Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 50 of 86
Apr 1, 2025GB Gallery Slideshow: Missing AuthorizationCVE-2025-31732 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GB Gallery Slideshow: from n/a through <= 1.3.
- Product
- GB Gallery Slideshow
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Zoho Flow: Missing AuthorizationCVE-2025-31408 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zoho Flow Zoho Flow zoho-flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through <= 2.13.3.
- Product
- Zoho Flow
- Affected
- up to 2.13.3
- What to do
- Affects up to 2.13.3. Update Zoho Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025YayExtra: Missing AuthorizationCVE-2025-31415 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in YayCommerce YayExtra yayextra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayExtra: from n/a through <= 1.5.2.
- Product
- YayExtra
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update YayExtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Material Dashboard: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31095 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Hossein Material Dashboard material-dashboard allows Authentication Bypass.This issue affects Material Dashboard: from n/a through <= 1.4.5.
- Product
- Material Dashboard
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025King Addons for Elementor: Missing AuthorizationCVE-2025-30926 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in KingAddons.com King Addons for Elementor king-addons.This issue affects King Addons for Elementor: from n/a through <= 24.12.58.
- Product
- King Addons for Elementor
- Affected
- up to 24.12.58
- What to do
- Affects up to 24.12.58. Update King Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Help Desk: Missing AuthorizationCVE-2025-30880 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 2.9.2.
- Product
- JS Help Desk
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Greek Multi Tool – Fix peralinks, accents, auto create menus and more: Missing AuthorizationCVE-2025-30797 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more: from n/a through <= 2.3.1.
- Product
- Greek Multi Tool – Fix peralinks, accents, auto create menus and more
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Greek Multi Tool – Fix peralinks, accents, auto create menus and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Vitepos: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-22277 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.
- Product
- Vitepos
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Gutentor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1986 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Gutentor
- Fixed in
- 3.4.7
- What to do
- Update Gutentor to 3.4.7 or newer.
Mar 31, 2025Processing Projects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31624 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LABCAT Processing Projects processing-projects allows DOM-Based XSS.This issue affects Processing Projects: from n/a through <= 1.0.2.
- Product
- Processing Projects
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Processing Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Connector to CiviCRM with CiviMcRestFace: Missing AuthorizationCVE-2025-31618 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.10.
- Product
- Connector to CiviCRM with CiviMcRestFace
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Connector to CiviCRM with CiviMcRestFace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Auto Post After Image Upload: Missing AuthorizationCVE-2025-31611 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Post After Image Upload: from n/a through <= 1.6.
- Product
- Auto Post After Image Upload
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Auto Post After Image Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025WPCargo Track & Trace: Missing AuthorizationCVE-2025-31609 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
- Product
- WPCargo Track & Trace
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025SP Blog Designer: Missing AuthorizationCVE-2025-31606 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Missing Authorization vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SP Blog Designer: from n/a through <= 1.0.0.
- Product
- SP Blog Designer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SP Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025CF7 Spreadsheets: Missing AuthorizationCVE-2025-31603 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
- Product
- CF7 Spreadsheets
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Chat by Chatwee: Missing AuthorizationCVE-2025-31596 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Chatwee Chat by Chatwee chatwee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chat by Chatwee: from n/a through <= 2.1.3.
- Product
- Chat by Chatwee
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Chat by Chatwee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Elfsight Testimonials Slider: Missing AuthorizationCVE-2025-31584 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
- Product
- Elfsight Testimonials Slider
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025PostmarkApp Email Integrator: Missing AuthorizationCVE-2025-31576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
- Product
- PostmarkApp Email Integrator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025ContentMX Content Publisher: Missing AuthorizationCVE-2025-31555 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ContentMX ContentMX Content Publisher contentmx-content-publisher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ContentMX Content Publisher: from n/a through <= 1.0.6.
- Product
- ContentMX Content Publisher
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update ContentMX Content Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Swiss Toolkit For WP: Missing AuthorizationCVE-2025-31546 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Swiss Toolkit For WP: from n/a through <= 1.4.0.
- Product
- Swiss Toolkit For WP
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Swiss Toolkit For WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Safe Ai Malware Protection for WP: Missing AuthorizationCVE-2025-31545 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Messiah Safe Ai Malware Protection for WP safe-ai-malware-protection-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Safe Ai Malware Protection for WP: from n/a through <= 1.0.20.
- Product
- Safe Ai Malware Protection for WP
- Affected
- up to 1.0.20
- What to do
- Affects up to 1.0.20. Update Safe Ai Malware Protection for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Swiss Toolkit For WP: Missing AuthorizationCVE-2025-31544 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Swiss Toolkit For WP: from n/a through <= 1.4.5.
- Product
- Swiss Toolkit For WP
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Swiss Toolkit For WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025ACME Divi Modules: Missing AuthorizationCVE-2025-31540 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in acmemediakits ACME Divi Modules acme-divi-modules allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACME Divi Modules: from n/a through <= 1.3.5.
- Product
- ACME Divi Modules
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update ACME Divi Modules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Cryptocurrency Widgets Pack: Missing AuthorizationCVE-2025-31539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Blocksera Cryptocurrency Widgets Pack cryptocurrency-widgets-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets Pack: from n/a through <= 2.0.1.
- Product
- Cryptocurrency Widgets Pack
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Cryptocurrency Widgets Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Salesmate Add-On for Gravity Forms: Missing AuthorizationCVE-2025-31533 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Salesmate.io Salesmate Add-On for Gravity Forms gf-salesmate-add-on allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Salesmate Add-On for Gravity Forms: from n/a through <= 2.0.3.
