Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,145 results · page 93 of 203
Oct 24, 2025LLM Hubspot Blog Import: Unauthorized modification of dataCVE-2025-11257 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_save_blogs' AJAX endpoint in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger an import of all Hubspot data.
- Product
- LLM Hubspot Blog Import
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update LLM Hubspot Blog Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 24, 2025Check Plagiarism: Unauthorized modification of dataCVE-2025-11172 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action() function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the API key.
- Product
- Check Plagiarism
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Check Plagiarism to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 24, 2025Originality.ai AI Checker: Unauthorized loss of dataCVE-2025-10902 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
- Product
- Originality.ai AI Checker
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update Originality.ai AI Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2025Originality.ai AI Checker: Unauthorized access of dataCVE-2025-10901 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all versions up to, and including, 1.0.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
- Product
- Originality.ai AI Checker
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Originality.ai AI Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 24, 2025Microsoft Azure Storage for: Unauthorized Arbitrary Media DeletionCVE-2025-10749 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the replace_attachment parameter granted they can access the nonce which is exposed to all authenticated users.
- Product
- Microsoft Azure Storage for
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update Microsoft Azure Storage for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2025URL Shortener Plugin For: Unauthorized access to functionality provided by the APICVE-2025-10740 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capability check on the verifyRequest function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify links.
- Product
- URL Shortener Plugin For
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update URL Shortener Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2025MeetingHub: Missing AuthorizationCVE-2025-62073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sovlix MeetingHub meetinghub.This issue affects MeetingHub: from n/a through <= 1.23.9.
- Product
- MeetingHub
- Affected
- up to 1.23.9
- What to do
- Affects up to 1.23.9. Update MeetingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Front End Users: Missing AuthorizationCVE-2025-62072 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33.
- Product
- Front End Users
- Affected
- up to 3.2.33
- What to do
- Affects up to 3.2.33. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-62071 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.29.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 5.29
- What to do
- Affects up to 5.29. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WowRevenue: Missing AuthorizationCVE-2025-62070 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPXPO WowRevenue revenue.This issue affects WowRevenue: from n/a through <= 1.2.13.
- Product
- WowRevenue
- Affected
- up to 1.2.13
- What to do
- Affects up to 1.2.13. Update WowRevenue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025One Page Express Companion: Missing AuthorizationCVE-2025-62052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through <= 1.6.43.
- Product
- One Page Express Companion
- Affected
- up to 1.6.43
- What to do
- Affects up to 1.6.43. Update One Page Express Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025SmartCrawl: Missing AuthorizationCVE-2025-62048 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform SmartCrawl smartcrawl-seo.This issue affects SmartCrawl: from n/a through <= 3.14.3.
- Product
- SmartCrawl
- Affected
- up to 3.14.3
- What to do
- Affects up to 3.14.3. Update SmartCrawl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Event Tickets: Missing AuthorizationCVE-2025-62027 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3.
- Product
- Event Tickets
- Affected
- up to 5.26.3
- What to do
- Affects up to 5.26.3. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025BuddyPress: Missing AuthorizationCVE-2025-62022 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4.
- Product
- BuddyPress
- Affected
- up to 14.3.4
- What to do
- Affects up to 14.3.4. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Acknowledgify: Missing AuthorizationCVE-2025-62021 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Made Neat Acknowledgify acknowledgify.This issue affects Acknowledgify: from n/a through <= 1.1.3.
- Product
- Acknowledgify
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Acknowledgify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2025-62019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.
- Product
- Recipe Card Blocks for Gutenberg & Elementor
- Affected
- up to 3.4.8
- What to do
- Affects up to 3.4.8. Update Recipe Card Blocks for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025UiChemy: Missing AuthorizationCVE-2025-62013 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in POSIMYTH UiChemy uichemy.This issue affects UiChemy: from n/a through <= 4.0.0.
- Product
- UiChemy
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update UiChemy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP SMS: Missing AuthorizationCVE-2025-62006 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1.
- Product
- WP SMS
- Affected
- up to 7.0.1
- What to do
- Affects up to 7.0.1. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Emails Catch All: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-60041 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3.
- Product
- Emails Catch All
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Emails Catch All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MasterStudy LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59575 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Author: Munzir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58916 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munzir Author: Munzir myshouts-shoutbox allows Reflected XSS.This issue affects Author: Munzir: from n/a through <= 0.9.
- Product
- Author: Munzir
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Author: Munzir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Orders & Customers Exporter: Missing AuthorizationCVE-2025-53424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.
- Product
- WooCommerce Orders & Customers Exporter
- Affected
- up to 5.4
- What to do
- Affects up to 5.4. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Accordion: Missing AuthorizationCVE-2025-53421 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.
- Product
- Accordion
- Affected
- up to 2.3.14
- What to do
- Affects up to 2.3.14. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025UDesign Core: Missing AuthorizationCVE-2025-53236 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in AndonDesign UDesign Core u-design-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UDesign Core: from n/a through <= 4.14.0.
