Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 62 of 126
Jul 4, 2025VG WORT METIS: Missing AuthorizationCVE-2025-50039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VG WORT METIS: from n/a through <= 2.0.1.
- Product
- VG WORT METIS
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update VG WORT METIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025Paytiko for WooCommerce: Missing AuthorizationCVE-2025-50032 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce paytiko allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paytiko for WooCommerce: from n/a through <= 1.3.21.
- Product
- Paytiko for WooCommerce
- Affected
- up to 1.3.21
- What to do
- Affects up to 1.3.21. Update Paytiko for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025MF Plus WPML: Missing AuthorizationCVE-2025-49431 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MF Plus WPML: from n/a through <= 1.1.
- Product
- MF Plus WPML
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MF Plus WPML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025WC Pickup Store: Missing AuthorizationCVE-2025-47634 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Pickup Store: from n/a through <= 1.8.9.
- Product
- WC Pickup Store
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update WC Pickup Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025EventON: Missing AuthorizationCVE-2025-47565 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventON: from n/a through <= 4.9.9.
- Product
- EventON
- Affected
- up to 4.9.9
- What to do
- Affects up to 4.9.9. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025fluXtore: Missing AuthorizationCVE-2025-30929 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fluXtore: from n/a through <= 1.6.0.
- Product
- fluXtore
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update fluXtore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025CF7 7 Mailchimp Add-on: Missing AuthorizationCVE-2025-29012 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 7 Mailchimp Add-on: from n/a through < 2.4.
- Product
- CF7 7 Mailchimp Add-on
- What to do
- Update CF7 7 Mailchimp Add-on to the newest version.
Jul 4, 2025LMSACE Connect: Missing AuthorizationCVE-2025-29007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LMSACE Connect: from n/a through <= 3.4.
- Product
- LMSACE Connect
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update LMSACE Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025WooCommerce Shop Page Builder: Missing AuthorizationCVE-2025-29001 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
- Product
- WooCommerce Shop Page Builder
- Affected
- up to 2.27.7
- What to do
- Affects up to 2.27.7. Update WooCommerce Shop Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025(Simply) Guest Author Name: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24764 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones (Simply) Guest Author Name guest-author-name allows DOM-Based XSS.This issue affects (Simply) Guest Author Name: from n/a through <= 4.36.
- Product
- (Simply) Guest Author Name
- Affected
- up to 4.36
- What to do
- Affects up to 4.36. Update (Simply) Guest Author Name to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025uDesign: Missing AuthorizationCVE-2025-24757 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AndonDesign uDesign udesign.This issue affects uDesign: from n/a through <= 4.11.2.
- Product
- uDesign
- Affected
- up to 4.11.2
- What to do
- Affects up to 4.11.2. Update uDesign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025Avada: Missing AuthorizationCVE-2025-24748 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.
- Product
- Avada
- Affected
- up to 7.11.10
- What to do
- Affects up to 7.11.10. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 3, 2025Booking X: Unauthorized access of dataCVE-2025-6814 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal credentials, by issuing a crafted POST request.
- Product
- Booking X
- Affected
- 1.0 to 1.1.2
- What to do
- Affects 1.0 to 1.1.2. Update Booking X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 3, 2025DocCheck Login: Unauthorized post accessCVE-2025-6786 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirecting a user to login on a password protected post after the page has loaded. This makes it possible for unauthenticated attackers to read posts they should not have access to.
- Product
- DocCheck Login
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update DocCheck Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 3, 2025Melapress File Monitor: Missing AuthorizationCVE-2025-3702 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress File Monitor: from n/a through < 2.2.0.
- Product
- Melapress File Monitor
- Fixed in
- 2.2.0
- What to do
- Update Melapress File Monitor to 2.2.0 or newer.
Jul 2, 2025Mollie Payments for WooCommerce: Missing AuthorizationCVE-2025-39362 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce.This issue affects Mollie Payments for WooCommerce: from n/a through <= 8.0.2.
- Product
- Mollie Payments for WooCommerce
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update Mollie Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2025Soumettre.fr: Unauthorized access and modification of dataCVE-2025-4654 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)
- Product
- Soumettre.fr
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Soumettre.fr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 1, 2025Lead Form Data Collection to CRM: Unauthorized accessCVE-2025-5692 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
- Product
- Lead Form Data Collection to CRM
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 1, 2025The Plus Addons for Elementor Pro: Missing AuthorizationCVE-2025-46259 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a before 6.3.7.
- Product
- The Plus Addons for Elementor Pro
- Fixed in
- 6.3.7
- What to do
- Update The Plus Addons for Elementor Pro to 6.3.7 or newer.
Jun 27, 2025Pre-Publish Post Checklist: Missing AuthorizationCVE-2025-53323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pre-Publish Post Checklist: from n/a through <= 3.1.
- Product
- Pre-Publish Post Checklist
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Pre-Publish Post Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Accept Authorize.NET Payments Using Contact Form 7: Insertion of Sensitive Information Into Sent DataCVE-2025-53322 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 accept-authorize-net-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Authorize.NET Payments Using Contact Form 7: from n/a through <= 2.5.
- Product
- Accept Authorize.NET Payments Using Contact Form 7
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Accept Authorize.NET Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025WP DB Booster: Missing AuthorizationCVE-2025-53318 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPManiax WP DB Booster wp-db-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP DB Booster: from n/a through <= 1.0.1.
- Product
- WP DB Booster
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP DB Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Contact Form – 7 : Hide Success Message: Missing AuthorizationCVE-2025-53304 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form – 7 : Hide Success Message: from n/a through <= 1.1.4.