- Product
- Salesmate Add-On for Gravity Forms
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Salesmate Add-On for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Google SEO Pressor Snippet: Missing AuthorizationCVE-2025-31530 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google SEO Pressor Snippet: from n/a through <= 2.0.
- Product
- Google SEO Pressor Snippet
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Google SEO Pressor Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Slider Path for Elementor: Missing AuthorizationCVE-2025-31529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rashid Slider Path for Elementor slider-path allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Path for Elementor: from n/a through <= 3.0.0.
- Product
- Slider Path for Elementor
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Slider Path for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025StaticPress: Missing AuthorizationCVE-2025-31528 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wokamoto StaticPress staticpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StaticPress: from n/a through <= 0.4.5.
- Product
- StaticPress
- Affected
- up to 0.4.5
- What to do
- Affects up to 0.4.5. Update StaticPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Simple:Press: Missing AuthorizationCVE-2025-31386 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in simplepress Simple:Press simplepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple:Press: from n/a through <= 6.11.5.
- Product
- Simple:Press
- Affected
- up to 6.11.5
- What to do
- Affects up to 6.11.5. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025NanoSupport: Missing AuthorizationCVE-2025-31376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mayeenul Islam NanoSupport nanosupport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NanoSupport: from n/a through <= 0.6.0.
- Product
- NanoSupport
- Affected
- up to 0.6.0
- What to do
- Affects up to 0.6.0. Update NanoSupport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025ELEX WooCommerce Request a Quote: Missing AuthorizationCVE-2025-31406 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ELEXtensions ELEX WooCommerce Request a Quote elex-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Request a Quote: from n/a through <= 2.3.9.
- Product
- ELEX WooCommerce Request a Quote
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update ELEX WooCommerce Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025WP Docs: Missing AuthorizationCVE-2025-31417 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through < 2.2.7.
- Product
- WP Docs
- What to do
- Update WP Docs to the newest version.
Mar 31, 2025Ads by WPQuads: Missing AuthorizationCVE-2025-30855 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads by WPQuads: from n/a through <= 2.0.87.1.
- Product
- Ads by WPQuads
- Affected
- up to 2.0.87.1
- What to do
- Affects up to 2.0.87.1. Update Ads by WPQuads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Clear Sucuri Cache: Missing AuthorizationCVE-2025-31469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in webrangers Clear Sucuri Cache clear-sucuri-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clear Sucuri Cache: from n/a through <= 1.4.
- Product
- Clear Sucuri Cache
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Clear Sucuri Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Traveler: Missing AuthorizationCVE-2025-26956 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 27, 2025Traveler: Missing AuthorizationCVE-2025-26733 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 27, 2025Sensei LMS: Missing AuthorizationCVE-2025-22740 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Sensei LMS sensei-lms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sensei LMS: from n/a through <= 4.24.4.
- Product
- Sensei LMS
- Affected
- up to 4.24.4
- What to do
- Affects up to 4.24.4. Update Sensei LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025LearnPress: Missing AuthorizationCVE-2025-22739 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.7.5.
- Product
- LearnPress
- Affected
- up to 4.2.7.5
- What to do
- Affects up to 4.2.7.5. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025iNET Webkit: Missing AuthorizationCVE-2025-22629 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through <= 1.2.2.
- Product
- iNET Webkit
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update iNET Webkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Disable Elementor Editor Translation: Missing AuthorizationCVE-2025-22671 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Leap13 Disable Elementor Editor Translation disable-elementor-editor-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Disable Elementor Editor Translation: from n/a through <= 1.0.2.
- Product
- Disable Elementor Editor Translation
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Disable Elementor Editor Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025VikBooking Hotel Booking Engine & PMS: Missing AuthorizationCVE-2025-22670 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.7.2.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Awesome Event Booking: Missing AuthorizationCVE-2025-22668 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Event Booking: from n/a through <= 2.7.2.
- Product
- Awesome Event Booking
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Awesome Event Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: Missing AuthorizationCVE-2025-22667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Creative Werk Designs Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets wpsyncsheets-woocommerce.This issue affects Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: from n/a through <= 1.8.2.
- Product
- Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025RapidLoad: Missing AuthorizationCVE-2025-22665 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shakeeb Sadikeen RapidLoad unusedcss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RapidLoad: from n/a through <= 2.4.4.
- Product
- RapidLoad
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update RapidLoad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025AIO Performance Profiler, Monitor, Optimize, Compress & Debug: Missing AuthorizationCVE-2025-22647 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-performance-accelerator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO Performance Profiler, Monitor, Optimize, Compress & Debug: from n/a through <= 1.2.
- Product
- AIO Performance Profiler, Monitor, Optimize, Compress & Debug
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update AIO Performance Profiler, Monitor, Optimize, Compress & Debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Envo Multipurpose: Missing AuthorizationCVE-2025-22770 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in EnvoThemes Envo Multipurpose allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Multipurpose: from n/a through 1.1.6.
- Product
- Envo Multipurpose
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Envo Multipurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025EAN for WooCommerce: Missing AuthorizationCVE-2025-22673 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EAN for WooCommerce: from n/a through <= 5.3.5.
- Product
- EAN for WooCommerce
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update EAN for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Conversios.io: Missing AuthorizationCVE-2025-30909 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.3.
- Product
- Conversios.io
- Affected
- up to 7.2.3
- What to do
- Affects up to 7.2.3. Update Conversios.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Analytify: Missing AuthorizationCVE-2025-30897 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.5.1.
- Product
- Analytify
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WP ERP: Missing AuthorizationCVE-2025-30896 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.13.4.
- Product
- WP ERP
- Affected
- up to 1.13.4
- What to do
- Affects up to 1.13.4. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.