationCVE-2026-24532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through <= 5.0.2.
- Product
- SiteLock Security – WP Hardening, Login Security & Malware Scans
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update SiteLock Security – WP Hardening, Login Security & Malware Scans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WebP Conversion: Missing AuthorizationCVE-2026-24530 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sheepfish WebP Conversion webp-conversion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebP Conversion: from n/a through <= 2.2.
- Product
- WebP Conversion
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WebP Conversion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Quick Restaurant Reservations: Missing AuthorizationCVE-2026-24529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alejandro Quick Restaurant Reservations quick-restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Restaurant Reservations: from n/a through <= 1.6.7.
- Product
- Quick Restaurant Reservations
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Quick Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026CLP Varnish Cache: Missing AuthorizationCVE-2026-24525 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CloudPanel CLP Varnish Cache clp-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CLP Varnish Cache: from n/a through <= 1.0.2.
- Product
- CLP Varnish Cache
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update CLP Varnish Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Tablesome: Missing AuthorizationCVE-2026-24524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.2.8.
- Product
- Tablesome
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP FullCalendar: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.
- Product
- WP FullCalendar
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update WP FullCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP Subscribe: Missing AuthorizationCVE-2026-24522 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscribe: from n/a through <= 1.2.16.
- Product
- WP Subscribe
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update WP Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Unauthorized modification or loss of dataCVE-2025-13921 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capability check on the 'wedocs_user_documentation_handling_capabilities' function in all versions up to, and including, 2.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit any documentation post. The vulnerability was partially patched in version 2.1.16.
- Product
- weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
- Affected
- up to 2.1.16
- What to do
- Affects up to 2.1.16. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026WPMasterToolKit: Missing AuthorizationCVE-2026-24388 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMasterToolKit: from n/a through <= 2.14.0.
- Product
- WPMasterToolKit
- Affected
- up to 2.14.0
- What to do
- Affects up to 2.14.0. Update WPMasterToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Quick Post Duplicator: Missing AuthorizationCVE-2026-24387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through <= 2.1.
- Product
- WP Quick Post Duplicator
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WP Quick Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Element Invader – Template Kits for Elementor: Missing AuthorizationCVE-2026-24386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Invader – Template Kits for Elementor: from n/a through <= 1.2.4.
- Product
- Element Invader – Template Kits for Elementor
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Element Invader – Template Kits for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026EventPrime: Missing AuthorizationCVE-2026-24380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.0.
- Product
- EventPrime
- Affected
- up to 4.2.8.0
- What to do
- Affects up to 4.2.8.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Job Portal: Authorization Bypass Through User-Controlled KeyCVE-2026-24379 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.3.
- Product
- WP Job Portal
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Nexter Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24377 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.6.3.
- Product
- Nexter Blocks
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026BA Book Everything: Missing AuthorizationCVE-2026-24371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through <= 1.8.16.
- Product
- BA Book Everything
- Affected
- up to 1.8.16
- What to do
- Affects up to 1.8.16. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026The Grid: Missing AuthorizationCVE-2026-24368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
- Product
- The Grid
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026YITH WooCommerce Request A Quote: Missing AuthorizationCVE-2026-24366 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through <= 2.46.0.
- Product
- YITH WooCommerce Request A Quote
- Affected
- up to 2.46.0
- What to do
- Affects up to 2.46.0. Update YITH WooCommerce Request A Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Quiz And Survey Master: Missing AuthorizationCVE-2026-24358 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.3.
- Product
- Quiz And Survey Master
- Affected
- up to 10.3.3
- What to do
- Affects up to 10.3.3. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Recipe Maker: Missing AuthorizationCVE-2026-24357 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Recipe Maker: from n/a through <= 10.2.4.
- Product
- WP Recipe Maker
- Affected
- up to 10.2.4
- What to do
- Affects up to 10.2.4. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026GetGenie: Missing AuthorizationCVE-2026-24356 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetGenie: from n/a through <= 4.3.0.
- Product
- GetGenie
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update GetGenie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026User Registration: Missing AuthorizationCVE-2026-24353 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.9.
- Product
- User Registration
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Golo: Missing AuthorizationCVE-2026-23974 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5.
- Product
- Golo
- What to do
- Update Golo to the newest version.
Jan 22, 2026BD Courier Order Ratio Checker: Missing AuthorizationCVE-2026-22481 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rasedul Haque Rumi BD Courier Order Ratio Checker bd-courier-order-ratio-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BD Courier Order Ratio Checker: from n/a through <= 2.0.1.
- Product
- BD Courier Order Ratio Checker
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update BD Courier Order Ratio Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Easy Form Builder: Missing AuthorizationCVE-2026-22472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.9.6.
- Product
- Easy Form Builder
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Absolute Addons For Elementor: Missing AuthorizationCVE-2026-22468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Absolute Addons For Elementor: from n/a through <= 1.0.14.
- Product
- Absolute Addons For Elementor
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP MapIt: Missing AuthorizationCVE-2026-22466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP MapIt: from n/a through <= 3.0.3.
- Product
- WP MapIt
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update WP MapIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026CTX Feed: Missing AuthorizationCVE-2026-22461 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CTX Feed: from n/a through <= 6.6.18.
- Product
- CTX Feed
- Affected
- up to 6.6.18
- What to do
- Affects up to 6.6.18. Update CTX Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Wanderland: Missing AuthorizationCVE-2026-22458 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wanderland: from n/a through <= 1.5.
- Product
- Wanderland
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Wanderland to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Don Peppe: Missing AuthorizationCVE-2026-22450 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Don Peppe: from n/a through <= 1.3.
- Product
- Don Peppe
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Don Peppe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Prowess: Missing AuthorizationCVE-2026-22447 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Select-Themes Prowess prowess allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prowess: from n/a through <= 1.8.1.
- Product
- Prowess
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Prowess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.