- Product
- Contact Form – 7 : Hide Success Message
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Contact Form – 7 : Hide Success Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025iCount Payment Gateway: Missing AuthorizationCVE-2025-53295 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through <= 2.0.7.
- Product
- iCount Payment Gateway
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update iCount Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Dashboard Widget Sidebar: Missing AuthorizationCVE-2025-53293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through <= 1.2.3.
- Product
- Dashboard Widget Sidebar
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Dashboard Widget Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025PlatiOnline Payments: Missing AuthorizationCVE-2025-53288 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlatiOnline Payments: from n/a through <= 7.0.0.
- Product
- PlatiOnline Payments
- Affected
- up to 7.0.0
- What to do
- Affects up to 7.0.0. Update PlatiOnline Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025CMS Blocks: Missing AuthorizationCVE-2025-53284 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMS Blocks: from n/a through <= 1.1.
- Product
- CMS Blocks
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CMS Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Cron Logger: Missing AuthorizationCVE-2025-53266 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cron Logger: from n/a through <= 1.3.0.
- Product
- Cron Logger
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Cron Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025HurryTimer: Missing AuthorizationCVE-2025-53255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HurryTimer: from n/a through <= 2.13.1.
- Product
- HurryTimer
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update HurryTimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Audio Editor & Recorder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-53211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Retrieve Embedded Sensitive Data.This issue affects Audio Editor & Recorder: from n/a through <= 2.2.3.
- Product
- Audio Editor & Recorder
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Audio Editor & Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025ChatBot: Missing AuthorizationCVE-2025-53200 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 6.7.3.
- Product
- ChatBot
- Affected
- up to 6.7.3
- What to do
- Affects up to 6.7.3. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Mobile DJ Manager: Missing AuthorizationCVE-2025-52824 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.
- Product
- Mobile DJ Manager
- Affected
- up to 1.7.8.3
- What to do
- Affects up to 1.7.8.3. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Trusty Whistleblowing: Missing AuthorizationCVE-2025-52818 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing trusty-whistleblowing-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusty Whistleblowing: from n/a through <= 2.0.1.
- Product
- Trusty Whistleblowing
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Trusty Whistleblowing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Abandoned Contact Form 7: Missing AuthorizationCVE-2025-52817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Contact Form 7: from n/a through <= 2.2.
- Product
- Abandoned Contact Form 7
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Abandoned Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2025Amazon Products to WooCommerce: Unauthorized modification of dataCVE-2025-5813 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_amazon_product_callback() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to create new produces.
- Product
- Amazon Products to WooCommerce
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Amazon Products to WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 25, 2025VG WORT METIS: Unauthorized modification of dataCVE-2025-5812 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenberg_save_post() function in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited post settings.
- Product
- VG WORT METIS
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update VG WORT METIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 25, 2025Post Carousel Slider for Elementor: Improper authorizationCVE-2025-3863 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the plugin’s support‐form handler to send arbitrary emails to the site’s support address.
- Product
- Post Carousel Slider for Elementor
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Post Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2025Import YouTube videos as WP Posts: Missing AuthorizationCVE-2025-52802 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through <= 2.1.
- Product
- Import YouTube videos as WP Posts
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Import YouTube videos as WP Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025ProfileGrid: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-52719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Retrieve Embedded Sensitive Data.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
- Product
- ProfileGrid
- Affected
- up to 5.9.5.2
- What to do
- Affects up to 5.9.5.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Enhanced Blocks – Page Builder Blocks for Gutenberg: Missing AuthorizationCVE-2025-50034 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks – Page Builder Blocks for Gutenberg enhanced-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Blocks – Page Builder Blocks for Gutenberg: from n/a through <= 1.4.1.
- Product
- Enhanced Blocks – Page Builder Blocks for Gutenberg
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Enhanced Blocks – Page Builder Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Zapier for: Missing AuthorizationCVE-2025-50010 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through <= 1.5.2.
- Product
- Zapier for
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Zapier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Kata Plus: Missing AuthorizationCVE-2025-50009 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kata Plus: from n/a through <= 1.5.3.
- Product
- Kata Plus
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Kata Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: Missing AuthorizationCVE-2025-50008 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: from n/a through <= 1.2.4.5.
- Product
- WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily
- Affected
- up to 1.2.4.5
- What to do
- Affects up to 1.2.4.5. Update WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WooCommerce Fortnox Integration: Missing AuthorizationCVE-2025-49998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Fortnox Integration: from n/a through <= 4.5.5.
- Product
- WooCommerce Fortnox Integration
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update WooCommerce Fortnox Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Giveaways and Contests by RafflePress: Missing AuthorizationCVE-2025-49997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.18.
- Product
- Giveaways and Contests by RafflePress
- Affected
- up to 1.12.18
- What to do
- Affects up to 1.12.18. Update Giveaways and Contests by RafflePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-49996 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 8.4.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 8.4
- What to do
- Affects up to 8.4. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Download Attachments: Authorization Bypass Through User-Controlled KeyCVE-2025-49995 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.3.1.
- Product
- Download Attachments
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Download Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Cookie-Script.com: Missing AuthorizationCVE-2025-49993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in csarturas Cookie-Script.com cookie-script-com allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookie-Script.com: from n/a through <= 1.2.1.
- Product
- Cookie-Script.com
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Cookie-Script.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP-Recall: Missing AuthorizationCVE-2025-49991 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/a through 16.26.14.
- Product
- WP-Recall
- Affected
- up to 16.26.14
- What to do
- Affects up to 16.26.14. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Contentstudio: Missing AuthorizationCVE-2025-49990 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contentstudio: from n/a through <= 1.3.7.
- Product
- Contentstudio
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.