Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 65 of 126
May 23, 2025Leadinfo: Missing AuthorizationCVE-2025-48271 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Leadinfo Leadinfo leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadinfo: from n/a through <= 1.1.
- Product
- Leadinfo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Leadinfo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Lead Form Data Collection to CRM: Missing AuthorizationCVE-2025-47690 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.
- Product
- Lead Form Data Collection to CRM
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 20256Storage Rentals: Missing AuthorizationCVE-2025-47619 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Path Traversal.This issue affects 6Storage Rentals: from n/a through <= 2.20.2.
- Product
- 6Storage Rentals
- Affected
- up to 2.20.2
- What to do
- Affects up to 2.20.2. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025MapSVG: Missing AuthorizationCVE-2025-47558 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MapSVG: from n/a through < 8.6.13.
- Product
- MapSVG
- What to do
- Update MapSVG to the newest version.
May 23, 2025Experto CTA Widget – Call To Action, Sticky CTA, Floating Button: Missing AuthorizationCVE-2025-47529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in UX Design Experts Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin experto-cta-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin: from n/a through <= 1.1.1.
- Product
- Experto CTA Widget – Call To Action, Sticky CTA, Floating Button
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Experto CTA Widget – Call To Action, Sticky CTA, Floating Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Visual Builder: Missing AuthorizationCVE-2025-46488 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in dastan800 Visual Builder visual-builder allows Reflected XSS.This issue affects Visual Builder: from n/a through <= 1.2.2.
- Product
- Visual Builder
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Visual Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025EC Authorize.net: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46487 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sftranna EC Authorize.net ec-authorizenet allows Reflected XSS.This issue affects EC Authorize.net: from n/a through <= 0.3.3.
- Product
- EC Authorize.net
- Affected
- up to 0.3.3
- What to do
- Affects up to 0.3.3. Update EC Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025JobHunt Job Alerts: Missing AuthorizationCVE-2025-39536 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Chimpstudio JobHunt Job Alerts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobHunt Job Alerts: from n/a through 3.6.
- Product
- JobHunt Job Alerts
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update JobHunt Job Alerts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2025Splitit: Unauthorized modification of dataCVE-2025-4105 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin settings, including changing the environment from sandbox to production and vice versa.
- Product
- Splitit
- Affected
- up to 4.2.8
- What to do
- Affects up to 4.2.8. Update Splitit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2025Grand Restaurant: Missing AuthorizationCVE-2025-39352 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025wProject: Missing AuthorizationCVE-2025-39350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0.
- Product
- wProject
- Fixed in
- 5.8.0
- What to do
- Update wProject to 5.8.0 or newer.
May 19, 2025Custom PC Builder Lite for WooCommerce: Missing AuthorizationCVE-2025-43838 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ChoPlugins.com Custom PC Builder Lite for WooCommerce custom-pc-builder-lite-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom PC Builder Lite for WooCommerce: from n/a through <= 1.0.1.
- Product
- Custom PC Builder Lite for WooCommerce
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Custom PC Builder Lite for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025JetBlocks For Elementor: Missing AuthorizationCVE-2025-39451 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.16.
- Product
- JetBlocks For Elementor
- Affected
- up to 1.3.16
- What to do
- Affects up to 1.3.16. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025JetWooBuilder: Missing AuthorizationCVE-2025-39449 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetWooBuilder: from n/a through <= 2.1.18.
- Product
- JetWooBuilder
- Affected
- up to 2.1.18
- What to do
- Affects up to 2.1.18. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025JetElements For Elementor: Missing AuthorizationCVE-2025-39447 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Crocoblock JetElements For Elementor jet-elements allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.
- Product
- JetElements For Elementor
- Affected
- up to 2.7.4.1
- What to do
- Affects up to 2.7.4.1. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Eduma: Missing AuthorizationCVE-2025-39460 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress Eduma eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma: from n/a through <= 5.6.4.
- Product
- Eduma
- Affected
- up to 5.6.4
- What to do
- Affects up to 5.6.4. Update Eduma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Name Directory: Missing AuthorizationCVE-2025-39454 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.30.0.
- Product
- Name Directory
- Affected
- up to 1.30.0
- What to do
- Affects up to 1.30.0. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Master Slider: Missing AuthorizationCVE-2025-39412 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in averta Master Slider master-slider.This issue affects Master Slider: from n/a through <= 3.11.0.
- Product
- Master Slider
- Affected
- up to 3.11.0
- What to do
- Affects up to 3.11.0. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Bellevue: Missing AuthorizationCVE-2025-39398 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2.
- Product
- Bellevue
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update Bellevue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025LTL Freight Quotes – FreightQuote Edition: Missing AuthorizationCVE-2025-22287 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through <= 2.3.11.
- Product
- LTL Freight Quotes – FreightQuote Edition
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update LTL Freight Quotes – FreightQuote Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Author Box After Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-46263 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lloyd Saunders Author Box After Posts author-box-after-posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through <= 1.6.
- Product
- Author Box After Posts
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Author Box After Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025AnalyticsWP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39394 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.This issue affects AnalyticsWP: from n/a through 2.1.2.
- Product
- AnalyticsWP
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update AnalyticsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025AnalyticsWP: Missing AuthorizationCVE-2025-39388 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0.
- Product
- AnalyticsWP
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update AnalyticsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Car Park Booking System for: Missing AuthorizationCVE-2025-39376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in QuanticaLabs Car Park Booking System for WordPress car-park-booking-system-for-wordpress.This issue affects Car Park Booking System for WordPress: from n/a through <= 2.6.
- Product
- Car Park Booking System for
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Car Park Booking System for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025JNews: Missing AuthorizationCVE-2025-39373 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jegtheme JNews jnews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JNews: from n/a through <= 11.6.16.
