Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,156 results · page 109 of 204
Apr 4, 2025StaffList: Missing AuthorizationCVE-2025-32232 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ERA404 StaffList stafflist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StaffList: from n/a through <= 3.2.7.
- Product
- StaffList
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update StaffList to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Bookingor: Missing AuthorizationCVE-2025-32231 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bookingor Bookingor bookingor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bookingor: from n/a through <= 2.0.1.
- Product
- Bookingor
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Bookingor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Variable Inspector: Missing AuthorizationCVE-2025-32229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Variable Inspector variable-inspector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Variable Inspector: from n/a through <= 2.6.3.
- Product
- Variable Inspector
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update Variable Inspector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Display product variations dropdown on shop page: Missing AuthorizationCVE-2025-32226 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Anzar Ahmed Display product variations dropdown on shop page display-product-variations-dropdown-on-shop-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display product variations dropdown on shop page: from n/a through <= 1.1.3.
- Product
- Display product variations dropdown on shop page
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Display product variations dropdown on shop page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025WP Event Manager: Missing AuthorizationCVE-2025-32225 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Event Manager WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through <= 3.2.0.
- Product
- WP Event Manager
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update WP Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Privyr CRM Integration: Missing AuthorizationCVE-2025-32224 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shivam Mani Tripathi Privyr CRM Integration privy-crm-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Privyr CRM Integration: from n/a through <= 1.0.2.
- Product
- Privyr CRM Integration
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Privyr CRM Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Salon booking system: Missing AuthorizationCVE-2025-32220 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.
- Product
- Salon booking system
- Affected
- up to 10.31.9
- What to do
- Affects up to 10.31.9. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025eaSYNC: Missing AuthorizationCVE-2025-32219 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Syntactics, Inc. eaSYNC easync-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eaSYNC: from n/a through <= 1.3.19.
- Product
- eaSYNC
- Affected
- up to 1.3.19
- What to do
- Affects up to 1.3.19. Update eaSYNC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025TableOn: Missing AuthorizationCVE-2025-32218 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in RealMag777 TableOn posts-table-filterable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TableOn: from n/a through <= 1.0.5.1.
- Product
- TableOn
- Affected
- up to 1.0.5.1
- What to do
- Affects up to 1.0.5.1. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2025-32217 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.1.
- Product
- Ai Image Alt Text Generator for WP
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Xpro Theme Builder: Missing AuthorizationCVE-2025-32201 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Theme Builder: from n/a through <= 1.2.8.4.
- Product
- Xpro Theme Builder
- Affected
- up to 1.2.8.4
- What to do
- Affects up to 1.2.8.4. Update Xpro Theme Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 20256Storage Rentals: Missing AuthorizationCVE-2025-32178 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 6Storage Rentals: from n/a through <= 2.20.2.
- Product
- 6Storage Rentals
- Affected
- up to 2.20.2
- What to do
- Affects up to 2.20.2. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Easy WP Optimizer: Missing AuthorizationCVE-2025-32147 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in coothemes Easy WP Optimizer easy-wp-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy WP Optimizer: from n/a through <= 1.1.0.
- Product
- Easy WP Optimizer
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Easy WP Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Booking Calendar and Notification: Missing AuthorizationCVE-2025-31381 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in shiptrack Booking Calendar and Notification booking-calendar-and-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar and Notification: from n/a through <= 4.0.3.
- Product
- Booking Calendar and Notification
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Booking Calendar and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Woffice CRM: Authentication BypassCVE-2025-2798 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being used. This can be combined with CVE-2025-2797 to bypass the user approval process if an Administrator can be tricked into taking an action such as clicking a link.
- Product
- Woffice CRM
- Affected
- up to 5.4.21
- What to do
- Affects up to 5.4.21. Update Woffice CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhub.woffice.iowordfence.com
Apr 4, 2025Pallet Packaging for WooCommerce: Missing AuthorizationCVE-2025-22285 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Pallet Packaging for WooCommerce pallet-packaging-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pallet Packaging for WooCommerce: from n/a through <= 1.1.15.
