Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

10,145 results · page 88 of 203

Nov 25, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Missing AuthorizationCVE-2025-13452 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters.
Product
Admin and Customer Messages After Order for WooCommerce: OrderConvo
Affected
up to 14
What to do
Affects up to 14. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025Chamber Dashboard Business Directory: Unauthorized data exportCVE-2025-13414 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information, including sensitive business details.
Product
Chamber Dashboard Business Directory
Affected
up to 3.3.11
What to do
Affects up to 3.3.11. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025Ace Post Type Builder: Unauthorized custom taxonomy deletionCVE-2025-13405 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing authorization validation on the cptb_delete_custom_taxonomy() function in all versions up to, and including, 1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary custom taxonomies.
Product
Ace Post Type Builder
Affected
up to 1.9
What to do
Affects up to 1.9. Update Ace Post Type Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025atec Duplicate Page & Post: Unauthorized post duplicationCVE-2025-13404 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The atec Duplicate Page & Post plugin for WordPress is vulnerable to unauthorized post duplication due to missing authorization validation on the duplicate_post() function in all versions up to, and including, 1.2.20. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, including private and password-protected posts, leading to data exposure.
Product
atec Duplicate Page & Post
Affected
up to 1.2.20
What to do
Affects up to 1.2.20. Update atec Duplicate Page & Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Unauthorized access of dataCVE-2025-13389 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `get_order_by_id()` function in all versions up to, and including, 14. This makes it possible for unauthenticated attackers to view sensitive WooCommerce order details and private conversation messages between customers and store administrators for any order by supplying an arbitrary order ID.
Product
Admin and Customer Messages After Order for WooCommerce: OrderConvo
Affected
up to 14
What to do
Affects up to 14. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025Social Images Widget: Unauthorized modification of dataCVE-2025-13386 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options_update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Social Images Widget
Affected
up to 2.1
What to do
Affects up to 2.1. Update Social Images Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 25, 2025Refund Request for WooCommerce: Unauthorized modification of dataCVE-2025-12634 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_refund_status' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update refund statuses to approved or rejected.
Product
Refund Request for WooCommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update Refund Request for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 25, 2025Autochat Automatic Conversation: Unauthorized modification of dataCVE-2025-12043 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Autochat Automatic Conversation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_auycht_saveCid' AJAX endpoint in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to connect and disconnect the client ID.
Product
Autochat Automatic Conversation
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Autochat Automatic Conversation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 25, 2025Blog2Social: Social Media Auto Post & Scheduler: Unauthorized modification of dataCVE-2025-13558 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteUserCcDraftPost' function in all versions up to, and including, 8.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the status of arbitrary posts to trash.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.7.0
What to do
Affects up to 8.7.0. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 24, 2025Search Exclude: Unauthorized modification of dataCVE-2025-10646 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capability check on the Base::get_rest_permission() method in all versions up to, and including, 2.5.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings, such as adding arbitrary posts to the search exclusion list.
Product
Search Exclude
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Search Exclude to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2025Booking Calendar Contact Form: Missing AuthorizationCVE-2025-13318 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and bypass payment requirements via the 'dex_bccf_ipn' parameter.
Product
Booking Calendar Contact Form
Affected
up to 1.2.60
What to do
Affects up to 1.2.60. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2025GSheetConnector For Ninja Forms: Unauthorized access of dataCVE-2025-13136 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-sheet-config ' page in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve information about the system.
Product
GSheetConnector For Ninja Forms
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update GSheetConnector For Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2025CP Contact Form with PayPal: Missing AuthorizationCVE-2025-13384 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint (via the 'cp_contactformpp_ipncheck' query parameter) that processes payment confirmations without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthenticated attackers to mark form submissions as paid without making actual payments by sending forged payment notification requests with arbitrary POST data (payment_status, txn_id, payer_email).
Product
CP Contact Form with PayPal
Affected
up to 1.3.56
What to do
Affects up to 1.3.56. Update CP Contact Form with PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2025Appointment Booking Calendar: Missing AuthorizationCVE-2025-13317 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.
Product
Appointment Booking Calendar
Affected
up to 1.3.96
What to do
Affects up to 1.3.96. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 22, 2025IDonate – Blood Donation, Request And Donor Management System: Unauthorized modification od dataCVE-2025-12877 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts. CVE-2025-67583 is likely a duplicate of this.
Product
IDonate – Blood Donation, Request And Donor Management System
Affected
up to 2.1.15
What to do
Affects up to 2.1.15. Update IDonate – Blood Donation, Request And Donor Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025Show Variations as Single Products Woocommerce: Missing AuthorizationCVE-2025-66114 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show Variations as Single Products Woocommerce: from n/a through <= 2.0.
Product
Show Variations as Single Products Woocommerce
Affected
up to 2.0
What to do
Affects up to 2.0. Update Show Variations as Single Products Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Better Chat Support for Messenger: Missing AuthorizationCVE-2025-66113 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Chat Support for Messenger: from n/a through <= 1.2.18.
Product
Better Chat Support for Messenger
Affected
up to 1.2.18
What to do
Affects up to 1.2.18. Update Better Chat Support for Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Accessibility Toolkit by WebYes: Missing AuthorizationCVE-2025-66112 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through <= 2.0.4.
Product
Accessibility Toolkit by WebYes
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Accessibility Toolkit by WebYes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Tiktok Feed: Missing AuthorizationCVE-2025-66110 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tiktok Feed: from n/a through <= 1.0.23.
Product
Tiktok Feed
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Tiktok Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Cart Weight for WooCommerce: Missing AuthorizationCVE-2025-66109 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cart Weight for WooCommerce: from n/a through <= 1.9.11.
