Updated 43 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

549new WordPress flaws this week

391,964entries in the database

10,145 results · page 85 of 203

Dec 13, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12362 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action.
Product
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 13, 2025Mavix Education: Unauthorized modification of dataCVE-2025-11164 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mavix Education theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mavix_education_activate_plugin' AJAX action in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Creativ Demo Importer plugin.
Product
Mavix Education
Affected
up to 1.0
What to do
Affects up to 1.0. Update Mavix Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Dec 12, 2025Simple Bike Rental: Unauthorized access of dataCVE-2025-14065 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni' AJAX action in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve all booking records containing customers' personally identifiable information (PII), including names, email addresses, and phone numbers.
Product
Simple Bike Rental
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Simple Bike Rental to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Bookit: Has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment optionsCVE-2025-12841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
Product
Bookit
Fixed in
2.5.1
What to do
Update Bookit to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Dec 12, 2025PDF for Contact Form 7 + Drag and Drop Template Builder: Unauthorized post duplicationCVE-2025-14074 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to, and including, 6.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to duplicate arbitrary posts, including password protected or private ones.
Product
PDF for Contact Form 7 + Drag and Drop Template Builder
Affected
up to 6.3.3
What to do
Affects up to 6.3.3. Update PDF for Contact Form 7 + Drag and Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Icegram Express - Email Subscribers, Newsletters and Marketing Automation: Missing AuthorizationCVE-2025-12348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage.
Product
Icegram Express - Email Subscribers, Newsletters and Marketing Automation
Affected
up to 5.9.10
What to do
Affects up to 5.9.10. Update Icegram Express - Email Subscribers, Newsletters and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Ultra Addons for Contact Form 7: Unauthorized access of dataCVE-2025-14356 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_generated_pdf' function in all versions up to, and including, 3.5.33. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate and get form submission PDF, when the "PDF Generator" and the "Database" addons are enabled (disabled by default).
Product
Ultra Addons for Contact Form 7
Affected
up to 3.5.33
What to do
Affects up to 3.5.33. Update Ultra Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 12, 2025Construction Light: Does not have authorisation and CSRFCVE-2025-10684 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
Product
Construction Light
Fixed in
1.6.8
What to do
Update Construction Light to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com
Dec 11, 2025Simple Theme Changer: Unauthorized modification of dataCVE-2025-14392 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.
Product
Simple Theme Changer
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Theme Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2025Vimeo SimpleGallery: Missing AuthorizationCVE-2025-14170 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2. This is due to missing authorization checks on the `vimeogallery_admin` function hooked to `admin_menu`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings via the `action` parameter.
Product
Vimeo SimpleGallery
Affected
up to 0.2
What to do
Affects up to 0.2. Update Vimeo SimpleGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025BuddyTask: Unauthorized access and modification of dataCVE-2025-14064 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view, create, modify, and delete task boards belonging to any BuddyPress group, including private and hidden groups they are not members of.
Product
BuddyTask
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update BuddyTask to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org plugins.trac.wordpress.org
Dec 11, 2025URL Media Uploader: Unauthorized safe file uploadsCVE-2025-14045 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.
Product
URL Media Uploader
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update URL Media Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 11, 2025Flow-Flow Social Feed Stream: Unauthorized modification of dataCVE-2025-13866 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flow_flow_social_auth AJAX action in versions 3.0.0 to 4.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings and store arbitrary JavaScript that executes whenever the plugin settings page is viewed.
Product
Flow-Flow Social Feed Stream
Affected
3.0.0 to 4.7.5
What to do
Affects 3.0.0 to 4.7.5. Update Flow-Flow Social Feed Stream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Premmerce Wishlist for WooCommerce: Missing AuthorizationCVE-2025-13440 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
Product
Premmerce Wishlist for WooCommerce
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Premmerce Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Blaze Demo Importer: Unauthorized database resets and file deletionCVE-2025-13334 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability check on the "blaze_demo_importer_install_demo" function in all versions up to, and including, 1.0.13. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the database by truncating all tables (except options, usermeta, and users), delete all sidebar widgets, theme modifications, and content of the uploads folder.
Product
Blaze Demo Importer
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Blaze Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2025Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus: Unauthorized modification of dataCVE-2025-13314 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions. This makes it possible for unauthenticated attackers to modify the plugin's settings and create arbitrary filter options.
Product
Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 11, 2025Campay Woocommerce Payment Gateway: Unauthenticated Payment BypassCVE-2025-12883 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly validating that a transaction has occurred through the payment gateway. This makes it possible for unauthenticated attackers to bypass payments and mark orders as successfully completed resulting in a loss of income.
Product
Campay Woocommerce Payment Gateway
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Campay Woocommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 11, 2025Premmerce Brands for WooCommerce: Unauthorized modification of dataCVE-2025-12783 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify brand permalink settings.
Product
Premmerce Brands for WooCommerce
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update Premmerce Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 9, 2025Elated Membership: Authentication BypassCVE-2025-13613 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
Product
Elated Membership
Affected
up to 1.2
What to do
Affects up to 1.2. Update Elated Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Dec 9, 2025Spectra: Missing AuthorizationCVE-2023-23729 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.
Product
Spectra
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vdp.patchstack.com
Dec 9, 2025ARMember: Missing AuthorizationCVE-2022-47425 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10.
Product
ARMember
Affected
up to 3.4.10
What to do
