Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,145 results · page 103 of 203
Jun 6, 2025onOffice for WP-Websites: Missing AuthorizationCVE-2025-30958 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onOffice for WP-Websites: from n/a through <= 6.5.1.
- Product
- onOffice for WP-Websites
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update onOffice for WP-Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Activity Plus Reloaded for BuddyPress: Missing AuthorizationCVE-2025-30957 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
- Product
- Activity Plus Reloaded for BuddyPress
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Activity Plus Reloaded for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Taskbuilder: Missing AuthorizationCVE-2025-30945 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in taskbuilder Taskbuilder taskbuilder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Taskbuilder: from n/a through <= 4.0.7.
- Product
- Taskbuilder
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025診断ジェネレータ作成プラグイン: Missing AuthorizationCVE-2025-30934 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OLIVESYSTEM 診断ジェネレータ作成プラグイン os-diagnosis-generator allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 診断ジェネレータ作成プラグイン: from n/a through <= 1.4.16.
- Product
- 診断ジェネレータ作成プラグイン
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update 診断ジェネレータ作成プラグイン to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Compress for MainWP: Missing AuthorizationCVE-2025-30932 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.30.32.
- Product
- WP Compress for MainWP
- Affected
- up to 6.30.32
- What to do
- Affects up to 6.30.32. Update WP Compress for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Wordapp: Missing AuthorizationCVE-2025-30927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wordapp Team Wordapp wordapp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordapp: from n/a through <= 1.7.0.
- Product
- Wordapp
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Wordapp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Accessibility Suite: Missing AuthorizationCVE-2025-30636 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.19.
- Product
- Accessibility Suite
- Affected
- up to 4.19
- What to do
- Affects up to 4.19. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WordLift: Missing AuthorizationCVE-2025-30624 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WordLift WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through <= 3.54.4.
- Product
- WordLift
- Affected
- up to 3.54.4
- What to do
- Affects up to 3.54.4. Update WordLift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Custom Category/Post Type Post order: Missing AuthorizationCVE-2025-29013 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in faaiq Custom Category/Post Type Post order custom-post-order-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Category/Post Type Post order: from n/a through <= 1.6.0.
- Product
- Custom Category/Post Type Post order
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Custom Category/Post Type Post order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Behance Portfolio Manager: Missing AuthorizationCVE-2025-29010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Direct Checkout for WooCommerce Lite: Missing AuthorizationCVE-2025-29006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in centangle Direct Checkout for WooCommerce Lite woo-direct-checkout-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Direct Checkout for WooCommerce Lite: from n/a through <= 1.0.3.
- Product
- Direct Checkout for WooCommerce Lite
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Direct Checkout for WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP AutoKeyword: Missing AuthorizationCVE-2025-28997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP AutoKeyword: from n/a through <= 1.0.
- Product
- WP AutoKeyword
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP AutoKeyword to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025GPP Slideshow: Missing AuthorizationCVE-2025-28996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Thad Allender GPP Slideshow gpp-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GPP Slideshow: from n/a through <= 1.3.5.
- Product
- GPP Slideshow
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update GPP Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Viral Loops WP Integration: Missing AuthorizationCVE-2025-28995 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Loops WP Integration: from n/a through <= 3.8.1.
- Product
- Viral Loops WP Integration
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Viral Loops WP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Viral Loops WP Integration: Missing AuthorizationCVE-2025-28994 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Loops WP Integration: from n/a through <= 3.8.1.
- Product
- Viral Loops WP Integration
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Viral Loops WP Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Elastic Email Subscribe Form: Missing AuthorizationCVE-2025-28985 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Elastic Email Elastic Email Subscribe Form elastic-email-subscribe-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Subscribe Form: from n/a through <= 1.2.2.
- Product
- Elastic Email Subscribe Form
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Elastic Email Subscribe Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Post Author: Cross-Site Request Forgery (CSRF)CVE-2025-28950 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through <= 1.1.1.
- Product
- Post Author
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Post Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025No Spam At All: Missing AuthorizationCVE-2025-24778 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in De paragon No Spam At All no-spam-at-all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects No Spam At All: from n/a through <= 1.3.
