Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,156 results · page 99 of 204
Aug 21, 2025ProveSource Social Proof: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-48355 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ProveSource LTD ProveSource Social Proof provesource allows Retrieve Embedded Sensitive Data.This issue affects ProveSource Social Proof: from n/a through <= 3.1.2.
- Product
- ProveSource Social Proof
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update ProveSource Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Taxi Booking Manager for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-54713 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.3.0.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Webba Booking: Missing AuthorizationCVE-2025-54040 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 5.1.20.
- Product
- Webba Booking
- Affected
- up to 5.1.20
- What to do
- Affects up to 5.1.20. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Coupon Affiliates: Missing AuthorizationCVE-2025-54025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.
- Product
- Coupon Affiliates
- Affected
- up to 6.4.0
- What to do
- Affects up to 6.4.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Maya Business: Authorization Bypass Through User-Controlled KeyCVE-2025-53208 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through <= 1.2.0.
- Product
- Maya Business
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Maya Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Houzez: Missing AuthorizationCVE-2025-49406 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1.
- Product
- Houzez
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025Themify Builder: Missing AuthorizationCVE-2025-49396 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themify Builder: from n/a through <= 7.6.7.
- Product
- Themify Builder
- Affected
- up to 7.6.7
- What to do
- Affects up to 7.6.7. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2025ColorMag: Unauthorized modification of dataCVE-2025-9202 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the ThemeGrill Demo Importer plugin.
- Product
- ColorMag
- Affected
- up to 4.0.19
- What to do
- Affects up to 4.0.19. Update ColorMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.cleantalk.orgthemes.trac.wordpress.org
Aug 16, 2025AL Pack: Unauthorized accessCVE-2025-7664 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AL Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the check_activate_permission() permission callback for the /wp-json/presslearn/v1/activate REST API endpoint in all versions up to, and including, 1.1.1. The callback reads the client-supplied Origin header and, after parsing, allows the request if it matches one of the trusted domains, without ever verifying user authentication, capabilities, or nonce tokens. This makes it possible for unauthenticated attackers to activate premium features by simply spoofing the Origin header.
- Product
- AL Pack
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update AL Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2025WPGYM - Wordpress Gym Management System: Unauthorized admin account creationCVE-2025-6080 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to unauthorized admin account creation in all versions up to, and including, 67.7.0. This is due to the plugin not properly validating a user's capabilities prior to adding users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new users, including admins.
- Product
- WPGYM - Wordpress Gym Management System
- Affected
- up to 67.7.0
- What to do
- Affects up to 67.7.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Aug 15, 2025Ultimate Video Player: Missing AuthorizationCVE-2025-49432 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FWDesign Ultimate Video Player fwduvp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Video Player: from n/a through <= 10.1.
- Product
- Ultimate Video Player
- Affected
- up to 10.1
- What to do
- Affects up to 10.1. Update Ultimate Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WooCommerce OTP Login With Phone Number, OTP Verification: Authentication bypassCVE-2025-8342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
- Product
- WooCommerce OTP Login With Phone Number, OTP Verification
- Affected
- up to 1.8.47
- What to do
- Affects up to 1.8.47. Update WooCommerce OTP Login With Phone Number, OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025Order Tip for WooCommerce: Unauthenticated Improper Input ValidationCVE-2025-6025 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.
- Product
- Order Tip for WooCommerce
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Order Tip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025WP Statistics: Missing AuthorizationCVE-2025-55716 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Statistics: from n/a through <= 14.15.
- Product
- WP Statistics
- Affected
- up to 14.15
- What to do
- Affects up to 14.15. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025The Plus Addons for Elementor Page Builder Lite: Missing AuthorizationCVE-2025-55712 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 6.3.13.
- Product
- The Plus Addons for Elementor Page Builder Lite
- Affected
- up to 6.3.13
- What to do
- Affects up to 6.3.13. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Nexter Blocks: Missing AuthorizationCVE-2025-54739 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nexter Blocks: from n/a through <= 4.5.4.
