Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 38 of 126
Jan 22, 2026Apimo Connector: Missing AuthorizationCVE-2026-22445 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.
- Product
- Apimo Connector
- Affected
- up to 2.6.5.2
- What to do
- Affects up to 2.6.5.2. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Verdure: Authorization Bypass Through User-Controlled KeyCVE-2026-22430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Verdure verdure allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verdure: from n/a through <= 1.6.
- Product
- Verdure
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Verdure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Sweet Jane: Authorization Bypass Through User-Controlled KeyCVE-2026-22426 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sweet Jane: from n/a through <= 1.2.
- Product
- Sweet Jane
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Sweet Jane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Dolcino: Authorization Bypass Through User-Controlled KeyCVE-2026-22411 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Dolcino dolcino allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dolcino: from n/a through <= 1.6.
- Product
- Dolcino
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Dolcino to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Justicia: Authorization Bypass Through User-Controlled KeyCVE-2026-22409 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Justicia justicia allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Justicia: from n/a through <= 1.2.
- Product
- Justicia
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Justicia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Roam: Authorization Bypass Through User-Controlled KeyCVE-2026-22407 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Roam roam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Roam: from n/a through <= 2.1.1.
- Product
- Roam
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Roam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Overton: Authorization Bypass Through User-Controlled KeyCVE-2026-22406 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through <= 1.3.
- Product
- Overton
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Overton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Innovio: Authorization Bypass Through User-Controlled KeyCVE-2026-22404 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Innovio innovio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Innovio: from n/a through <= 1.7.
- Product
- Innovio
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Innovio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Holmes: Authorization Bypass Through User-Controlled KeyCVE-2026-22400 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Holmes holmes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Holmes: from n/a through <= 1.7.
- Product
- Holmes
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Holmes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Fleur: Authorization Bypass Through User-Controlled KeyCVE-2026-22398 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fleur fleur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fleur: from n/a through <= 2.0.
- Product
- Fleur
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Fleur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Fiorello: Authorization Bypass Through User-Controlled KeyCVE-2026-22396 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Fiorello fiorello allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fiorello: from n/a through <= 1.0.
- Product
- Fiorello
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Fiorello to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Curly: Authorization Bypass Through User-Controlled KeyCVE-2026-22393 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Curly: from n/a through <= 3.3.
- Product
- Curly
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Curly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Cocco: Authorization Bypass Through User-Controlled KeyCVE-2026-22391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through <= 1.5.1.
- Product
- Cocco
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Cocco to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Civic Cookie Control: Missing AuthorizationCVE-2026-22348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Civic Cookie Control: from n/a through <= 1.53.
- Product
- Civic Cookie Control
- Affected
- up to 1.53
- What to do
- Affects up to 1.53. Update Civic Cookie Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2025-69315 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.15.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.9.15
- What to do
- Affects up to 1.6.9.15. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026PostX: Missing AuthorizationCVE-2025-69313 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 5.0.3.
- Product
- PostX
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Broadstreet Ads: Missing AuthorizationCVE-2025-69311 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.
- Product
- Broadstreet Ads
- Affected
- up to 1.52.1
- What to do
- Affects up to 1.52.1. Update Broadstreet Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Premium Addons for Elementor: Missing AuthorizationCVE-2025-69300 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.63.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.63
- What to do
- Affects up to 4.11.63. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Membership: Missing AuthorizationCVE-2025-69193 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.4.
- Product
- WP Membership
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Real Estate Pro: Missing AuthorizationCVE-2025-69192 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Pro: from n/a through <= 2.1.5.
- Product
- Real Estate Pro
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Real Estate Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026ListingHub: Missing AuthorizationCVE-2025-69191 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingHub: from n/a through <= 1.2.7.
- Product
- ListingHub
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update ListingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Listihub: Missing AuthorizationCVE-2025-69190 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through <= 1.0.6.
- Product
- Listihub
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Listihub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026fitness-trainer: Missing AuthorizationCVE-2025-69188 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fitness-trainer: from n/a through <= 1.7.1.
- Product
- fitness-trainer
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update fitness-trainer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Final User: Missing AuthorizationCVE-2025-69187 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through <= 1.2.5.
- Product
- Final User
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Final User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-69186 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
- Product
- Hospital Doctor Directory
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hotel Listing: Missing AuthorizationCVE-2025-69185 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.