Product
Cart Weight for WooCommerce
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update Cart Weight for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025TNC Toolbox: Web Performance: Missing AuthorizationCVE-2025-66108 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TNC Toolbox: Web Performance: from n/a through <= 2.0.4.
Product
TNC Toolbox: Web Performance
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update TNC Toolbox: Web Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Subscriptions & Memberships for PayPal: Missing AuthorizationCVE-2025-66107 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscriptions & Memberships for PayPal: from n/a through <= 1.1.7.
Product
Subscriptions & Memberships for PayPal
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Subscriptions & Memberships for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Featured Post Creative: Missing AuthorizationCVE-2025-66106 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5.
Product
Featured Post Creative
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Featured Post Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025CBX Bookmark & Favorite: Missing AuthorizationCVE-2025-66101 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CBX Bookmark & Favorite: from n/a through <= 2.0.1.
Product
CBX Bookmark & Favorite
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update CBX Bookmark & Favorite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Chat Help: Missing AuthorizationCVE-2025-66099 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chat Help: from n/a through <= 3.1.3.
Product
Chat Help
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Chat Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Table Block by Tableberg: Missing AuthorizationCVE-2025-66096 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by Tableberg: from n/a through <= 0.6.9.
Product
Table Block by Tableberg
Affected
up to 0.6.9
What to do
Affects up to 0.6.9. Update Table Block by Tableberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Product Feed for WooCommerce: Missing AuthorizationCVE-2025-66089 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.1.
Product
Product Feed for WooCommerce
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025PropertyHive: Missing AuthorizationCVE-2025-66087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.
Product
PropertyHive
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025SMS Alert Order Notifications: Missing AuthorizationCVE-2025-66086 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.8.
Product
SMS Alert Order Notifications
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Arconix Shortcodes: Missing AuthorizationCVE-2025-66085 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.
Product
Arconix Shortcodes
Affected
up to 2.1.18
What to do
Affects up to 2.1.18. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025FluentCommunity: Missing AuthorizationCVE-2025-66084 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through <= 2.0.0.
Product
FluentCommunity
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update FluentCommunity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025WpEvently: Missing AuthorizationCVE-2025-66083 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4.
Product
WpEvently
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025WpEvently: Missing AuthorizationCVE-2025-66082 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4.
Product
WpEvently
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Gutenverse Form: Missing AuthorizationCVE-2025-66079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through <= 2.2.0.
Product
Gutenverse Form
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Gutenverse Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Legal Pages: Missing AuthorizationCVE-2025-66077 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.6.
Product
Legal Pages
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66075 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
Product
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025UsersWP: Missing AuthorizationCVE-2025-66072 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through <= 1.2.47.
Product
UsersWP
Affected
up to 1.2.47
What to do
Affects up to 1.2.47. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Custom Order Numbers for WooCommerce: Missing AuthorizationCVE-2025-66071 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Order Numbers for WooCommerce: from n/a through <= 1.11.0.
Product
Custom Order Numbers for WooCommerce
Affected
up to 1.11.0
What to do
Affects up to 1.11.0. Update Custom Order Numbers for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025PPOM for WooCommerce: Missing AuthorizationCVE-2025-66069 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through <= 33.0.16.
Product
PPOM for WooCommerce
Affected
up to 33.0.16
What to do
Affects up to 33.0.16. Update PPOM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Gutenverse: Missing AuthorizationCVE-2025-66065 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jegstudio Gutenverse gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through <= 3.2.1.
Product
Gutenverse
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Gutenverse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025WP Google Review Slider: Missing AuthorizationCVE-2025-66063 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Google Review Slider: from n/a through <= 17.4.
Product
WP Google Review Slider
Affected
up to 17.4
What to do
Affects up to 17.4. Update WP Google Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Seriously Simple Podcasting: Missing AuthorizationCVE-2025-66060 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
Product
Seriously Simple Podcasting
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Seriously Simple Podcasting: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-66059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Retrieve Embedded Sensitive Data.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
Product
Seriously Simple Podcasting
Affected
up to 3.13.0
What to do
Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Uncanny Automator: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-66056 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Embedded Sensitive Data.This issue affects Uncanny Automator: from n/a through < 6.10.0.
Product
Uncanny Automator
What to do
Update Uncanny Automator to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025ELEX WordPress HelpDesk & Customer Ticketing System: Unauthorized modification of dataCVE-2025-10054 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the role and capabilities of any user with an Administrator, WSDesk Supervisor, or WSDesk Agents role.
Product
ELEX WordPress HelpDesk & Customer Ticketing System
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories: Unauthorized modification of dataCVE-2025-13149 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.
Product
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Nov 21, 2025AuthorSure: Cross-Site Request ForgeryCVE-2025-13134 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the 'authorsure' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
AuthorSure
Affected
up to 2.3
What to do
Affects up to 2.3. Update AuthorSure to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record drive.google.com wordfence.com
Nov 21, 2025Checkbox: Unauthorized loss of dataCVE-2025-12170 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX endpoint in all versions up to, and including, 2.8.10. This makes it possible for unauthenticated attackers to clear log files.
Product
Checkbox
Affected
up to 2.8.10
What to do
Affects up to 2.8.10. Update Checkbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2025Realty Portal: Unauthorized modification of data that can lead to privilege escalationCVE-2025-11985 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0.1 to 0.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Realty Portal
Affected
0.1 to 0.4.1
What to do
Affects 0.1 to 0.4.1. Update Realty Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org developer.wordpress.org
Nov 21, 2025UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2025-11815 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.08
What to do
Affects up to 3.5.08. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.