- Product
- Pallet Packaging for WooCommerce
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Pallet Packaging for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Apptivo Business Site CRM: Missing AuthorizationCVE-2025-31909 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Apptivo Apptivo Business Site CRM apptivo-business-site allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apptivo Business Site CRM: from n/a through <= 5.3.
- Product
- Apptivo Business Site CRM
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update Apptivo Business Site CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025GetBookingsWP: Missing AuthorizationCVE-2025-31896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in istmoplugins GetBookingsWP get-bookings-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetBookingsWP: from n/a through <= 1.1.27.
- Product
- GetBookingsWP
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update GetBookingsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Payday: Missing AuthorizationCVE-2025-31876 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in gunnarpayday Payday payday allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payday: from n/a through <= 3.3.18.
- Product
- Payday
- Affected
- up to 3.3.18
- What to do
- Affects up to 3.3.18. Update Payday to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Local Magic: Missing AuthorizationCVE-2025-31858 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in matthewrubin Local Magic local-magic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Local Magic: from n/a through <= 2.9.0.
- Product
- Local Magic
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update Local Magic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025FPW Category Thumbnails: Missing AuthorizationCVE-2025-31841 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Frank P. Walentynowicz FPW Category Thumbnails fpw-category-thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FPW Category Thumbnails: from n/a through <= 1.9.5.
- Product
- FPW Category Thumbnails
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update FPW Category Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Shopify to WooCommerce Migration: Missing AuthorizationCVE-2025-31795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Plugin Devs Shopify to WooCommerce Migration migrate-shopify-to-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopify to WooCommerce Migration: from n/a through <= 1.3.0.
- Product
- Shopify to WooCommerce Migration
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Shopify to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025WR Price List Manager For Woocommerce: Missing AuthorizationCVE-2025-31794 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WR Price List Manager For Woocommerce: from n/a through <= 1.0.8.
- Product
- WR Price List Manager For Woocommerce
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update WR Price List Manager For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025TextMe SMS: Missing AuthorizationCVE-2025-31789 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Matat Technologies TextMe SMS textme-sms-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through <= 1.9.1.
- Product
- TextMe SMS
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update TextMe SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Widget Manager Light: Missing AuthorizationCVE-2025-31768 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in OTWthemes Widget Manager Light widget-manager-light allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Widget Manager Light: from n/a through <= 1.18.
- Product
- Widget Manager Light
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Widget Manager Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Free Woocommerce Product Table View: Missing AuthorizationCVE-2025-31758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Free Woocommerce Product Table View: from n/a through <= 1.78.
- Product
- Free Woocommerce Product Table View
- Affected
- up to 1.78
- What to do
- Affects up to 1.78. Update Free Woocommerce Product Table View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Clients: Missing AuthorizationCVE-2025-31746 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Think201 Clients clients allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clients: from n/a through <= 1.1.4.
- Product
- Clients
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Minimalistic Event Manager: Missing AuthorizationCVE-2025-31739 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in Manuel Schmalstieg Minimalistic Event Manager minimalistic-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimalistic Event Manager: from n/a through <= 1.1.1.
- Product
- Minimalistic Event Manager
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Minimalistic Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Rich Text Editor: Missing AuthorizationCVE-2025-31736 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in richtexteditor Rich Text Editor richtexteditor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rich Text Editor: from n/a through <= 1.0.1.
- Product
- Rich Text Editor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Rich Text Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025WooTumblog: Missing AuthorizationCVE-2025-31729 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in jeffikus WooTumblog woo-tumblog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooTumblog: from n/a through <= 2.1.4.
- Product
- WooTumblog
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update WooTumblog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025WP Video Playlist: Missing AuthorizationCVE-2025-31581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Sandeep Kumar WP Video Playlist wp-video-playlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Video Playlist: from n/a through <= 1.1.2.