Affects up to 3.4.10. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vdp.patchstack.com
Dec 9, 2025Slider a SlidersPack: Missing AuthorizationCVE-2022-46845 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Essential Plugin Slider a SlidersPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider a SlidersPack: from n/a before 2.3.
Product
Slider a SlidersPack
Fixed in
2.3
What to do
Update Slider a SlidersPack to 2.3 or newer.
Full record and what to do →NVD record vdp.patchstack.com
Dec 9, 2025WebToffee eCommerce Marketing Automation: Missing AuthorizationCVE-2025-67599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee WebToffee eCommerce Marketing Automation decorator-woocommerce-email-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebToffee eCommerce Marketing Automation: from n/a through <= 2.1.1.
Product
WebToffee eCommerce Marketing Automation
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WebToffee eCommerce Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Fluent Booking: Missing AuthorizationCVE-2025-67597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjahan Jewel Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through <= 1.9.11.
Product
Fluent Booking
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update Fluent Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Thim Elementor Kit: Authorization Bypass Through User-Controlled KeyCVE-2025-67594 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thim Elementor Kit: from n/a through <= 1.3.3.
Product
Thim Elementor Kit
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Thim Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025My Calendar: Missing AuthorizationCVE-2025-67592 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Calendar: from n/a through <= 3.6.16.
Product
My Calendar
Affected
up to 3.6.16
What to do
Affects up to 3.6.16. Update My Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2025-67589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.
Product
WooCommerce PDF Invoices & Packing Slips
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Elementor Website Builder: Missing AuthorizationCVE-2025-67588 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.
Product
Elementor Website Builder
Affected
up to 3.33.0
What to do
Affects up to 3.33.0. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Highlight and Share: Missing AuthorizationCVE-2025-67586 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.
Product
Highlight and Share
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update Highlight and Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025GoDAM: Missing AuthorizationCVE-2025-67584 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in rtCamp GoDAM godam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDAM: from n/a through <= 1.4.6.
Product
GoDAM
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update GoDAM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025IDonate: Missing AuthorizationCVE-2025-67583 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.
Product
IDonate
Affected
up to 2.1.15
What to do
Affects up to 2.1.15. Update IDonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Wbcom Designs: Missing AuthorizationCVE-2025-67582 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wbcomdesigns Wbcom Designs lock-my-bp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wbcom Designs: from n/a through <= 2.1.1.
Product
Wbcom Designs
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Wbcom Designs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025TrueBooker: Missing AuthorizationCVE-2025-67581 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.0.
Product
TrueBooker
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Constant Contact + WooCommerce: Missing AuthorizationCVE-2025-67580 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= 2.4.1.
Product
Constant Contact + WooCommerce
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Constant Contact + WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025User Extra Fields: Missing AuthorizationCVE-2025-67579 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.
Product
User Extra Fields
Affected
up to 16.8
What to do
Affects up to 16.8. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP Email Capture: Missing AuthorizationCVE-2025-67578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Email Capture: from n/a through <= 3.12.4.
Product
WP Email Capture
Affected
up to 3.12.4
What to do
Affects up to 3.12.4. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Easy Form Builder: Missing AuthorizationCVE-2025-67577 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.
Product
Easy Form Builder
Affected
up to 3.8.20
What to do
Affects up to 3.8.20. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Simple Link Directory: Missing AuthorizationCVE-2025-67576 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through <= 8.8.3.
Product
Simple Link Directory
Affected
up to 8.8.3
What to do
Affects up to 8.8.3. Update Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Sitewide Notice WP: Missing AuthorizationCVE-2025-67575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sitewide Notice WP: from n/a through <= 2.4.1.
Product
Sitewide Notice WP
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Sitewide Notice WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2025-67574 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.30.
Product
Booking calendar, Appointment Booking System
Affected
up to 3.2.30
What to do
Affects up to 3.2.30. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Sailing: Missing AuthorizationCVE-2025-67573 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sailing: from n/a through < 4.4.6.
Product
Sailing
What to do
Update Sailing to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025PenNews: Missing AuthorizationCVE-2025-67572 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PenNews: from n/a through < 6.7.4.
Product
PenNews
What to do
Update PenNews to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WPFunnels: Missing AuthorizationCVE-2025-67571 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.
Product
WPFunnels
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WPForms Google Sheet Connector: Missing AuthorizationCVE-2025-67570 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.
Product
WPForms Google Sheet Connector
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025AdForest: Missing AuthorizationCVE-2025-67569 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdForest: from n/a through <= 6.0.11.
Product
AdForest
Affected
up to 6.0.11
What to do
Affects up to 6.0.11. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Basel: Missing AuthorizationCVE-2025-67568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: from n/a through <= 5.9.1.
Product
Basel
Affected
up to 5.9.1
What to do
Affects up to 5.9.1. Update Basel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Sober: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67567 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This issue affects Sober: from n/a through <= 3.5.11.
Product
Sober
Affected
up to 3.5.11
What to do
Affects up to 3.5.11. Update Sober to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Woffice Core: Missing AuthorizationCVE-2025-67566 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.
Product
Woffice Core
Affected
up to 5.4.30
What to do
Affects up to 5.4.30. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Rehub: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67565 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.
Product
Rehub
Affected
up to 19.9.9.1
What to do
Affects up to 19.9.9.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Pixel Manager for WooCommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects Pixel Manager for WooCommerce: from n/a through <= 1.51.1.
Product
Pixel Manager for WooCommerce
Affected
up to 1.51.1
What to do
Affects up to 1.51.1. Update Pixel Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.