Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,136 results · page 68 of 203
Feb 24, 2026Responsive Lightbox & Gallery: Is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious linkCVE-2025-15386 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
- Product
- Responsive Lightbox & Gallery
- Fixed in
- 2.6.1
- What to do
- Update Responsive Lightbox & Gallery to 2.6.1 or newer.
Feb 23, 2026Simple Ajax Chat: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-3075 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Jeff Starr Simple Ajax Chat simple-ajax-chat allows Retrieve Embedded Sensitive Data.This issue affects Simple Ajax Chat: from n/a through <= 20251121.
- Product
- Simple Ajax Chat
- Affected
- up to 20251121
- What to do
- Affects up to 20251121. Update Simple Ajax Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2026The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce: Insufficient Verification of Data AuthenticityCVE-2026-2385 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter.
- Product
- The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- Affected
- up to 6.4.7
- What to do
- Affects up to 6.4.7. Update The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2026LearnPress Export Import – WordPress extension for LearnPress: Unauthorized loss of dataCVE-2026-1787 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to delete course that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability.
- Product
- LearnPress Export Import – WordPress extension for LearnPress
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update LearnPress Export Import – WordPress extension for LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 21, 2026weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation: Unauthorized form deletionCVE-2025-14339 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the `weMail` JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to the forms endpoint.
- Product
- weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2026Authorsy: Authorization Bypass Through User-Controlled KeyCVE-2026-24950 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in themeplugs Authorsy authorsy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Authorsy: from n/a through <= 1.0.6.
- Product
- Authorsy
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Authorsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-24946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.8.0.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Subscribe2: Missing AuthorizationCVE-2026-24944 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in weDevs Subscribe2 subscribe2 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe2: from n/a through <= 10.44.
- Product
- Subscribe2
- Affected
- up to 10.44
- What to do
- Affects up to 10.44. Update Subscribe2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WP Job Portal: Missing AuthorizationCVE-2026-24941 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.4.
- Product
- WP Job Portal
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PawFriends - Pet Shop and Veterinary: Authorization Bypass Through User-Controlled KeyCVE-2026-22383 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through <= 1.3.
- Product
- PawFriends - Pet Shop and Veterinary
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update PawFriends - Pet Shop and Veterinary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WP FullCalendar: Missing AuthorizationCVE-2026-22351 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through <= 1.6.
- Product
- WP FullCalendar
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update WP FullCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PDF for Elementor Forms + Drag And Drop Template Builder: Missing AuthorizationCVE-2026-22350 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.3.1.
- Product
- PDF for Elementor Forms + Drag And Drop Template Builder
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Booked: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-22341 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through <= 3.0.0.
- Product
- Booked
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Booked to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WooODT Lite: Authentication Bypass by SpoofingCVE-2025-69401 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass by Spoofing vulnerability in mdalabar WooODT Lite byconsole-woo-order-delivery-time allows Identity Spoofing.This issue affects WooODT Lite: from n/a through <= 2.5.2.
- Product
- WooODT Lite
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update WooODT Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Cnvrse: Authorization Bypass Through User-Controlled KeyCVE-2025-69394 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in cnvrse Cnvrse cnvrse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cnvrse: from n/a through < 026.02.10.20.
- Product
- Cnvrse
- What to do
- Update Cnvrse to the newest version.
Feb 20, 2026Exzo: Missing AuthorizationCVE-2025-69393 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exzo: from n/a through <= 1.2.4.
- Product
- Exzo
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Exzo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Cliengo – Chatbot: Missing AuthorizationCVE-2025-69388 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cliengo Cliengo – Chatbot cliengo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cliengo – Chatbot: from n/a through <= 3.0.4.
- Product
- Cliengo – Chatbot
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Cliengo – Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Cartify - WooCommerce Gutenberg: Missing AuthorizationCVE-2025-69385 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AgniHD Cartify - WooCommerce Gutenberg WordPress Theme cartify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cartify - WooCommerce Gutenberg WordPress Theme: from n/a through <= 1.3.
- Product
- Cartify - WooCommerce Gutenberg
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Cartify - WooCommerce Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026WooCommerce Bulk Product Editor: Missing AuthorizationCVE-2025-69381 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.
- Product
- WooCommerce Bulk Product Editor
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026ModelTheme Framework: Missing AuthorizationCVE-2025-69303 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ModelTheme Framework: from n/a through < 2.0.0.
- Product
- ModelTheme Framework
- What to do
- Update ModelTheme Framework to the newest version.
Feb 20, 2026Gauge: Missing AuthorizationCVE-2025-69298 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in GhostPool Gauge gauge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gauge: from n/a through <= 6.56.4.
- Product
- Gauge
- Affected
- up to 6.56.4
- What to do
- Affects up to 6.56.4. Update Gauge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Aardvark: Missing AuthorizationCVE-2025-69297 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aardvark Plugin: from n/a through <= 2.19.
- Product
- Aardvark
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update Aardvark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026New User Approve: Missing AuthorizationCVE-2025-69063 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.0.
- Product
- New User Approve
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026AhaChat Messenger Marketing: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-68895 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in ahachat AhaChat Messenger Marketing ahachat-messenger-marketing allows Password Recovery Exploitation.This issue affects AhaChat Messenger Marketing: from n/a through <= 1.1.