- Product
- WP Video Playlist
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Video Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025TuriTop Booking System: Missing AuthorizationCVE-2025-31541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TuriTop Booking System: from n/a through <= 1.0.10.
- Product
- TuriTop Booking System
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update TuriTop Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Residential Address Detection: Missing AuthorizationCVE-2025-30916 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Residential Address Detection: from n/a through <= 2.5.4.
- Product
- Residential Address Detection
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Residential Address Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025Small Package Quotes – Worldwide Express Edition: Missing AuthorizationCVE-2025-30915 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.19.
- Product
- Small Package Quotes – Worldwide Express Edition
- Affected
- up to 5.2.19
- What to do
- Affects up to 5.2.19. Update Small Package Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025Shopper Approved Reviews: Unauthorized modification of data that can lead to privilege escalationCVE-2025-3063 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Shopper Approved Reviews
- Affected
- 2.0 to 2.1
- What to do
- Affects 2.0 to 2.1. Update Shopper Approved Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 2, 2025Demo Awesome: Unauthorized modification of dataCVE-2024-13637 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Demo Awesome plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin function in all versions up to, and including, 1.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins..
- Product
- Demo Awesome
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Demo Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 1, 2025Insert Headers and Footers Code – HT Script: Unauthorized modification of dataCVE-2025-2779 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.
- Product
- Insert Headers and Footers Code – HT Script
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Insert Headers and Footers Code – HT Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025Sliced Invoices: Missing AuthorizationCVE-2025-31628 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SlicedInvoices Sliced Invoices sliced-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sliced Invoices: from n/a through <= 3.10.0.
- Product
- Sliced Invoices
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update Sliced Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ni WooCommerce Product Enquiry: Missing AuthorizationCVE-2025-31580 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry ni-woocommerce-product-enquiry allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ni WooCommerce Product Enquiry: from n/a through <= 4.1.8.
- Product
- Ni WooCommerce Product Enquiry
- Affected
- up to 4.1.8
- What to do
- Affects up to 4.1.8. Update Ni WooCommerce Product Enquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Mobile Bottom Menu: Missing AuthorizationCVE-2025-31525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah WP Mobile Bottom Menu mobile-bottom-menu-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mobile Bottom Menu: from n/a through <= 1.4.0.
- Product
- WP Mobile Bottom Menu
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WP Mobile Bottom Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025ShortPixel Adaptive Images: Missing AuthorizationCVE-2025-30853 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.10.0.
- Product
- ShortPixel Adaptive Images
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: Missing AuthorizationCVE-2025-30825 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through <= 1.3.5.
- Product
- WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025MyBookProgress by Stormhill Media: Missing AuthorizationCVE-2025-31887 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in zookatron MyBookProgress by Stormhill Media mybookprogress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyBookProgress by Stormhill Media: from n/a through <= 1.0.8.
- Product
- MyBookProgress by Stormhill Media
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update MyBookProgress by Stormhill Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-31886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.21.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 5.21
- What to do
- Affects up to 5.21. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WebinarPress: Missing AuthorizationCVE-2025-31882 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.
- Product
- WebinarPress
- Affected
- up to 1.33.28
- What to do
- Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Pearl: Missing AuthorizationCVE-2025-31881 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Stylemix Pearl pearl-header-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pearl: from n/a through <= 1.3.9.
- Product
- Pearl
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Barcode Generator for WooCommerce: Missing AuthorizationCVE-2025-31879 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.4.
- Product
- Barcode Generator for WooCommerce
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Barcode Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025UPC/EAN/GTIN Code Generator: Missing AuthorizationCVE-2025-31878 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.
- Product
- UPC/EAN/GTIN Code Generator
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update UPC/EAN/GTIN Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025RestroPress: Missing AuthorizationCVE-2025-31877 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.8.
- Product
- RestroPress
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Clone any post type: Missing AuthorizationCVE-2025-31872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Clone any post type: from n/a through <= 3.6.
- Product
- WP Clone any post type
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update WP Clone any post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.