Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 60 of 126
Aug 28, 2025Page Manager for Elementor: Missing AuthorizationCVE-2025-53230 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.
- Product
- Page Manager for Elementor
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Page Manager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025AutoWP: Missing AuthorizationCVE-2025-48350 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.7.
- Product
- AutoWP
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update AutoWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025WP Mailgun SMTP: Missing AuthorizationCVE-2025-48327 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Mailgun SMTP: from n/a through <= 1.0.7.
- Product
- WP Mailgun SMTP
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update WP Mailgun SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2025Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Unauthorized access of dataCVE-2025-9376 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality.
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Affected
- up to 11.58
- What to do
- Affects up to 11.58. Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2025Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpreCVE-2025-0951 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
Aug 27, 2025AfterShip Tracking: Missing AuthorizationCVE-2025-58201 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AfterShip & Automizely AfterShip Tracking aftership-woocommerce-tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AfterShip Tracking: from n/a through <= 1.17.17.
- Product
- AfterShip Tracking
- Affected
- up to 1.17.17
- What to do
- Affects up to 1.17.17. Update AfterShip Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2025Xpro Theme Builder: Missing AuthorizationCVE-2025-58198 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Theme Builder: from n/a through <= 1.2.9.
- Product
- Xpro Theme Builder
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Xpro Theme Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2025Uncanny Automator: Missing AuthorizationCVE-2025-58193 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through <= 6.7.0.1.
- Product
- Uncanny Automator
- Affected
- up to 6.7.0.1
- What to do
- Affects up to 6.7.0.1. Update Uncanny Automator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2025WP Bulk Delete: Missing AuthorizationCVE-2025-58192 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through <= 1.3.6.
- Product
- WP Bulk Delete
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update WP Bulk Delete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2025School Management: Missing AuthorizationCVE-2025-48108 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects School Management: from n/a through 93.2.0.
- Product
- School Management
- Affected
- up to 93.2.0
- What to do
- Affects up to 93.2.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2025Tourfic: Unauthorized modification of dataCVE-2024-8860 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions in all versions up to, and including, 2.14.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively.
- Product
- Tourfic
- Affected
- up to 2.14.5
- What to do
- Affects up to 2.14.5. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 23, 2025WP Filter & Combine RSS Feeds: Unauthorized modification of dataCVE-2025-7828 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Filter & Combine RSS Feeds plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the post_listing_page() function in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete feeds.
- Product
- WP Filter & Combine RSS Feeds
- Affected
- up to 0.4
- What to do
- Affects up to 0.4. Update WP Filter & Combine RSS Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Aug 23, 2025Ni WooCommerce Customer Product Report: Unauthorized modification of dataCVE-2025-7827 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_woocpr_action() function in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings.
- Product
- Ni WooCommerce Customer Product Report
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Ni WooCommerce Customer Product Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Aug 23, 2025WC Plus: Unauthorized modification of dataCVE-2025-7821 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJAX action in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update the site's favicon logo base.
- Product
- WC Plus
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WC Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Aug 22, 2025Spacious: Unauthorized modification of dataCVE-2025-9331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo data into the site.
- Product
- Spacious
- Affected
- up to 1.9.11
- What to do
- Affects up to 1.9.11. Update Spacious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.cleantalk.orgthemes.trac.wordpress.org
Aug 22, 2025Church Admin: Missing AuthorizationCVE-2025-57896 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.26.
- Product
- Church Admin
- Affected
- up to 5.0.26
- What to do
- Affects up to 5.0.26. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2025WPPizza: Missing AuthorizationCVE-2025-57894 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ollybach WPPizza wppizza allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPPizza: from n/a through <= 3.19.8.
- Product
- WPPizza
- Affected
- up to 3.19.8
- What to do
- Affects up to 3.19.8. Update WPPizza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2025Jobmonster: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-57888 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensitive Data.This issue affects Jobmonster: from n/a through <= 4.8.0.
- Product
- Jobmonster
- Affected
- up to 4.8.0
- What to do
- Affects up to 4.8.0. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2025Accessibility Checker by Equalize Digital: Authorization Bypass Through User-Controlled KeyCVE-2025-57886 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.30.0.
- Product
- Accessibility Checker by Equalize Digital
- Affected
- up to 1.30.0
- What to do
- Affects up to 1.30.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2025Greenshift: Missing AuthorizationCVE-2025-57884 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greenshift: from n/a through <= 12.1.1.
- Product
- Greenshift
- Affected
- up to 12.1.1
- What to do
- Affects up to 12.1.1. Update Greenshift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-7221 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 21, 2025ProveSource Social Proof: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-48355 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ProveSource LTD ProveSource Social Proof provesource allows Retrieve Embedded Sensitive Data.This issue affects ProveSource Social Proof: from n/a through <= 3.1.2.
- Product
- ProveSource Social Proof
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update ProveSource Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Webba Booking: Missing AuthorizationCVE-2025-54040 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 5.1.20.
- Product
- Webba Booking
- Affected
- up to 5.1.20
- What to do
- Affects up to 5.1.20. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Coupon Affiliates: Missing AuthorizationCVE-2025-54025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.
- Product
- Coupon Affiliates
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Maya Business: Authorization Bypass Through User-Controlled KeyCVE-2025-53208 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through <= 1.2.0.
- Product
- Maya Business
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Maya Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Houzez: Missing AuthorizationCVE-2025-49406 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1.
