Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 59 of 126
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
- Product
- Accessibility Checker by Equalize Digital
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Kalium: Missing AuthorizationCVE-2025-53348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.
- Product
- Kalium
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update Kalium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Awesome Support: Missing AuthorizationCVE-2025-53340 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Support: from n/a through <= 6.3.6.
- Product
- Awesome Support
- Affected
- up to 6.3.6
- What to do
- Affects up to 6.3.6. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Spreadconnect: Missing AuthorizationCVE-2025-53291 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5.
- Product
- Spreadconnect
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Spreadconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Majestic Support: Missing AuthorizationCVE-2025-49860 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.
- Product
- Majestic Support
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Church Admin: Missing AuthorizationCVE-2025-39553 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.
- Product
- Church Admin
- Affected
- up to 5.0.9
- What to do
- Affects up to 5.0.9. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025WP Simple Booking Calendar: Missing AuthorizationCVE-2025-39541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/a through <= 2.0.13.
- Product
- WP Simple Booking Calendar
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update WP Simple Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Target Video Easy Publish: Missing AuthorizationCVE-2025-32688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through <= 3.8.9.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.9
- What to do
- Affects up to 3.8.9. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Unauthorized access and modification of dataCVE-2025-9542 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify integration settings or view existing automations.
- Product
- AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in
- Affected
- up to 5.3.7
- What to do
- Affects up to 5.3.7. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2025AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Unauthorized modification of dataCVE-2025-9539 · WordPress plugins & themes · reported by WordfenceHigh 8
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator
- Product
- AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in
- Affected
- up to 5.3.6
- What to do
- Affects up to 5.3.6. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 8, 2025Ditty: Lacks authorization and authentication for requests to its displayItems endpointCVE-2025-8085 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
- Product
- Ditty
- Fixed in
- 3.1.58
- What to do
- Update Ditty to 3.1.58 or newer.
Sep 6, 2025Cloud SAML SSO: Unauthorized modification of dataCVE-2025-7040 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings' action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters for organization settings and passes them directly to update_option() without any check of the user’s capabilities or a CSRF nonce. This makes it possible for unauthenticated attackers to change critical configuration (including toggling signing and encryption), potentially breaking the SSO flow and causing a denial-of-service.
- Product
- Cloud SAML SSO
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Cloud SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-54744 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.15.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.15
- What to do
- Affects up to 3.6.15. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025HAPPY: Missing AuthorizationCVE-2025-53571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.6.
- Product
- HAPPY
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Site Info: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58866 · WordPress plugins & themes · reported by PatchstackLow 2.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Rami Yushuvaev Site Info site-info-dashboard-widget allows Retrieve Embedded Sensitive Data.This issue affects Site Info: from n/a through <= 1.1.
- Product
- Site Info
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Site Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Media Author: Incorrect Privilege AssignmentCVE-2025-58841 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a through <= 1.0.4.
- Product
- Media Author
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Media Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Shk Corporate: Missing AuthorizationCVE-2025-58824 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shk Corporate: from n/a through <= 2.4.1.1.
- Product
- Shk Corporate
- Affected
- up to 2.4.1.1
- What to do
- Affects up to 2.4.1.1. Update Shk Corporate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025SoftMe: Missing AuthorizationCVE-2025-58817 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoftMe: from n/a through <= 1.1.27.
- Product
- SoftMe
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update SoftMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Product Carousel Slider for Elementor: Missing AuthorizationCVE-2025-58816 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Carousel Slider for Elementor: from n/a through <= 2.1.3.
- Product
- Product Carousel Slider for Elementor
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Product Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Consultstreet: Missing AuthorizationCVE-2025-58813 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Consultstreet: from n/a through <= 3.0.0.
- Product
- Consultstreet
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Consultstreet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ninja Charts: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58797 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embedded Sensitive Data.This issue affects Ninja Charts: from n/a through <= 3.3.5.
- Product
- Ninja Charts
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Ninja Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Payoneer Checkout: Missing AuthorizationCVE-2025-58795 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through <= 3.4.0.
- Product
- Payoneer Checkout
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Payoneer Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Authors List: Cross-Site Request Forgery (CSRF)CVE-2025-58792 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a through <= 2.0.6.2.
- Product
- Authors List
- Affected
- up to 2.0.6.2
- What to do
- Affects up to 2.0.6.2. Update Authors List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ray Enterprise Translation: Missing AuthorizationCVE-2025-58785 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.2.
- Product
- Ray Enterprise Translation
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Gutentor: Missing AuthorizationCVE-2025-58783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.5.
- Product
- Gutentor
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update Gutentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025AI Engine: Unauthorized access and loss of dataCVE-2025-8268 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded by other users.
