Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,269 results · page 72 of 126
Mar 28, 2025Administrator Z: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2815 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26959 is a duplicate of this issue.
- Product
- Administrator Z
- Affected
- up to 2025.03.24
- What to do
- Affects up to 2025.03.24. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 27, 2025Traveler: Missing AuthorizationCVE-2025-26956 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 27, 2025Traveler: Missing AuthorizationCVE-2025-26733 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 27, 2025Sensei LMS: Missing AuthorizationCVE-2025-22740 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Sensei LMS sensei-lms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sensei LMS: from n/a through <= 4.24.4.
- Product
- Sensei LMS
- Affected
- up to 4.24.4
- What to do
- Affects up to 4.24.4. Update Sensei LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025LearnPress: Missing AuthorizationCVE-2025-22739 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.7.5.
- Product
- LearnPress
- Affected
- up to 4.2.7.5
- What to do
- Affects up to 4.2.7.5. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025iNET Webkit: Missing AuthorizationCVE-2025-22629 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through <= 1.2.2.
- Product
- iNET Webkit
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update iNET Webkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Disable Elementor Editor Translation: Missing AuthorizationCVE-2025-22671 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Leap13 Disable Elementor Editor Translation disable-elementor-editor-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Disable Elementor Editor Translation: from n/a through <= 1.0.2.
- Product
- Disable Elementor Editor Translation
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Disable Elementor Editor Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025VikBooking Hotel Booking Engine & PMS: Missing AuthorizationCVE-2025-22670 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.7.2.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Awesome Event Booking: Missing AuthorizationCVE-2025-22668 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Event Booking: from n/a through <= 2.7.2.
- Product
- Awesome Event Booking
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update Awesome Event Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: Missing AuthorizationCVE-2025-22667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Creative Werk Designs Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets wpsyncsheets-woocommerce.This issue affects Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: from n/a through <= 1.8.2.
- Product
- Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025RapidLoad: Missing AuthorizationCVE-2025-22665 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shakeeb Sadikeen RapidLoad unusedcss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RapidLoad: from n/a through <= 2.4.4.
- Product
- RapidLoad
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update RapidLoad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025AIO Performance Profiler, Monitor, Optimize, Compress & Debug: Missing AuthorizationCVE-2025-22647 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-performance-accelerator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO Performance Profiler, Monitor, Optimize, Compress & Debug: from n/a through <= 1.2.
- Product
- AIO Performance Profiler, Monitor, Optimize, Compress & Debug
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update AIO Performance Profiler, Monitor, Optimize, Compress & Debug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Envo Multipurpose: Missing AuthorizationCVE-2025-22770 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in EnvoThemes Envo Multipurpose allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Multipurpose: from n/a through 1.1.6.
- Product
- Envo Multipurpose
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Envo Multipurpose to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025EAN for WooCommerce: Missing AuthorizationCVE-2025-22673 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EAN for WooCommerce: from n/a through <= 5.3.5.
- Product
- EAN for WooCommerce
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update EAN for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Conversios.io: Missing AuthorizationCVE-2025-30909 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.3.
- Product
- Conversios.io
- Affected
- up to 7.2.3
- What to do
- Affects up to 7.2.3. Update Conversios.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Analytify: Missing AuthorizationCVE-2025-30897 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.5.1.
- Product
- Analytify
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WP ERP: Missing AuthorizationCVE-2025-30896 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.13.4.
- Product
- WP ERP
- Affected
- up to 1.13.4
- What to do
- Affects up to 1.13.4. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-30894 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.79.262.
- Product
- WP Fast Total Search
- Affected
- up to 1.79.262
- What to do
- Affects up to 1.79.262. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WpEvently: Missing AuthorizationCVE-2025-30887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 4.2.9.
- Product
- WpEvently
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Trust.Reviews: Missing AuthorizationCVE-2025-30883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through <= 2.3.
- Product
- Trust.Reviews
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Trust.Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Big Store: Missing AuthorizationCVE-2025-30881 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themehunk Big Store big-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Big Store: from n/a through <= 2.0.8.
- Product
- Big Store
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Big Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Quiz Cat: Missing AuthorizationCVE-2025-30877 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in fatcatapps Quiz Cat quiz-cat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz Cat: from n/a through <= 3.0.8.
- Product
- Quiz Cat
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Quiz Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Specific Content For Mobile: Missing AuthorizationCVE-2025-30874 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Mortellaro Specific Content For Mobile specific-content-for-mobile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Specific Content For Mobile: from n/a through <= 0.5.3.
- Product
- Specific Content For Mobile
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Specific Content For Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Product Author for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-30872 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nitin Prakash Product Author for WooCommerce wc-product-author allows Cross Site Request Forgery.This issue affects Product Author for WooCommerce: from n/a through <= 1.0.7.
- Product
- Product Author for WooCommerce
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Product Author for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Terms & Conditions Per Product: Missing AuthorizationCVE-2025-30866 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through <= 1.2.15.
- Product
- Terms & Conditions Per Product
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update Terms & Conditions Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Exchange Rates: Missing AuthorizationCVE-2025-30864 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in falselight Exchange Rates exchange-rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exchange Rates: from n/a through <= 1.2.2.