- Product
- Nexter Blocks
- Affected
- up to 4.5.4
- What to do
- Affects up to 4.5.4. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Savoy: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-54736 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This issue affects Savoy: from n/a through <= 3.0.8.
- Product
- Savoy
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Savoy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Embedder for Google Reviews: Missing AuthorizationCVE-2025-54730 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews embedder-for-google-reviews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embedder for Google Reviews: from n/a through <= 1.7.3.
- Product
- Embedder for Google Reviews
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Embedder for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Membership: Missing AuthorizationCVE-2025-54717 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.3.
- Product
- WP Membership
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Easy Elementor Addons: Missing AuthorizationCVE-2025-54712 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Elementor Addons: from n/a through <= 2.2.7.
- Product
- Easy Elementor Addons
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Easy Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Modernize: Missing AuthorizationCVE-2025-53343 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoodLayers Modernize modernize allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modernize: from n/a through <= 3.4.0.
- Product
- Modernize
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Modernize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025App, SaaS & Software Startup Tech Theme - Stratus: Missing AuthorizationCVE-2025-53341 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pixel Makers Creative INC. App, SaaS & Software Startup Tech Theme - Stratus allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects App, SaaS & Software Startup Tech Theme - Stratus: from n/a before 4.2.11.
- Product
- App, SaaS & Software Startup Tech Theme - Stratus
- Fixed in
- 4.2.11
- What to do
- Update App, SaaS & Software Startup Tech Theme - Stratus to 4.2.11 or newer.
Aug 14, 2025CodeablePress: Missing AuthorizationCVE-2025-53221 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in codeablepress CodeablePress codeablepress-simple-frontend-profile-picture-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CodeablePress: from n/a through <= 1.0.2.
- Product
- CodeablePress
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update CodeablePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WpEvently: Missing AuthorizationCVE-2025-54705 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 4.4.6.
- Product
- WpEvently
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025HT Mega: Missing AuthorizationCVE-2025-54695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in DevItems HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through <= 2.9.0.
- Product
- HT Mega
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update HT Mega to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Membership For WooCommerce: Missing AuthorizationCVE-2025-54692 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.9.0.
- Product
- Membership For WooCommerce
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Motors: Authorization Bypass Through User-Controlled KeyCVE-2025-54691 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through <= 1.4.80.
- Product
- Motors
- Affected
- up to 1.4.80
- What to do
- Affects up to 1.4.80. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Neon Channel Product Customizer Free: Missing AuthorizationCVE-2025-54679 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free neon-channel-product-customizer-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Neon Channel Product Customizer Free: from n/a through <= 2.0.
- Product
- Neon Channel Product Customizer Free
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Neon Channel Product Customizer Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025TheBooking: Missing AuthorizationCVE-2025-52801 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in VonStroheim TheBooking thebooking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TheBooking: from n/a through <= 1.4.4.
- Product
- TheBooking
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update TheBooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025The E-Commerce ERP: Missing AuthorizationCVE-2025-52800 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.
- Product
- The E-Commerce ERP
- Affected
- up to 2.1.1.3
- What to do
- Affects up to 2.1.1.3. Update The E-Commerce ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025SMM API: Missing AuthorizationCVE-2025-52785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through <= 6.0.31.
- Product
- SMM API
- Affected
- up to 6.0.31
- What to do
- Affects up to 6.0.31. Update SMM API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Project Cost Calculator: Missing AuthorizationCVE-2025-52775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through <= 1.0.0.
- Product
- Project Cost Calculator
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Project Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WordPress Event Manager, Event Calendar and Booking: Missing AuthorizationCVE-2025-52731 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through <= 4.0.24.
- Product
- WordPress Event Manager, Event Calendar and Booking
- Affected
- up to 4.0.24
- What to do
- Affects up to 4.0.24. Update WordPress Event Manager, Event Calendar and Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Global Gallery: Missing AuthorizationCVE-2025-52721 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global Gallery: from n/a through 9.2.3.
