Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 44 of 86
Jun 6, 2025GPP Slideshow: Missing AuthorizationCVE-2025-28996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Thad Allender GPP Slideshow gpp-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GPP Slideshow: from n/a through <= 1.3.5.
- Product
- GPP Slideshow
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update GPP Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Viral Loops WP Integration: Missing AuthorizationCVE-2025-28995 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Loops WP Integration: from n/a through <= 3.8.1.
- Product
- Viral Loops WP Integration
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Viral Loops WP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Viral Loops WP Integration: Missing AuthorizationCVE-2025-28994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Loops WP Integration: from n/a through <= 3.8.1.
- Product
- Viral Loops WP Integration
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Viral Loops WP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Elastic Email Subscribe Form: Missing AuthorizationCVE-2025-28985 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Elastic Email Elastic Email Subscribe Form elastic-email-subscribe-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Subscribe Form: from n/a through <= 1.2.2.
- Product
- Elastic Email Subscribe Form
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Elastic Email Subscribe Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025No Spam At All: Missing AuthorizationCVE-2025-24778 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in De paragon No Spam At All no-spam-at-all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects No Spam At All: from n/a through <= 1.3.
- Product
- No Spam At All
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update No Spam At All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Responsive Flipbooks: Missing AuthorizationCVE-2025-24776 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codelobster Responsive Flipbooks responsive-flipbooks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Flipbooks: from n/a through <= 1.0.
- Product
- Responsive Flipbooks
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Responsive Flipbooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025bbPress API: Missing AuthorizationCVE-2025-24763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pascal Casier bbPress API bbp-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects bbPress API: from n/a through <= 1.0.14.
- Product
- bbPress API
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update bbPress API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025TicketBAI Facturas para WooCommerce: Missing AuthorizationCVE-2025-24762 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TicketBAI Facturas para WooCommerce: from n/a through <= 3.45.
- Product
- TicketBAI Facturas para WooCommerce
- Affected
- up to 3.45
- What to do
- Affects up to 3.45. Update TicketBAI Facturas para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025KI Live Video Conferences: Missing AuthorizationCVE-2025-23971 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
- Product
- KI Live Video Conferences
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 20256Storage Rentals: Missing AuthorizationCVE-2023-26002 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5.
- Product
- 6Storage Rentals
- Affected
- up to 2.19.5
- What to do
- Affects up to 2.19.5. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Sola Support Ticket: Missing AuthorizationCVE-2023-25997 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a through 3.17.
- Product
- Sola Support Ticket
- Affected
- up to 3.17
- What to do
- Affects up to 3.17. Update Sola Support Ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025QuickCab: Missing AuthorizationCVE-2025-48337 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuickcabWP QuickCab.This issue affects QuickCab: from n/a through 1.3.3.
- Product
- QuickCab
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update QuickCab to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Responsive Plus: Missing AuthorizationCVE-2025-48335 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Plus: from n/a through <= 3.2.0.
- Product
- Responsive Plus
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Responsive Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025BM Content Builder: Unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' functionCVE-2025-1777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BM Content Builder
- Affected
- up to 3.16.2.1
- What to do
- Affects up to 3.16.2.1. Update BM Content Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseatheme.networdfence.com
Jun 6, 2025Short URL: Does not properly sanitise and escape a parameter before using it in SQL statementCVE-2023-2921 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers.
- Product
- Short URL
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update Short URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2025Uncanny Automator: Missing AuthorizationCVE-2025-48133 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through <= 6.4.0.2.
- Product
- Uncanny Automator
- Affected
- up to 6.4.0.2
- What to do
- Affects up to 6.4.0.2. Update Uncanny Automator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2025Element Pack Pro: Missing AuthorizationCVE-2025-46258 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BdThemes Element Pack Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Pack Pro: from n/a before 8.0.0.
- Product
- Element Pack Pro
- Fixed in
- 8.0.0
- What to do
- Update Element Pack Pro to 8.0.0 or newer.
Jun 4, 2025File Provider: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-4578 · WordPress plugins & themes · reported by WPScanCritical 9.8
The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- File Provider
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update File Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 3, 2025FancyBox for: Does not escape captions and titles attributes before using them to populate galleries' caption fieldsCVE-2025-3662 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS
- Product
- FancyBox for
- Fixed in
- 3.3.6
- What to do
- Update FancyBox for to 3.3.6 or newer.
Jun 2, 2025Booking and Rental Manager: Missing AuthorizationCVE-2025-47585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking and Rental Manager: from n/a through <= 2.3.8.
- Product
- Booking and Rental Manager
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025Woo Slider Pro: Missing AuthorizationCVE-2025-48334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro woo-slider-pro-drag-drop-slider-builder-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Slider Pro: from n/a through <= 1.12.
- Product
- Woo Slider Pro
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Woo Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Visual Header: Missing AuthorizationCVE-2025-48275 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in dastan800 Visual Header visual-header allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Header: from n/a through <= 1.3.
- Product
- Visual Header
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Visual Header to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Leadinfo: Missing AuthorizationCVE-2025-48271 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Leadinfo Leadinfo leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadinfo: from n/a through <= 1.1.
- Product
- Leadinfo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Leadinfo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Lead Form Data Collection to CRM: Missing AuthorizationCVE-2025-47690 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.
- Product
- Lead Form Data Collection to CRM
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 20256Storage Rentals: Missing AuthorizationCVE-2025-47619 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Path Traversal.This issue affects 6Storage Rentals: from n/a through <= 2.20.2.
- Product
- 6Storage Rentals
- Affected
- up to 2.20.2
- What to do
- Affects up to 2.20.2. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025MapSVG: Missing AuthorizationCVE-2025-47558 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MapSVG: from n/a through < 8.6.13.