- Product
- AI Engine
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2025Contact Form By Mega Forms: Missing AuthorizationCVE-2025-58639 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms mega-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form By Mega Forms: from n/a through <= 1.6.1.
- Product
- Contact Form By Mega Forms
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Contact Form By Mega Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Support Genix: Missing AuthorizationCVE-2025-58635 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.23.
- Product
- Support Genix
- Affected
- up to 1.4.23
- What to do
- Affects up to 1.4.23. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025PeachPay Payments: Missing AuthorizationCVE-2025-58634 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in peachpay PeachPay Payments peachpay-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PeachPay Payments: from n/a through <= 1.117.4.
- Product
- PeachPay Payments
- Affected
- up to 1.117.4
- What to do
- Affects up to 1.117.4. Update PeachPay Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Mobile Contact Line: Missing AuthorizationCVE-2025-58622 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile Contact Line: from n/a through <= 2.4.0.
- Product
- Mobile Contact Line
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Mobile Contact Line to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025F4 Media Taxonomies: Missing AuthorizationCVE-2025-58617 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F4 Media Taxonomies: from n/a through <= 1.1.4.
- Product
- F4 Media Taxonomies
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update F4 Media Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Frisbii Pay: Missing AuthorizationCVE-2025-58616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frisbii Pay: from n/a through <= 1.8.2.1.
- Product
- Frisbii Pay
- Affected
- up to 1.8.2.1
- What to do
- Affects up to 1.8.2.1. Update Frisbii Pay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Posts Table with Search & Sort: Missing AuthorizationCVE-2025-58613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through <= 1.4.10.
- Product
- Posts Table with Search & Sort
- Affected
- up to 1.4.10
- What to do
- Affects up to 1.4.10. Update Posts Table with Search & Sort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025SaasLauncher: Missing AuthorizationCVE-2025-58606 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.
- Product
- SaasLauncher
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update SaasLauncher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Surfer: Missing AuthorizationCVE-2025-58603 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.
- Product
- Surfer
- Affected
- up to 1.6.4.574
- What to do
- Affects up to 1.6.4.574. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Classified Listing: Missing AuthorizationCVE-2025-58601 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.
- Product
- Classified Listing
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Paid Member Subscriptions: Missing AuthorizationCVE-2025-58600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.
- Product
- Paid Member Subscriptions
- Affected
- up to 2.15.9
- What to do
- Affects up to 2.15.9. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-58599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.
- Product
- Order Delivery Date for WooCommerce
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2025-58597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.
- Product
- wpForo Forum
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Brizy: Missing AuthorizationCVE-2025-58594 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.12.
- Product
- Brizy
- Affected
- up to 2.7.12
- What to do
- Affects up to 2.7.12. Update Brizy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Malcure Malware Scanner: Missing AuthorizationCVE-2025-3701 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Malcure Malware Scanner: from n/a through <= 16.8.
- Product
- Malcure Malware Scanner
- Affected
- up to 16.8
- What to do
- Affects up to 16.8. Update Malcure Malware Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Makeaholic: Missing AuthorizationCVE-2025-58210 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through <= 1.8.5.
- Product
- Makeaholic
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update Makeaholic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025Login with phone number: Missing AuthorizationCVE-2024-32832 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
- Product
- Login with phone number
- Affected
- up to 1.6.93
- What to do
- Affects up to 1.6.93. Update Login with phone number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2025Barcode Scanner with Inventory & Order Manager: Missing AuthorizationCVE-2024-32589 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.
- Product
- Barcode Scanner with Inventory & Order Manager
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2025LWSCache: Unauthorized modification of dataCVE-2025-8147 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function in all versions up to, and including, 2.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate arbitrary whitelisted LWS plugins.
- Product
- LWSCache
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update LWSCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2025B Slider: Missing AuthorizationCVE-2025-54734 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Slider: from n/a through <= 1.1.30.
- Product
- B Slider
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update B Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025All Bootstrap Blocks: Missing AuthorizationCVE-2025-54733 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All Bootstrap Blocks: from n/a through <= 1.3.28.
- Product
- All Bootstrap Blocks
- Affected
- up to 1.3.28
- What to do
- Affects up to 1.3.28. Update All Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025Zephyr Project Manager: Missing AuthorizationCVE-2025-54714 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.201.
- Product
- Zephyr Project Manager
- Affected
- up to 3.3.201
- What to do
- Affects up to 3.3.201. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025Tiktok Feed: Missing AuthorizationCVE-2025-54710 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tiktok Feed: from n/a through <= 1.0.21.
- Product
- Tiktok Feed
- Affected
- up to 1.0.21
- What to do
- Affects up to 1.0.21. Update Tiktok Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025LifePress: Missing AuthorizationCVE-2025-53337 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LifePress: from n/a through <= 2.1.3.
- Product
- LifePress
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update LifePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.