Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,137 results · page 81 of 203
Dec 29, 2025Mobile builder: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-68860 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue affects Mobile builder: from n/a through <= 1.4.2.
- Product
- Mobile builder
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Mobile builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025JetBlog: Missing AuthorizationCVE-2025-68503 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetBlog: from n/a through <= 2.4.7.
- Product
- JetBlog
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025JetPopup: Authorization Bypass Through User-Controlled KeyCVE-2025-68502 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through <= 2.0.20.1.
- Product
- JetPopup
- Affected
- up to 2.0.20.1
- What to do
- Affects up to 2.0.20.1. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025Plugin Optimizer: Missing AuthorizationCVE-2025-68861 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in pluginoptimizer Plugin Optimizer plugin-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin Optimizer: from n/a through <= 1.3.7.
- Product
- Plugin Optimizer
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Plugin Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 25, 2025Frontend Post Submission Manager Lite – Frontend Posting: Unauthorized loss of dataCVE-2025-14913 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
- Product
- Frontend Post Submission Manager Lite – Frontend Posting
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Frontend Post Submission Manager Lite – Frontend Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 24, 2025Userpro: Missing AuthorizationCVE-2025-68608 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in DeluxeThemes Userpro userpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025PostX: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.This issue affects PostX: from n/a through <= 5.0.3.
- Product
- PostX
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Editorial Calendar: Missing AuthorizationCVE-2025-68603 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editorial Calendar: from n/a through <= 3.8.8.
- Product
- Editorial Calendar
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Bit Assist: Missing AuthorizationCVE-2025-68596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bit Assist: from n/a through <= 1.5.11.
- Product
- Bit Assist
- Affected
- up to 1.5.11
- What to do
- Affects up to 1.5.11. Update Bit Assist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Widgets for Social Photo Feed: Missing AuthorizationCVE-2025-68595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.
- Product
- Widgets for Social Photo Feed
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Widgets for Social Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Missing AuthorizationCVE-2025-68594 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.12.0.
- Product
- Poll, Survey & Quiz Maker Plugin by Opinion Stage
- Affected
- up to 19.12.0
- What to do
- Affects up to 19.12.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Adminify: Missing AuthorizationCVE-2025-68593 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
- Product
- WP Adminify
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Adminify: Missing AuthorizationCVE-2025-68592 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
- Product
- WP Adminify
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Simple File List: Missing AuthorizationCVE-2025-68591 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.18.
- Product
- Simple File List
- Affected
- up to 6.1.18
- What to do
- Affects up to 6.1.18. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Telegram Widget and Join Link: Missing AuthorizationCVE-2025-68589 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Telegram Widget and Join Link: from n/a through <= 2.2.12.
- Product
- WP Telegram Widget and Join Link
- Affected
- up to 2.2.12
- What to do
- Affects up to 2.2.12. Update WP Telegram Widget and Join Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025TS Poll: Missing AuthorizationCVE-2025-68588 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Poll: from n/a through <= 2.5.5.
- Product
- TS Poll
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update TS Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Watu Quiz: Missing AuthorizationCVE-2025-68587 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.
- Product
- Watu Quiz
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Cooked: Missing AuthorizationCVE-2025-68586 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.
- Product
- Cooked
- Affected
- up to 1.11.3
- What to do
- Affects up to 1.11.3. Update Cooked to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Document Revisions: Missing AuthorizationCVE-2025-68585 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Ben Balter WP Document Revisions wp-document-revisions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Document Revisions: from n/a through <= 3.7.2.
- Product
- WP Document Revisions
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WP Document Revisions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Funnelforms Free: Missing AuthorizationCVE-2025-68582 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Funnelforms Free: from n/a through <= 3.8.
- Product
- Funnelforms Free
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025YITH Slider for page builders: Missing AuthorizationCVE-2025-68581 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through <= 1.0.11.
- Product
- YITH Slider for page builders
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update YITH Slider for page builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025FV Simpler SEO: Missing AuthorizationCVE-2025-68579 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Simpler SEO: from n/a through <= 1.9.6.
- Product
- FV Simpler SEO
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update FV Simpler SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Addonify: Missing AuthorizationCVE-2025-68578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Addonify Addonify addonify-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify: from n/a through <= 2.0.4.
- Product
- Addonify
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Addonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Virusdie: Missing AuthorizationCVE-2025-68577 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through <= 1.1.6.
- Product
- Virusdie
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Virusdie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Virusdie: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6.
- Product
- Virusdie
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Virusdie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Wappointment: Missing AuthorizationCVE-2025-68575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wappointment: from n/a through <= 2.7.6.