- Product
- AhaChat Messenger Marketing
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AhaChat Messenger Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Missing AuthorizationCVE-2025-68837 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through <= 3.3.5.
- Product
- ELEX WordPress HelpDesk & Customer Ticketing System
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: Missing AuthorizationCVE-2025-68834 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-sheet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: from n/a through <= 1.1.3.
- Product
- Sync Master Sheet – Product Sync with Google Sheet for WooCommerce
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Sync Master Sheet – Product Sync with Google Sheet for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Sendy: Missing AuthorizationCVE-2025-68564 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in sendy Sendy sendy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendy: from n/a through <= 3.4.2.
- Product
- Sendy
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update Sendy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Checkout Gateway for IRIS: Missing AuthorizationCVE-2025-68542 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Gateway for IRIS: from n/a through <= 1.3.
- Product
- Checkout Gateway for IRIS
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Checkout Gateway for IRIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PDF for WPForms: Missing AuthorizationCVE-2025-68534 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 6.3.0.
- Product
- PDF for WPForms
- Affected
- up to 6.3.0
- What to do
- Affects up to 6.3.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Paid Member Subscriptions: Authorization Bypass Through User-Controlled KeyCVE-2025-68514 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.16.8.
- Product
- Paid Member Subscriptions
- Affected
- up to 2.16.8
- What to do
- Affects up to 2.16.8. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Directorist: Missing AuthorizationCVE-2025-68069 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.6.6.
- Product
- Directorist
- Affected
- up to 8.6.6
- What to do
- Affects up to 8.6.6. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Shiprocket: Authorization Bypass Through User-Controlled KeyCVE-2025-68051 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through <= 2.0.8.
- Product
- Shiprocket
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Shiprocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Leadpages: Missing AuthorizationCVE-2025-68050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadpages: from n/a through <= 1.1.3.
- Product
- Leadpages
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Leadpages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026NextMove Lite: Missing AuthorizationCVE-2025-68048 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.
- Product
- NextMove Lite
- Affected
- up to 2.23.0
- What to do
- Affects up to 2.23.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026LottieFiles: Missing AuthorizationCVE-2025-68043 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.
- Product
- LottieFiles
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update LottieFiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Travelpayouts: Missing AuthorizationCVE-2025-68042 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.
- Product
- Travelpayouts
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Travelpayouts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Advanced WC Analytics: Missing AuthorizationCVE-2025-68032 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Passionate Brains Advanced WC Analytics advance-wc-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced WC Analytics: from n/a through <= 3.19.0.
- Product
- Advanced WC Analytics
- Affected
- up to 3.19.0
- What to do
- Affects up to 3.19.0. Update Advanced WC Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026GA4WP: Google Analytics for: Missing AuthorizationCVE-2025-68028 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through <= 2.10.0.
- Product
- GA4WP: Google Analytics for
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update GA4WP: Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026LC Wizard: Missing AuthorizationCVE-2025-68026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LC Wizard: from n/a through <= 2.1.1.
- Product
- LC Wizard
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update LC Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Addonify Floating Cart For WooCommerce: Missing AuthorizationCVE-2025-68025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify Floating Cart For WooCommerce addonify-floating-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify Floating Cart For WooCommerce: from n/a through <= 1.2.17.
- Product
- Addonify Floating Cart For WooCommerce
- Affected
- up to 1.2.17
- What to do
- Affects up to 1.2.17. Update Addonify Floating Cart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Addonify – WooCommerce Wishlist: Missing AuthorizationCVE-2025-68024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – WooCommerce Wishlist: from n/a through <= 2.0.15.
- Product
- Addonify – WooCommerce Wishlist
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Addonify – WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Addonify – Compare Products For WooCommerce: Missing AuthorizationCVE-2025-68023 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – Compare Products For WooCommerce: from n/a through <= 1.1.17.
- Product
- Addonify – Compare Products For WooCommerce
- Affected
- up to 1.1.17
- What to do
- Affects up to 1.1.17. Update Addonify – Compare Products For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Plugin BlueX for WooCommerce: Missing AuthorizationCVE-2025-68022 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin BlueX for WooCommerce: from n/a through <= 3.1.6.
- Product
- Plugin BlueX for WooCommerce
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update Plugin BlueX for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026ConveyThis: Missing AuthorizationCVE-2025-68021 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.9.
- Product
- ConveyThis
- Affected
- up to 269.9
- What to do
- Affects up to 269.9. Update ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Easy Hotel Booking: Missing AuthorizationCVE-2025-68005 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in themewant Easy Hotel Booking easy-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Hotel Booking: from n/a through <= 1.9.2.
- Product
- Easy Hotel Booking
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Easy Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Testimonial Slider: Missing AuthorizationCVE-2025-68000 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.
- Product
- Testimonial Slider
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Miraculous Elementor: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-67998 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7.
- Product
- Miraculous Elementor
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Miraculous Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026YayCurrency: Missing AuthorizationCVE-2025-67994 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayCurrency: from n/a through <= 3.3.
- Product
- YayCurrency
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update YayCurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Atarim: Missing AuthorizationCVE-2025-67993 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.2.1.
- Product
- Atarim
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026HAPPY: Missing AuthorizationCVE-2025-67977 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.8.
- Product
- HAPPY
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.