Vulnerability database

2,838 results · page 13 of 57

• Jan 22, 2026Uper for Elementor: Missing AuthorizationCVE-2025-66140 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.

  Product

  Uper for Elementor

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Uper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Audier For Elementor: Missing AuthorizationCVE-2025-66139 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.

  Product

  Audier For Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Audier For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Motionger for Elementor: Missing AuthorizationCVE-2025-66138 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motionger for Elementor: from n/a through <= 2.0.4.

  Product

  Motionger for Elementor

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Motionger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Searcher for Elementor: Missing AuthorizationCVE-2025-66137 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.

  Product

  Searcher for Elementor

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update Searcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Carter for Elementor: Missing AuthorizationCVE-2025-66136 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2.

  Product

  Carter for Elementor

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Carter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Imager for Elementor: Missing AuthorizationCVE-2025-66135 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4.

  Product

  Imager for Elementor

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Imager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Grand Restaurant Theme Elements for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63026 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor allows Stored XSS.This issue affects Grand Restaurant Theme Elements for Elementor: from n/a through <= 2.1.1.

  Product

  Grand Restaurant Theme Elements for Elementor

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update Grand Restaurant Theme Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49055 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

  Product

  WP Lead Capturing Pages

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Lead Capturing Pages: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49050 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

  Product

  WP Lead Capturing Pages

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update WP Lead Capturing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026DZS Video Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49049 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.

  Product

  DZS Video Gallery

  Affected

  up to 12.39

  What to do

  Affects up to 12.39. Update DZS Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Element Pack Elementor Addons: Cross-Site Request Forgery (CSRF)CVE-2025-31413 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Cross Site Request Forgery.This issue affects Element Pack Elementor Addons: from n/a through <= 8.3.13.

  Product

  Element Pack Elementor Addons

  Affected

  up to 8.3.13

  What to do

  Affects up to 8.3.13. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026LA-Studio Element Kit for Elementor: Administrative User CreationCVE-2026-0920 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.

  Product

  LA-Studio Element Kit for Elementor

  Affected

  up to 1.5.6.3

  What to do

  Affects up to 1.5.6.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 16, 2026Essential Addons for Elementor: Sensitive Information ExposureCVE-2026-1004 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.

  Product

  Essential Addons for Elementor

  Affected

  up to 6.5.5

  What to do

  Affects up to 6.5.5. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Jan 8, 2026X Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22518 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows DOM-Based XSS.This issue affects X Addons for Elementor: from n/a through <= 1.0.23.

  Product

  X Addons for Elementor

  Affected

  up to 1.0.23

  What to do

  Affects up to 1.0.23. Update X Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Automotive Listings: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67928 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issue affects Automotive Listings: from n/a through <= 18.6.

  Product

  Automotive Listings

  Affected

  up to 18.6

  What to do

  Affects up to 18.6. Update Automotive Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Lobo: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67921 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through < 2.8.6.

  Product

  Lobo

  What to do

  Update Lobo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Felan Framework: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23993 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <= 1.1.3.

  Product

  Felan Framework

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Workreap (theme's plugin): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22728 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.

  Product

  Workreap (theme's plugin)

  Affected

  up to 3.3.6

  What to do

  Affects up to 3.3.6. Update Workreap (theme's plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026WooCommerce Orders & Customers Exporter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22713 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.

  Product

  WooCommerce Orders & Customers Exporter

  Affected

  up to 5.4

  What to do

  Affects up to 5.4. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026Jeg Elementor Kit: Stored Cross-Site ScriptingCVE-2025-14275 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization in the countdown widget's redirect functionality. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary JavaScript that will execute when an administrator or other user views the page containing the malicious countdown element.

  Product

  Jeg Elementor Kit

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 7, 2026The Plus Addons for Elementor Pro: Missing AuthorizationCVE-2025-46434 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a through < 6.3.7.

  Product

  The Plus Addons for Elementor Pro

  What to do

  Update The Plus Addons for Elementor Pro to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026WPCHURCH: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32303 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.

  Product

  WPCHURCH

  Affected

  up to 2.7.0

  What to do

  Affects up to 2.7.0. Update WPCHURCH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Responsive Addons for Elementor: Missing AuthorizationCVE-2025-69363 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Addons for Elementor: from n/a through <= 2.0.8.

  Product

  Responsive Addons for Elementor

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Responsive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026TheGem Theme Elements (for WPBakery): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69360 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-Based XSS.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.11.0.

  Product

  TheGem Theme Elements (for WPBakery)

  Affected

  up to 5.11.0

  What to do

  Affects up to 5.11.0. Update TheGem Theme Elements (for WPBakery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026TheGem Theme Elements (for Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69357 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows Stored XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.

  Product

  TheGem Theme Elements (for Elementor)

  Affected

  up to 5.11.0

  What to do

  Affects up to 5.11.0. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026TheGem Theme Elements (for Elementor): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69356 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File Inclusion.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.

  Product

  TheGem Theme Elements (for Elementor)

  Affected

  up to 5.11.0

  What to do

  Affects up to 5.11.0. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Ninja Tables: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69351 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.4.

  Product

  Ninja Tables

  Affected

  up to 5.2.4

  What to do

  Affects up to 5.2.4. Update Ninja Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Ultimate Store Kit Elementor Addons: Missing AuthorizationCVE-2025-69336 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.9.4.