- Product
- No Spam At All
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update No Spam At All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Responsive Flipbooks: Missing AuthorizationCVE-2025-24776 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codelobster Responsive Flipbooks responsive-flipbooks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Flipbooks: from n/a through <= 1.0.
- Product
- Responsive Flipbooks
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Responsive Flipbooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025bbPress API: Missing AuthorizationCVE-2025-24763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pascal Casier bbPress API bbp-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects bbPress API: from n/a through <= 1.0.14.
- Product
- bbPress API
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update bbPress API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025TicketBAI Facturas para WooCommerce: Missing AuthorizationCVE-2025-24762 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TicketBAI Facturas para WooCommerce: from n/a through <= 3.45.
- Product
- TicketBAI Facturas para WooCommerce
- Affected
- up to 3.45
- What to do
- Affects up to 3.45. Update TicketBAI Facturas para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025KI Live Video Conferences: Missing AuthorizationCVE-2025-23971 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
- Product
- KI Live Video Conferences
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025KI Live Video Conferences: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-23969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Retrieve Embedded Sensitive Data.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
- Product
- KI Live Video Conferences
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 20256Storage Rentals: Missing AuthorizationCVE-2023-26002 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5.
- Product
- 6Storage Rentals
- Affected
- up to 2.19.5
- What to do
- Affects up to 2.19.5. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Sola Support Ticket: Missing AuthorizationCVE-2023-25997 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a through 3.17.
- Product
- Sola Support Ticket
- Affected
- up to 3.17
- What to do
- Affects up to 3.17. Update Sola Support Ticket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025QuickCab: Missing AuthorizationCVE-2025-48337 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuickcabWP QuickCab.This issue affects QuickCab: from n/a through 1.3.3.
- Product
- QuickCab
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update QuickCab to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Responsive Plus: Missing AuthorizationCVE-2025-48335 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Plus: from n/a through <= 3.2.0.
- Product
- Responsive Plus
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Responsive Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Hive Support: Unauthorized access and modification of dataCVE-2025-5018 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hs_update_ai_chat_settings() and hive_lite_support_get_all_binbox() functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and overwrite the site’s OpenAI API key and inspection data or modify AI-chat prompts and behavior. This vulnerability is potentially a duplicate of CVE-2025-32208 or/and CVE-2025-32242.
- Product
- Hive Support
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2025Art: Unauthorized accessCVE-2025-1778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'arttheme_theme_option_restore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the theme option.
- Product
- Art
- Affected
- up to 3.12.2.3
- What to do
- Affects up to 3.12.2.3. Update Art to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jun 6, 2025BM Content Builder: Unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' functionCVE-2025-1777 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'ux_cb_page_options_save' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- BM Content Builder
- Affected
- up to 3.16.2.1
- What to do
- Affects up to 3.16.2.1. Update BM Content Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseatheme.networdfence.com
Jun 5, 2025Uncanny Automator: Missing AuthorizationCVE-2025-48133 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through <= 6.4.0.2.
- Product
- Uncanny Automator
- Affected
- up to 6.4.0.2
- What to do
- Affects up to 6.4.0.2. Update Uncanny Automator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2025Element Pack Pro: Missing AuthorizationCVE-2025-46258 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BdThemes Element Pack Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Pack Pro: from n/a before 8.0.0.
- Product
- Element Pack Pro
- Fixed in
- 8.0.0
- What to do
- Update Element Pack Pro to 8.0.0 or newer.
Jun 5, 2025HyperComments: Unauthorized modification of data that can lead to privilege escalationCVE-2025-5701 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- HyperComments
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update HyperComments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 4, 2025File Provider: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-4578 · WordPress plugins & themes · reported by WPScanCritical 9.8
The File Provider WordPress plugin through 1.2.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- File Provider
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update File Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 3, 2025Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs.CVE-2025-48951 · WordPress plugins & themes · reported by GitHubCritical 9.3
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Applications using the Auth0-PHP SDK are affected, as are applications using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, because those SDKsrely on the Auth0-PHP SDK versions from 8.0.0-BETA3 until 8.14.0. Version 8.3.1 contains a patch for the issue.
- What to do
- Update the plugin to the newest version.
Jun 2, 2025Broken Link Checker: Unauthorized data accessCVE-2025-4047 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajax_full_status and ajax_dashboard_status functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the plugin's status.