- Product
- UDesign Core
- Affected
- up to 4.14.0
- What to do
- Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025SUMO Memberships for WooCommerce: Missing AuthorizationCVE-2025-52757 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.
- Product
- SUMO Memberships for WooCommerce
- What to do
- Update SUMO Memberships for WooCommerce to the newest version.
Oct 22, 2025IDonatePro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-52752 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.
- Product
- IDonatePro
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update IDonatePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Wikipedia Preview: Missing AuthorizationCVE-2025-52738 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.
- Product
- Wikipedia Preview
- Affected
- up to 1.15.0
- What to do
- Affects up to 1.15.0. Update Wikipedia Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Breeze Checkout: Missing AuthorizationCVE-2025-49961 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Breeze Team Breeze Checkout breeze-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze Checkout: from n/a through <= 1.4.0.
- Product
- Breeze Checkout
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Breeze Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Houzez: Authorization Bypass Through User-Controlled KeyCVE-2025-49952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.
- Product
- Houzez
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Official Integration for Billingo: Missing AuthorizationCVE-2025-49950 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in billingo Official Integration for Billingo billingo allows Privilege Escalation.This issue affects Official Integration for Billingo: from n/a through <= 4.3.0.
- Product
- Official Integration for Billingo
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update Official Integration for Billingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Templazee: Missing AuthorizationCVE-2025-49949 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in templazee Templazee templazee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templazee: from n/a through <= 1.0.2.
- Product
- Templazee
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Templazee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Smash Balloon Social Post Feed: Missing AuthorizationCVE-2025-49937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.
- Product
- Smash Balloon Social Post Feed
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Smash Balloon Social Post Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPLMS: Missing AuthorizationCVE-2025-49925 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.
- Product
- WPLMS
- Affected
- up to 1.9.9.7
- What to do
- Affects up to 1.9.9.7. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPeMatico RSS Feed Fetcher: Missing AuthorizationCVE-2025-49922 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.3.
- Product
- WPeMatico RSS Feed Fetcher
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Web Accessibility By accessiBe: Missing AuthorizationCVE-2025-49920 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10.
- Product
- Web Accessibility By accessiBe
- Affected
- up to 2.10
- What to do
- Affects up to 2.10. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MultiVendorX: Missing AuthorizationCVE-2025-49916 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.
- Product
- MultiVendorX
- Affected
- up to 4.2.23
- What to do
- Affects up to 4.2.23. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025CoSchedule: Missing AuthorizationCVE-2025-49913 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.
- Product
- CoSchedule
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update CoSchedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPGuppy: Missing AuthorizationCVE-2025-49910 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4.
- Product
- WPGuppy
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MDTF: Missing AuthorizationCVE-2025-49907 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.3.9.
- Product
- MDTF
- Affected
- up to 1.3.3.9
- What to do
- Affects up to 1.3.3.9. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPComplete: Missing AuthorizationCVE-2025-49906 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3.
- Product
- WPComplete
- Affected
- up to 2.9.5.3
- What to do
- Affects up to 2.9.5.3. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025ZoloBlocks: Missing AuthorizationCVE-2025-49903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in bdthemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through <= 2.3.11.
- Product
- ZoloBlocks
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update ZoloBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Simple Link Directory: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-49901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
- Product
- Simple Link Directory
- What to do
- Update Simple Link Directory to the newest version.
Oct 22, 2025Whydonate: Missing AuthorizationCVE-2025-49899 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.
- Product
- Whydonate
- Affected
- up to 4.0.15
- What to do
- Affects up to 4.0.15. Update Whydonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Hydra Booking: Missing AuthorizationCVE-2025-49377 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.
- Product
- Hydra Booking
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025DELUCKS SEO: Missing AuthorizationCVE-2025-49376 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects DELUCKS SEO: from n/a through <= 2.5.9.
- Product
- DELUCKS SEO
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Custom CSS: Missing AuthorizationCVE-2025-48096 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0.
- Product
- Custom CSS
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Custom CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Tablesome Table Premium: Missing AuthorizationCVE-2025-30944 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Essekia Tablesome Table Premium tablesome-premium allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tablesome Table Premium: from n/a through <= 1.1.23.
- Product
- Tablesome Table Premium
- Affected
- up to 1.1.23
- What to do
- Affects up to 1.1.23. Update Tablesome Table Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Flexible Refund and Return Order for WooCommerce: Missing AuthorizationCVE-2025-10570 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.
- Product
- Flexible Refund and Return Order for WooCommerce
- Affected
- up to 1.0.38
- What to do
- Affects up to 1.0.38. Update Flexible Refund and Return Order for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 22, 2025The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to downloCVE-2025-10638 · WordPress plugins & themes · reported by WPScanMedium 5.3
The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address
- Product
- NS Maintenance Mode for WP
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update NS Maintenance Mode for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2025Kognetiks Chatbot: Unauthorized modification of dataCVE-2025-11256 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversations.
- Product
- Kognetiks Chatbot
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Kognetiks Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.