  Product

  Ultimate Store Kit Elementor Addons

  Affected

  up to 2.9.4

  What to do

  Affects up to 2.9.4. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Entrada: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39484 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.

  Product

  Entrada

  Affected

  up to 5.7.7

  What to do

  Affects up to 5.7.7. Update Entrada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026The Plus Addons for Elementor Page Builder Lite: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-23511 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows DOM-Based XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 5.3.3.

  Product

  The Plus Addons for Elementor Page Builder Lite

  Affected

  up to 5.3.3

  What to do

  Affects up to 5.3.3. Update The Plus Addons for Elementor Page Builder Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Infility Global: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68865 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.

  Product

  Infility Global

  Affected

  up to 2.15.06

  What to do

  Affects up to 2.15.06. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026AnyWhere Elementor Pro: Missing AuthorizationCVE-2025-31046 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.

  Product

  AnyWhere Elementor Pro

  Affected

  up to 2.29

  What to do

  Affects up to 2.29. Update AnyWhere Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Premium SEO Pack: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31044 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 3.3.2.

  Product

  Premium SEO Pack

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update Premium SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 5, 2026Amazon Native Shopping Recommendations: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30633 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL Injection.This issue affects Amazon Native Shopping Recommendations: from n/a through 1.3.

  Product

  Amazon Native Shopping Recommendations

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Amazon Native Shopping Recommendations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 1, 2026All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements: Unauthorized data lossCVE-2025-14428 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'my_sticky_elements_bulks' function in all versions up to, and including, 2.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all contact form leads stored by the plugin.

  Product

  All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 31, 2025Conformer for Elementor: Missing AuthorizationCVE-2025-66148 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Conformer for Elementor conformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conformer for Elementor: from n/a through <= 1.0.7.

  Product

  Conformer for Elementor

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Conformer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Logger for Elementor: Missing AuthorizationCVE-2025-66146 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Logger for Elementor logger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logger for Elementor: from n/a through <= 1.0.9.

  Product

  Logger for Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Logger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Worker for Elementor: Missing AuthorizationCVE-2025-66144 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Worker for Elementor worker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Worker for Elementor: from n/a through <= 1.0.10.

  Product

  Worker for Elementor

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Worker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-30628 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows SQL Injection.This issue affects Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer): from n/a through 1.2.

  Product

  Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer)

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Mediabay - WordPress Media Library Folders: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28949 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.

  Product

  Mediabay - WordPress Media Library Folders

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Mediabay - WordPress Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Headinger for Elementor: Missing AuthorizationCVE-2025-66153 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Headinger for Elementor headinger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headinger for Elementor: from n/a through <= 1.1.4.

  Product

  Headinger for Elementor

  Affected

  up to 1.1.4

  What to do

  Affects up to 1.1.4. Update Headinger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Criptopayer for Elementor: Missing AuthorizationCVE-2025-66152 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Criptopayer for Elementor criptopayer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Criptopayer for Elementor: from n/a through <= 1.0.1.

  Product

  Criptopayer for Elementor

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Criptopayer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Countdowner for Elementor: Missing AuthorizationCVE-2025-66151 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Countdowner for Elementor countdowner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Countdowner for Elementor: from n/a through <= 1.0.4.

  Product

  Countdowner for Elementor

  Affected

  up to 1.0.4

  What to do

  Affects up to 1.0.4. Update Countdowner for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Select Graphist for Elementor Graphist for Elementor: Missing AuthorizationCVE-2025-66160 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Select Graphist for Elementor Graphist for Elementor graphist-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Select Graphist for Elementor Graphist for Elementor: from n/a through <= 1.2.10.

  Product

  Select Graphist for Elementor Graphist for Elementor

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update Select Graphist for Elementor Graphist for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Walker for Elementor: Missing AuthorizationCVE-2025-66159 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Walker for Elementor walker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Walker for Elementor: from n/a through <= 1.1.6.

  Product

  Walker for Elementor

  Affected

  up to 1.1.6

  What to do

  Affects up to 1.1.6. Update Walker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Gmaper for Elementor: Missing AuthorizationCVE-2025-66158 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Gmaper for Elementor gmaper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmaper for Elementor: from n/a through <= 1.0.9.

  Product

  Gmaper for Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Gmaper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Sliper for Elementor: Missing AuthorizationCVE-2025-66157 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Sliper for Elementor sliper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sliper for Elementor: from n/a through <= 1.0.10.

  Product

  Sliper for Elementor

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Sliper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Watcher for Elementor: Missing AuthorizationCVE-2025-66156 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Watcher for Elementor watcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watcher for Elementor: from n/a through <= 1.0.9.

  Product

  Watcher for Elementor

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Watcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Questionar for Elementor: Missing AuthorizationCVE-2025-66155 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Questionar for Elementor questionar-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Questionar for Elementor: from n/a through <= 1.1.7.

  Product

  Questionar for Elementor

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Questionar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 31, 2025Couponer for Elementor: Missing AuthorizationCVE-2025-66154 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in merkulove Couponer for Elementor couponer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Couponer for Elementor: from n/a through <= 1.1.7.

  Product

  Couponer for Elementor

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update Couponer for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.