- Product
- Hotel Listing
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Hotel Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Institutions Directory: Missing AuthorizationCVE-2025-69184 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3.4.
- Product
- Institutions Directory
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Lawyer Directory: Missing AuthorizationCVE-2025-69181 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.4.
- Product
- Lawyer Directory
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Reservation: Missing AuthorizationCVE-2025-69095 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.
- Product
- Reservation
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Registration & Login with Mobile Phone Number for WooCommerce: Missing AuthorizationCVE-2025-69052 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registration & Login with Mobile Phone Number for WooCommerce: from n/a through <= 1.3.1.
- Product
- Registration & Login with Mobile Phone Number for WooCommerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Registration & Login with Mobile Phone Number for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Solace: Missing AuthorizationCVE-2025-68911 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in solacewp Solace solace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Solace: from n/a through <= 2.1.16.
- Product
- Solace
- Affected
- up to 2.1.16
- What to do
- Affects up to 2.1.16. Update Solace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WDV One Page Docs: Missing AuthorizationCVE-2025-68896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vrpr WDV One Page Docs wdv-one-page-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WDV One Page Docs: from n/a through <= 1.2.4.
- Product
- WDV One Page Docs
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update WDV One Page Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Scalenut: Missing AuthorizationCVE-2025-68882 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Scalenut Scalenut scalenut allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scalenut: from n/a through <= 1.1.5.
- Product
- Scalenut
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Scalenut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Depicter Slider: Missing AuthorizationCVE-2025-68558 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through <= 4.0.4.
- Product
- Depicter Slider
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Icegram: Missing AuthorizationCVE-2025-68507 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35.
- Product
- Icegram
- Affected
- up to 3.1.35
- What to do
- Affects up to 3.1.35. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-68073 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Easy Property Listings: Missing AuthorizationCVE-2025-68072 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.
- Product
- Easy Property Listings
- Affected
- up to 3.5.20
- What to do
- Affects up to 3.5.20. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hotel Listing: Missing AuthorizationCVE-2025-68059 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.
- Product
- Hotel Listing
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Hotel Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Institutions Directory: Missing AuthorizationCVE-2025-68058 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3..4.
- Product
- Institutions Directory
- Affected
- up to 1.3..4
- What to do
- Affects up to 1.3..4. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-68057 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
- Product
- Hospital Doctor Directory
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Contact Form & Lead Form Elementor Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.
- Product
- Contact Form & Lead Form Elementor Builder
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Contact Form & Lead Form Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP BackItUp: Missing AuthorizationCVE-2025-68039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: from n/a through <= 2.1.0.
- Product
- WP BackItUp
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP BackItUp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Notifier: Missing AuthorizationCVE-2025-68020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.13.
- Product
- Notifier
- Affected
- up to 2.7.13
- What to do
- Affects up to 2.7.13. Update Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026SEO Booster: Missing AuthorizationCVE-2025-68019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.
- Product
- SEO Booster
- Affected
- up to 6.1.8
- What to do
- Affects up to 6.1.8. Update SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Order Listener for WooCommerce: Missing AuthorizationCVE-2025-68018 · WordPress plugins & themes · reported by PatchstackCritical 9.4
Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1.
- Product
- Order Listener for WooCommerce
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Order Listener for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026onepay Payment Gateway For WooCommerce: Missing AuthorizationCVE-2025-68016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooCommerce: from n/a through <= 1.1.2.
- Product
- onepay Payment Gateway For WooCommerce
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update onepay Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Payment Gateway Authorize.Net CIM for WooCommerce: Missing AuthorizationCVE-2025-68013 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.
- Product
- Payment Gateway Authorize.Net CIM for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Payment Gateway Authorize.Net CIM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Slider Templates: Missing AuthorizationCVE-2025-68009 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3.
- Product
- Slider Templates
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Slider Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Event Espresso 4 Decaf: Missing AuthorizationCVE-2025-68007 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.37.decaf.
- Product
- Event Espresso 4 Decaf
- Affected
- up to 5.0.37.decaf
- What to do
- Affects up to 5.0.37.decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Shown Connector: Missing AuthorizationCVE-2025-68003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.
- Product
- Shown Connector
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Shown Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.