- Product
- Wappointment
- Affected
- up to 2.7.6
- What to do
- Affects up to 2.7.6. Update Wappointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025BBP Core: Missing AuthorizationCVE-2025-68572 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Spider Themes BBP Core bbp-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BBP Core: from n/a through <= 1.4.1.
- Product
- BBP Core
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update BBP Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025SALESmanago & Leadoo: Missing AuthorizationCVE-2025-68571 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.9.0.
- Product
- SALESmanago & Leadoo
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Time Slots Booking Form: Missing AuthorizationCVE-2025-68569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.39.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.2.39
- What to do
- Affects up to 1.2.39. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Claspo – Popups, Spin the Wheel & Email Capture: Missing AuthorizationCVE-2025-68568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: from n/a through <= 1.0.7.
- Product
- Claspo – Popups, Spin the Wheel & Email Capture
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Claspo – Popups, Spin the Wheel & Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Twitch Player: Missing AuthorizationCVE-2025-68565 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JayBee Twitch Player ttv-easy-embed-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Twitch Player: from n/a through <= 2.1.3.
- Product
- Twitch Player
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Twitch Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Sunshine Photo Cart: Missing AuthorizationCVE-2025-68535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.5.7.1
- What to do
- Affects up to 3.5.7.1. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Spiffy Calendar: Missing AuthorizationCVE-2025-68523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.
- Product
- Spiffy Calendar
- Affected
- up to 5.0.7
- What to do
- Affects up to 5.0.7. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WpStream: Missing AuthorizationCVE-2025-68522 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.
- Product
- WpStream
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update WpStream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WpStream: Missing AuthorizationCVE-2025-68521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.
- Product
- WpStream
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update WpStream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Tablesome: Missing AuthorizationCVE-2025-68517 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.35.1.
- Product
- Tablesome
- Affected
- up to 1.1.35.1
- What to do
- Affects up to 1.1.35.1. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Gutenverse Form: Missing AuthorizationCVE-2025-68511 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through <= 2.3.1.
- Product
- Gutenverse Form
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Gutenverse Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Brave: Missing AuthorizationCVE-2025-68508 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brave Brave brave-popup-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brave: from n/a through <= 0.8.3.
- Product
- Brave
- Affected
- up to 0.8.3
- What to do
- Affects up to 0.8.3. Update Brave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025H5P: Missing AuthorizationCVE-2025-68505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in icc0rz H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through <= 1.16.1.
- Product
- H5P
- Affected
- up to 1.16.1
- What to do
- Affects up to 1.16.1. Update H5P to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Premium Addons for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68494 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.53.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.53
- What to do
- Affects up to 4.11.53. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Membership For WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2025-67909 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Membership For WooCommerce: from n/a through <= 3.0.3.
- Product
- Membership For WooCommerce
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Eight Day Week Print Workflow: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67621 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.
- Product
- Eight Day Week Print Workflow
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Eight Day Week Print Workflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Master Addons for Elementor: Missing AuthorizationCVE-2023-40679 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through 2.0.5.3.
- Product
- Master Addons for Elementor
- Affected
- up to 2.0.5.3
- What to do
- Affects up to 2.0.5.3. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Resoto: Missing AuthorizationCVE-2023-28619 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bnayawpguy Resoto allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Resoto: from n/a through 1.0.8.
- Product
- Resoto
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Resoto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025Chakra test: Missing AuthorizationCVE-2025-68557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vikas Ratudi Chakra test chakra-test allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chakra test: from n/a through <= 1.0.1.
- Product
- Chakra test
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Chakra test to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025HAPPY: Missing AuthorizationCVE-2025-68556 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.9.
- Product
- HAPPY
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025VPSUForm: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vikas Ratudi VPSUForm v-form allows Retrieve Embedded Sensitive Data.This issue affects VPSUForm: from n/a through <= 3.2.24.
- Product
- VPSUForm
- Affected
- up to 3.2.24
- What to do
- Affects up to 3.2.24. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025PowerPack Pro for Elementor: Missing AuthorizationCVE-2024-24844 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Pro for Elementor: from n/a through 2.10.6.
- Product
- PowerPack Pro for Elementor
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update PowerPack Pro for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025PhastPress: Unauthenticated Arbitrary File ReadCVE-2025-14388 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
- Product
- PhastPress
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update PhastPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 23, 2025Premium Addons for Elementor – Powerful Elementor Templates & Widgets: Unauthorized access of dataCVE-2025-14155 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it possible for unauthenticated attackers to view the content of private, draft, and pending templates.
- Product
- Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- Affected
- up to 4.11.53
- What to do
- Affects up to 4.11.53. Update Premium Addons for Elementor – Powerful Elementor Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.