- Product
- Broken Link Checker
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2025WordPress Comments Import & Export: Unauthorized modification of dataCVE-2025-3919 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings parameters. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts on the plugin settings page that will execute whenever an administrative user accesses an injected page. The vulnerability was partially fixed in version 2.4.3 and fully fixed in version 2.4.4
- Product
- WordPress Comments Import & Export
- Affected
- up to 2.4.3
- Fixed in
- 2.4.3
- What to do
- Update WordPress Comments Import & Export to 2.4.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2025Booking and Rental Manager: Missing AuthorizationCVE-2025-47585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking and Rental Manager: from n/a through <= 2.3.8.
- Product
- Booking and Rental Manager
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025Browse As: Authentication bypassCVE-2025-5190 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect authentication checking in the 'IS_BA_Browse_As::notice' function with the 'is_ba_original_user_COOKIEHASH' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the user id.
- Product
- Browse As
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Browse As to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 30, 2025Woo Slider Pro – Drag Drop Slider Builder For WooCommerce: Unauthorized modification of dataCVE-2025-4597 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Woo Slider Pro – Drag Drop Slider Builder For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woo_slide_pro_delete_draft_preview AJAX action in all versions up to, and including, 1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
- Product
- Woo Slider Pro – Drag Drop Slider Builder For WooCommerce
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Woo Slider Pro – Drag Drop Slider Builder For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2025Woo Slider Pro: Missing AuthorizationCVE-2025-48334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BinaryCarpenter Woo Slider Pro woo-slider-pro-drag-drop-slider-builder-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Slider Pro: from n/a through <= 1.12.
- Product
- Woo Slider Pro
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Woo Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2025Featured Image Plus – Quick & Bulk Edit with Unsplash: Unauthorized modification of dataCVE-2025-4431 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fip_save_attach_featured function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update featured image of any post.
- Product
- Featured Image Plus – Quick & Bulk Edit with Unsplash
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Featured Image Plus – Quick & Bulk Edit with Unsplash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 26, 2025MStore API – Create Native Android & iOS Apps On The Cloud: Unauthorized modification of dataCVE-2025-4683 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new posts.
- Product
- MStore API – Create Native Android & iOS Apps On The Cloud
- Affected
- up to 4.17.5
- What to do
- Affects up to 4.17.5. Update MStore API – Create Native Android & iOS Apps On The Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 23, 2025Visual Header: Missing AuthorizationCVE-2025-48275 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in dastan800 Visual Header visual-header allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Header: from n/a through <= 1.3.
- Product
- Visual Header
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Visual Header to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Leadinfo: Missing AuthorizationCVE-2025-48271 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Leadinfo Leadinfo leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadinfo: from n/a through <= 1.1.
- Product
- Leadinfo
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Leadinfo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Lead Form Data Collection to CRM: Missing AuthorizationCVE-2025-47690 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.
- Product
- Lead Form Data Collection to CRM
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Lead Form Data Collection to CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 20256Storage Rentals: Missing AuthorizationCVE-2025-47619 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Path Traversal.This issue affects 6Storage Rentals: from n/a through <= 2.20.2.
- Product
- 6Storage Rentals
- Affected
- up to 2.20.2
- What to do
- Affects up to 2.20.2. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025MapSVG: Missing AuthorizationCVE-2025-47558 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MapSVG: from n/a through < 8.6.13.
- Product
- MapSVG
- What to do
- Update MapSVG to the newest version.
May 23, 2025Experto CTA Widget – Call To Action, Sticky CTA, Floating Button: Missing AuthorizationCVE-2025-47529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in UX Design Experts Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin experto-cta-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin: from n/a through <= 1.1.1.
- Product
- Experto CTA Widget – Call To Action, Sticky CTA, Floating Button
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Experto CTA Widget – Call To Action, Sticky CTA, Floating Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Subaccounts for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-47461 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in mediaticus Subaccounts for WooCommerce subaccounts-for-woocommerce allows Authentication Abuse.This issue affects Subaccounts for WooCommerce: from n/a through <= 1.6.6.
- Product
- Subaccounts for WooCommerce
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Subaccounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.