- Product
- JNews
- Affected
- up to 11.6.16
- What to do
- Affects up to 11.6.16. Update JNews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Author Box Plugin With Different Description: Cross-Site Request Forgery (CSRF)CVE-2025-39371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Author Box Plugin With Different Description author-box-with-different-description allows Cross Site Request Forgery.This issue affects Author Box Plugin With Different Description: from n/a through <= 1.3.5.
- Product
- Author Box Plugin With Different Description
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Author Box Plugin With Different Description to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Rootspersona: Missing AuthorizationCVE-2025-39368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ed4becky Rootspersona rootspersona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rootspersona: from n/a through <= 3.7.5.
- Product
- Rootspersona
- Affected
- up to 3.7.5
- What to do
- Affects up to 3.7.5. Update Rootspersona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Grand Restaurant: Missing AuthorizationCVE-2025-39353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.
- Product
- Grand Restaurant
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Grand Restaurant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Customify: Missing AuthorizationCVE-2025-26920 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in pressmaximum Customify customify-theme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customify: from n/a through <= 0.4.8.
- Product
- Customify
- Affected
- up to 0.4.8
- What to do
- Affects up to 0.4.8. Update Customify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Bulk: Missing AuthorizationCVE-2025-26867 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11.
- Product
- Bulk
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Bulk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Embed and Integrate Etsy Shop: Missing AuthorizationCVE-2025-48346 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Embed360 Embed and Integrate Etsy Shop embed-and-integrate-etsy-shop allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embed and Integrate Etsy Shop: from n/a through <= 1.0.8.
- Product
- Embed and Integrate Etsy Shop
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Embed and Integrate Etsy Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Majestic Support: Missing AuthorizationCVE-2025-48282 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.0.
- Product
- Majestic Support
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WP Job Portal: Missing AuthorizationCVE-2025-48272 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.3.2.
- Product
- WP Job Portal
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Bot for Telegram on WooCommerce: Missing AuthorizationCVE-2025-48268 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Guru Team Bot for Telegram on WooCommerce bot-for-telegram-on-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bot for Telegram on WooCommerce: from n/a through <= 1.2.6.
- Product
- Bot for Telegram on WooCommerce
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Bot for Telegram on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Url Rewrite Analyzer: Missing AuthorizationCVE-2025-48262 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in M.Code Url Rewrite Analyzer url-rewrite-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Url Rewrite Analyzer: from n/a through <= 1.3.3.
- Product
- Url Rewrite Analyzer
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Url Rewrite Analyzer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-48260 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.3.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Projectopia: Missing AuthorizationCVE-2025-48257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.
- Product
- Projectopia
- Affected
- up to 5.1.17
- What to do
- Affects up to 5.1.17. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Shortlinks by Pretty Links: Missing AuthorizationCVE-2025-48247 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links pretty-link allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortlinks by Pretty Links: from n/a through <= 3.6.15.
- Product
- Shortlinks by Pretty Links
- Affected
- up to 3.6.15
- What to do
- Affects up to 3.6.15. Update Shortlinks by Pretty Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025The Events Calendar: Missing AuthorizationCVE-2025-48246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.11.2.1.
- Product
- The Events Calendar
- Affected
- up to 6.11.2.1
- What to do
- Affects up to 6.11.2.1. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Legal Pages: Missing AuthorizationCVE-2025-48242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.5.
- Product
- Legal Pages
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2025MultiVendorX – WooCommerce Multivendor Marketplace Solutions: Unauthorized loss of dataCVE-2025-4101 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'delete_fpm_product' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary posts, pages, attachments, and products. The vulnerability was partially patched in version 4.2.22.
- Product
- MultiVendorX – WooCommerce Multivendor Marketplace Solutions
- Affected
- up to 4.2.22
- What to do
- Affects up to 4.2.22. Update MultiVendorX – WooCommerce Multivendor Marketplace Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2025EventON Pro: Unauthorized modification of dataCVE-2025-3527 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EventON Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'assets/lib/settings/settings.js' file in all versions up to, and including, 4.9.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.9.6.
- Product
- EventON Pro
- Affected
- up to 4.9.6
- What to do
- Affects up to 4.9.6. Update EventON Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
May 16, 2025BERTHA AI: Missing AuthorizationCVE-2025-48138 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.
- Product
- BERTHA AI
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update BERTHA AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Sharespine Woocommerce Connector: Missing AuthorizationCVE-2025-48128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharespine Woocommerce Connector: from n/a through <= 4.7.55.
- Product
- Sharespine Woocommerce Connector
- Affected
- up to 4.7.55
- What to do
- Affects up to 4.7.55. Update Sharespine Woocommerce Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Push notification for Mobile and Web app: Missing AuthorizationCVE-2025-48127 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through <= 2.0.3.
- Product
- Push notification for Mobile and Web app
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Push notification for Mobile and Web app to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025WooCommerce POS: Missing AuthorizationCVE-2025-48117 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.
- Product
- WooCommerce POS
- Affected
- up to 1.7.8
- What to do
- Affects up to 1.7.8. Update WooCommerce POS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025EventON: Missing AuthorizationCVE-2025-48116 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ashan Perera EventON eventon-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 2.4.4.
- Product
- EventON
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025ProfileGrid: Missing AuthorizationCVE-2025-48079 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid : from n/a through <= 5.9.5.1.
- Product
- ProfileGrid
- Affected
- up to 5.9.5.1
- What to do
- Affects up to 5.9.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025EventON: Missing AuthorizationCVE-2025-47564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 4.9.8.
- Product
- EventON
- Affected
- up to 4.9.8
- What to do
- Affects up to 4.9.8. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025CURCY: Missing AuthorizationCVE-2025-47563 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CURCY: from n/a through <= 2.3.7.
- Product
- CURCY
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.