- Product
- Exchange Rates
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Five Star Restaurant Reservations: Missing AuthorizationCVE-2025-30861 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.6.29.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.6.29
- What to do
- Affects up to 2.6.29. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Tickera: Missing AuthorizationCVE-2025-30851 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.5.2.
- Product
- Tickera
- Affected
- up to 3.5.5.2
- What to do
- Affects up to 3.5.5.2. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2025-30839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.2.1.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Cool Author Box: Missing AuthorizationCVE-2025-30830 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cool Author Box: from n/a through <= 2.9.9.
- Product
- Cool Author Box
- Affected
- up to 2.9.9
- What to do
- Affects up to 2.9.9. Update Cool Author Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Timetics: Missing AuthorizationCVE-2025-30828 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.29.
- Product
- Timetics
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Textmetrics: Missing AuthorizationCVE-2025-30824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Textmetrics: from n/a through <= 3.6.1.
- Product
- Textmetrics
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Textmetrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025SNORDIAN's H5PxAPIkatchu: Missing AuthorizationCVE-2025-30821 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in otacke SNORDIAN's H5PxAPIkatchu h5pxapikatchu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SNORDIAN's H5PxAPIkatchu: from n/a through <= 0.4.14.
- Product
- SNORDIAN's H5PxAPIkatchu
- Affected
- up to 0.4.14
- What to do
- Affects up to 0.4.14. Update SNORDIAN's H5PxAPIkatchu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Z Companion: Missing AuthorizationCVE-2025-30817 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wpzita Z Companion z-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Z Companion: from n/a through <= 1.0.13.
- Product
- Z Companion
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Z Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Live Forms: Missing AuthorizationCVE-2025-30809 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4.
- Product
- Live Forms
- Affected
- up to 4.8.4
- What to do
- Affects up to 4.8.4. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Just Writing Statistics: Missing AuthorizationCVE-2025-30803 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Writing Statistics: from n/a through <= 5.3.
- Product
- Just Writing Statistics
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update Just Writing Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Chatbox Manager: Missing AuthorizationCVE-2025-30790 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chatbox Manager: from n/a through <= 1.2.2.
- Product
- Chatbox Manager
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Chatbox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Support Genix: Authorization Bypass Through User-Controlled KeyCVE-2025-30777 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.11.
- Product
- Support Genix
- Affected
- up to 1.4.11
- What to do
- Affects up to 1.4.11. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WPC Smart Upsell Funnel for WooCommerce: Missing AuthorizationCVE-2025-30772 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.
- Product
- WPC Smart Upsell Funnel for WooCommerce
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update WPC Smart Upsell Funnel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025PDF for WPForms: Missing AuthorizationCVE-2025-30767 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.3.0.
- Product
- PDF for WPForms
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025WP Compress – Instant Performance & Speed Optimization: Unauthorized access, modification, and loss of dataCVE-2025-2110 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
- Product
- WP Compress – Instant Performance & Speed Optimization
- Affected
- up to 6.30.15
- What to do
- Affects up to 6.30.15. Update WP Compress – Instant Performance & Speed Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2025Advanced iFrame: Unauthorized excessive creation of options on the aip_map_url_callback() functionCVE-2025-1440 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the advancediFrameParameterData option with an excessive amount of unvalidated data.
- Product
- Advanced iFrame
- Affected
- up to 2024.5
- What to do
- Affects up to 2024.5. Update Advanced iFrame to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 26, 2025Active Products Tables for WooCommerce. Use constructor to create tables: Unauthorized filter callingCVE-2025-1514 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.
- Product
- Active Products Tables for WooCommerce. Use constructor to create tables
- Affected
- up to 1.0.6.7
- What to do
- Affects up to 1.0.6.7. Update Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2025BWL Advanced FAQ Manager: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13801 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'baf_set_notice_status' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
- Product
- BWL Advanced FAQ Manager
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update BWL Advanced FAQ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Mar 25, 2025Ultimate Dashboard – Custom WordPress Dashboard: Unauthorized modification of dataCVE-2025-2276 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_module_actions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate/deactivate plugin modules.
- Product
- Ultimate Dashboard – Custom WordPress Dashboard
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update Ultimate Dashboard – Custom WordPress Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 25, 2025Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings: Unauthorized access and modification of dataCVE-2025-2224 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
- Product
- Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
- Affected
- up to 8.2
- What to do
- Affects up to 8.2. Update Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2025aoa-downloadable: Lacks authorization and authentication for requests to its downloadCVE-2024-13618 · WordPress plugins & themes · reported by WPScanHigh 7.2
The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
- Product
- aoa-downloadable
- Affected
- up to 0.1.0
- What to do
- Affects up to 0.1.0. Update aoa-downloadable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025sourceplay-navermap: Missing AuthorizationCVE-2025-30605 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ldwin79 sourceplay-navermap sourceplay-navermap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects sourceplay-navermap: from n/a through <= 0.0.2.
- Product
- sourceplay-navermap
- Affected
- up to 0.0.2
- What to do
- Affects up to 0.0.2. Update sourceplay-navermap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Advanced Dewplayer: Missing AuthorizationCVE-2025-30592 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Dewplayer: from n/a through <= 1.6.
- Product
- Advanced Dewplayer
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Advanced Dewplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Music Press Pro: Missing AuthorizationCVE-2025-30591 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through <= 1.4.6.
- Product
- Music Press Pro
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Music Press Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.