- Product
- Global Gallery
- Affected
- up to 9.2.3
- What to do
- Affects up to 9.2.3. Update Global Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025DB Backup: Missing AuthorizationCVE-2025-50031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in syedamirhussain91 DB Backup db-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DB Backup: from n/a through <= 6.0.
- Product
- DB Backup
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025AI Tools: Missing AuthorizationCVE-2025-50029 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ashish AI Tools artificial-intelligence-auto-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Tools: from n/a through <= 4.0.7.
- Product
- AI Tools
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update AI Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Netease Music: Missing AuthorizationCVE-2025-49052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dariolee Netease Music netease-music allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netease Music: from n/a through <= 3.2.1.
- Product
- Netease Music
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Netease Music to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Authentication and xmlrpc log writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49037 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Federico Rota Authentication and xmlrpc log writer authentication-and-xmlrpc-log-writer allows Reflected XSS.This issue affects Authentication and xmlrpc log writer: from n/a through <= 1.2.2.
- Product
- Authentication and xmlrpc log writer
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Authentication and xmlrpc log writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Lead Capturing Pages: Missing AuthorizationCVE-2025-31425 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
- Product
- WP Lead Capturing Pages
- What to do
- Update WP Lead Capturing Pages to the newest version.
Aug 14, 2025Thank You Page Customizer for WooCommerce: Missing AuthorizationCVE-2025-30993 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.7.
- Product
- Thank You Page Customizer for WooCommerce
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Thank You Page Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025IDonatePro: Missing AuthorizationCVE-2025-30639 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonatePro: from n/a through <= 2.1.9.
- Product
- IDonatePro
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update IDonatePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Advanced Google Universal Analytics: Missing AuthorizationCVE-2025-28962 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in stefanoai Advanced Google Universal Analytics advanced-google-universal-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Universal Analytics: from n/a through <= 1.0.3.
- Product
- Advanced Google Universal Analytics
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Advanced Google Universal Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2025Simple Local Avatars: Unauthorized modification of data in version 2CVE-2025-8482 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on the migrate_from_wp_user_avatar() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to migrate avatar metadata for all users.
- Product
- Simple Local Avatars
- What to do
- Update Simple Local Avatars to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 12, 2025FiboSearch: Missing AuthorizationCVE-2025-47444 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiboSearch: from n/a through <= 1.32.1.
- Product
- FiboSearch
- Affected
- up to 1.32.1
- What to do
- Affects up to 1.32.1. Update FiboSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2025Post SMTP: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-24000 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
- Product
- Post SMTP
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2025Zakra: Unauthorized data modificationCVE-2025-8595 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo settings.
- Product
- Zakra
- Affected
- up to 4.1.5
- What to do
- Affects up to 4.1.5. Update Zakra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.cleantalk.orgthemes.trac.wordpress.org
Aug 5, 2025the third-party `uploadify.php` script: WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file uploadCVE-2012-10027 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
- Product
- the third-party `uploadify.php` script
- Affected
- up to 1.35.0
- What to do
- Affects up to 1.35.0. Update the third-party `uploadify.php` script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordweb.archive.orgraw.githubusercontent.com
Aug 5, 2025upload.php: The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file uploadCVE-2012-10026 · WordPress plugins & themes · reported by VulnCheckCritical 10
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
- Product
- upload.php
- What to do
- Update upload.php to the newest version.
Full record and what to do →NVD recordweb.archive.orgraw.githubusercontent.com
Aug 2, 2025Brave Conversion Engine (PRO): Authentication BypassCVE-2025-7710 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the plugin not properly restricting a claimed identity while authenticating with Facebook. This makes it possible for unauthenticated attackers to log in as other users, including administrators.
- Product
- Brave Conversion Engine (PRO)
- Affected
- up to 0.7.7
- What to do
- Affects up to 0.7.7. Update Brave Conversion Engine (PRO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgetbrave.iowordfence.com
Aug 2, 2025Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder): Unauthorized modification of dataCVE-2025-8488 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_hfe_compatibility_option_callback ()function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the compatibility option setting.
- Product
- Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.