- Product
- MapSVG
- What to do
- Update MapSVG to the newest version.
May 23, 2025Experto CTA Widget – Call To Action, Sticky CTA, Floating Button: Missing AuthorizationCVE-2025-47529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in UX Design Experts Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin experto-cta-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin: from n/a through <= 1.1.1.
- Product
- Experto CTA Widget – Call To Action, Sticky CTA, Floating Button
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Experto CTA Widget – Call To Action, Sticky CTA, Floating Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Subaccounts for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-47461 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in mediaticus Subaccounts for WooCommerce subaccounts-for-woocommerce allows Authentication Abuse.This issue affects Subaccounts for WooCommerce: from n/a through <= 1.6.6.
- Product
- Subaccounts for WooCommerce
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Subaccounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Visual Builder: Missing AuthorizationCVE-2025-46488 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in dastan800 Visual Builder visual-builder allows Reflected XSS.This issue affects Visual Builder: from n/a through <= 1.2.2.
- Product
- Visual Builder
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Visual Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Nomupay Payment Processing Gateway: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-46486 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from n/a through <= 7.1.7.
- Product
- Nomupay Payment Processing Gateway
- Affected
- up to 7.1.7
- What to do
- Affects up to 7.1.7. Update Nomupay Payment Processing Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025JobHunt Job Alerts: Missing AuthorizationCVE-2025-39536 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Chimpstudio JobHunt Job Alerts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobHunt Job Alerts: from n/a through 3.6.
- Product
- JobHunt Job Alerts
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update JobHunt Job Alerts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Restaurant: Missing AuthorizationCVE-2025-39352 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025wProject: Missing AuthorizationCVE-2025-39350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0.
- Product
- wProject
- Fixed in
- 5.8.0
- What to do
- Update wProject to 5.8.0 or newer.
May 19, 2025Custom PC Builder Lite for WooCommerce: Missing AuthorizationCVE-2025-43838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ChoPlugins.com Custom PC Builder Lite for WooCommerce custom-pc-builder-lite-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom PC Builder Lite for WooCommerce: from n/a through <= 1.0.1.
- Product
- Custom PC Builder Lite for WooCommerce
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Custom PC Builder Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025JetBlocks For Elementor: Missing AuthorizationCVE-2025-39451 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.16.
- Product
- JetBlocks For Elementor
- Affected
- up to 1.3.16
- What to do
- Affects up to 1.3.16. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025JetWooBuilder: Missing AuthorizationCVE-2025-39449 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetWooBuilder: from n/a through <= 2.1.18.
- Product
- JetWooBuilder
- Affected
- up to 2.1.18
- What to do
- Affects up to 2.1.18. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025JetElements For Elementor: Missing AuthorizationCVE-2025-39447 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetElements For Elementor jet-elements allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.
- Product
- JetElements For Elementor
- Affected
- up to 2.7.4.1
- What to do
- Affects up to 2.7.4.1. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Eduma: Missing AuthorizationCVE-2025-39460 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress Eduma eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma: from n/a through <= 5.6.4.
- Product
- Eduma
- Affected
- up to 5.6.4
- What to do
- Affects up to 5.6.4. Update Eduma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Name Directory: Missing AuthorizationCVE-2025-39454 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.30.0.
- Product
- Name Directory
- Affected
- up to 1.30.0
- What to do
- Affects up to 1.30.0. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Master Slider: Missing AuthorizationCVE-2025-39412 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in averta Master Slider master-slider.This issue affects Master Slider: from n/a through <= 3.11.0.
- Product
- Master Slider
- Affected
- up to 3.11.0
- What to do
- Affects up to 3.11.0. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Bellevue: Missing AuthorizationCVE-2025-39398 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2.
- Product
- Bellevue
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update Bellevue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025LTL Freight Quotes – FreightQuote Edition: Missing AuthorizationCVE-2025-22287 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through <= 2.3.11.
- Product
- LTL Freight Quotes – FreightQuote Edition
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update LTL Freight Quotes – FreightQuote Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025AnalyticsWP: Missing AuthorizationCVE-2025-39388 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0.
- Product
- AnalyticsWP
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update AnalyticsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Car Park Booking System for: Missing AuthorizationCVE-2025-39376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in QuanticaLabs Car Park Booking System for WordPress car-park-booking-system-for-wordpress.This issue affects Car Park Booking System for WordPress: from n/a through <= 2.6.
- Product
- Car Park Booking System for
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Car Park Booking System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025JNews: Missing AuthorizationCVE-2025-39373 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jegtheme JNews jnews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JNews: from n/a through <= 11.6.16.
- Product
- JNews
- Affected
- up to 11.6.16
- What to do
- Affects up to 11.6.16. Update JNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Rootspersona: Missing AuthorizationCVE-2025-39368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ed4becky Rootspersona rootspersona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rootspersona: from n/a through <= 3.7.5.
- Product
- Rootspersona
- Affected
- up to 3.7.5
- What to do
- Affects up to 3.7.5. Update Rootspersona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Restaurant: Missing AuthorizationCVE-2025-39353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Customify: Missing AuthorizationCVE-2025-26920 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in pressmaximum Customify customify-theme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customify: from n/a through <= 0.4.8.
- Product
- Customify
- Affected
- up to 0.4.8
- What to do
- Affects up to 0.4.8. Update Customify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Bulk: Missing AuthorizationCVE-2025-26867 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11.
- Product
- Bulk
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Bulk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Masteriyo - LMS: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-33939 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.
- Product
- Masteriyo - LMS
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.