- Product
- Houzez
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Themify Builder: Missing AuthorizationCVE-2025-49396 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themify Builder: from n/a through <= 7.6.7.
- Product
- Themify Builder
- Affected
- up to 7.6.7
- What to do
- Affects up to 7.6.7. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025ColorMag: Unauthorized modification of dataCVE-2025-9202 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the ThemeGrill Demo Importer plugin.
- Product
- ColorMag
- Affected
- up to 4.0.19
- What to do
- Affects up to 4.0.19. Update ColorMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.cleantalk.orgthemes.trac.wordpress.org
Aug 16, 2025AL Pack: Unauthorized accessCVE-2025-7664 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.1.1. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.
- Product
- AL Pack
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update AL Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2025WPGYM - Wordpress Gym Management System: Unauthorized admin account creationCVE-2025-6080 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67.7.0. This is due to the plugin not properly validating a user's capabilities prior to adding users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new users, including admins.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.7.0
- What to do
- Affects up to 67.7.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Aug 15, 2025Ultimate Video Player: Missing AuthorizationCVE-2025-49432 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FWDesign Ultimate Video Player fwduvp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Video Player: from n/a through <= 10.1.
- Product
- Ultimate Video Player
- Affected
- up to 10.1
- What to do
- Affects up to 10.1. Update Ultimate Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Statistics: Missing AuthorizationCVE-2025-55716 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Statistics: from n/a through <= 14.15.
- Product
- WP Statistics
- Affected
- up to 14.15
- What to do
- Affects up to 14.15. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025The Plus Addons for Elementor Page Builder Lite: Missing AuthorizationCVE-2025-55712 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 6.3.13.
- Product
- The Plus Addons for Elementor Page Builder Lite
- Affected
- up to 6.3.13
- What to do
- Affects up to 6.3.13. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Nexter Blocks: Missing AuthorizationCVE-2025-54739 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nexter Blocks: from n/a through <= 4.5.4.
- Product
- Nexter Blocks
- Affected
- up to 4.5.4
- What to do
- Affects up to 4.5.4. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Savoy: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-54736 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This issue affects Savoy: from n/a through <= 3.0.8.
- Product
- Savoy
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Savoy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Embedder for Google Reviews: Missing AuthorizationCVE-2025-54730 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews embedder-for-google-reviews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embedder for Google Reviews: from n/a through <= 1.7.3.
- Product
- Embedder for Google Reviews
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Embedder for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Membership: Missing AuthorizationCVE-2025-54717 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.3.
- Product
- WP Membership
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Easy Elementor Addons: Missing AuthorizationCVE-2025-54712 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Elementor Addons: from n/a through <= 2.2.7.
- Product
- Easy Elementor Addons
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Modernize: Missing AuthorizationCVE-2025-53343 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoodLayers Modernize modernize allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modernize: from n/a through <= 3.4.0.
- Product
- Modernize
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Modernize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025App, SaaS & Software Startup Tech Theme - Stratus: Missing AuthorizationCVE-2025-53341 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pixel Makers Creative INC. App, SaaS & Software Startup Tech Theme - Stratus allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects App, SaaS & Software Startup Tech Theme - Stratus: from n/a before 4.2.11.
- Product
- App, SaaS & Software Startup Tech Theme - Stratus
- Fixed in
- 4.2.11
- What to do
- Update App, SaaS & Software Startup Tech Theme - Stratus to 4.2.11 or newer.
Aug 14, 2025CodeablePress: Missing AuthorizationCVE-2025-53221 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in codeablepress CodeablePress codeablepress-simple-frontend-profile-picture-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CodeablePress: from n/a through <= 1.0.2.
- Product
- CodeablePress
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update CodeablePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WpEvently: Missing AuthorizationCVE-2025-54705 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 4.4.6.
- Product
- WpEvently
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025HT Mega: Missing AuthorizationCVE-2025-54695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in DevItems HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through <= 2.9.0.
- Product
- HT Mega
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update HT Mega to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Membership For WooCommerce: Missing AuthorizationCVE-2025-54692 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.9.0.
- Product
- Membership For WooCommerce
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Motors: Authorization Bypass Through User-Controlled KeyCVE-2025-54691 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through <= 1.4.80.
- Product
- Motors
- Affected
- up to 1.4.80
- What to do
- Affects up to 1.4.80. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Neon Channel Product Customizer Free: Missing AuthorizationCVE-2025-54679 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free neon-channel-product-customizer-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Neon Channel Product Customizer Free: from n/a through <= 2.0.
- Product
- Neon Channel Product Customizer Free
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Neon Channel Product Customizer Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025TheBooking: Missing AuthorizationCVE-2025-52801 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in VonStroheim TheBooking thebooking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TheBooking: from n/a through <= 1.4.4.
- Product
- TheBooking
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update TheBooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025The E-Commerce ERP: Missing AuthorizationCVE-2025-52800 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.
- Product
- The E-Commerce ERP
- Affected
- up to 2.1.1.3
- What to do
- Affects up to 2.1.1.3. Update The E-Commerce ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025SMM API: Missing AuthorizationCVE-2025-52785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through <= 6.0.31.
- Product
- SMM API
- Affected
- up to 6.0.31
- What to do
- Affects up to 6.0.31. Update SMM API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Project Cost Calculator: Missing AuthorizationCVE-2025-52775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through <= 1.0.0.
- Product
- Project Cost Calculator
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Project Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.