Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,041 results · page 19 of 21
Feb 19, 2026The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and inCVE-2025-13851 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This makes it possible for unauthenticated attackers to register accounts with arbitrary roles, including administrator, by manipulating the _buyent_classified_user_type parameter during the registration process, granting them complete control over the WordPress site.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Lizza LMS Pro: Privilege EscalationCVE-2025-13563 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- Lizza LMS Pro
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Lizza LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Clasifico Listing: Privilege escalationCVE-2025-12882 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listing_user_role' parameter. This makes it possible for unauthenticated attackers to gain elevated privileges by registering an account with the administrator role.
- Product
- Clasifico Listing
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Clasifico Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2026Spam protection, Anti-Spam, FireWall by CleanTalk: Unauthorized Arbitrary Plugin InstallationCVE-2026-1490 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.
- Product
- Spam protection, Anti-Spam, FireWall by CleanTalk
- Affected
- up to 6.71
- What to do
- Affects up to 6.71. Update Spam protection, Anti-Spam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2026Truelysell Core: Privilege escalationCVE-2025-8572 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated attackers to create accounts with elevated privileges, including administrator access.
- Product
- Truelysell Core
- What to do
- Update Truelysell Core to the newest version.
Feb 14, 2026midi-Synth: Arbitrary file uploadsCVE-2026-1306 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'export' AJAX action in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible granted the attacker can obtain a valid nonce. The nonce is exposed in frontend JavaScript making it trivially accessible to unauthenticated attackers.
- Product
- midi-Synth
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update midi-Synth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2026Prime Listing Manager: Allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secretCVE-2025-14892 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secret.
- Product
- Prime Listing Manager
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Prime Listing Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2026AdForest: Authentication bypassCVE-2026-1729 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.
- Product
- AdForest
- Affected
- up to 6.0.12
- What to do
- Affects up to 6.0.12. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2026Migration, Backup, Staging – WPvivid Backup & Migration: Unauthenticated Arbitrary File UploadCVE-2026-1357 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process combined with a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using openssl_private_decrypt(), it does not terminate execution and instead passes the boolean false value to the phpseclib library's AES cipher initialization. The library treats this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Additionally, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This makes it possible for unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the wpvivid_action=send_to_site parameter.
- Product
- Migration, Backup, Staging – WPvivid Backup & Migration
- Affected
- up to 0.9.123
- What to do
- Affects up to 0.9.123. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2026JAY Login & Register: Privilege EscalationCVE-2025-15027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_login_register_ajax_create_final_user' function. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
- Product
- JAY Login & Register
- Affected
- up to 2.6.03
- What to do
- Affects up to 2.6.03. Update JAY Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 2, 2026User Profile Builder: Does not have a proper password reset processCVE-2025-15030 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
- Product
- User Profile Builder
- Fixed in
- 3.15.2
- What to do
- Update User Profile Builder to 3.15.2 or newer.
Jan 28, 2026Snow Monkey Forms: Arbitrary file deletionCVE-2026-1056 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- Product
- Snow Monkey Forms
- Affected
- up to 12.0.3
- What to do
- Affects up to 12.0.3. Update Snow Monkey Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 24, 2026Kalrav AI Agent: Arbitrary file uploadsCVE-2025-13374 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Kalrav AI Agent
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Kalrav AI Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026LA-Studio Element Kit for Elementor: Administrative User CreationCVE-2026-0920 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.5.6.3
- What to do
- Affects up to 1.5.6.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 20, 2026Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Privilege escalationCVE-2025-15521 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This is due to the plugin not properly validating a user's identity prior to updating their password and relying solely on a publicly-exposed nonce for authorization. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and gain access to their account.
- Product
- Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 20, 2026Advanced Custom Fields: Extended: Privilege EscalationCVE-2025-14533 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to the 'insert_user' function not restricting the roles with which a user can register. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if 'role' is mapped to the custom field.
- Product
- Advanced Custom Fields: Extended
- Affected
- up to 0.9.2.1
- What to do
- Affects up to 0.9.2.1. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 17, 2026Registration & Login with Mobile Phone Number for WooCommerce: Authentication BypassCVE-2025-10484 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fma_lwp_set_session_php_fun() function. This makes it possible for unauthenticated attackers to authenticate as any user on the site, including administrators, without a valid password.
- Product
- Registration & Login with Mobile Phone Number for WooCommerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Registration & Login with Mobile Phone Number for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2026RegistrationMagic: Privilege EscalationCVE-2025-15403 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. This makes it possible for unauthenticated attackers to injecting an empty slug into the order parameter, and manipulate the plugin's menu generation logic, and when the admin menu is subsequently built, the plugin adds 'manage_options' capability for the target role. Note: The vulnerability can only be exploited unauthenticated, but further privilege escalation requires at least a subscriber user.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.1
- What to do
- Affects up to 6.0.7.1. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 15, 2026process_upload: Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file uploadCVE-2011-10041 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.
- Product
- process_upload
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update process_upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2026News and Blog Designer Bundle: Local File InclusionCVE-2025-14502 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- News and Blog Designer Bundle
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update News and Blog Designer Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2026Integration Opvius AI for WooCommerce: Path TraversalCVE-2025-14301 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the `process_table_bulk_actions()` function processing user-supplied file paths without authentication checks, nonce verification, or path validation. This makes it possible for unauthenticated attackers to delete or download arbitrary files on the server via the `wsaw-log[]` POST parameter, which can be leveraged to delete critical files like `wp-config.php` or read sensitive configuration files.
- Product
- Integration Opvius AI for WooCommerce
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Integration Opvius AI for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 13, 2026E-xact | Hosted Payment |: Is vulnerable to arbitrary file deletion due to insufficient file path validationCVE-2025-14829 · WordPress plugins & themes · reported by WPScanCritical 9.1
The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
- Product
- E-xact | Hosted Payment |
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update E-xact | Hosted Payment | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2026Dreamer Blog: Is vulnerable to arbitrary installations due to a missing capability checkCVE-2025-10915 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.
- Product
- Dreamer Blog
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Dreamer Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2026the Login Widget: AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code executionCVE-2020-36875 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the login_error parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web server process, resulting in remote code execution.
- Product
- the Login Widget
- What to do
- Update the Login Widget to the newest version.
Jan 9, 2026Frontend Admin by DynamiApps: Missing authorization to unauthorized data modification and deletionCVE-2025-14741 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.28.25
- What to do
- Affects up to 3.28.25. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2025-14736 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.29. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.28.29
- What to do
- Affects up to 3.28.29. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2026WP Cost Estimation: Arbitrary file uploads and deletionCVE-2019-25296 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to, and including, 9.642. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additionally, the attacker can also delete files on the server such as database configuration files, subsequently uploading their own database files.
- Product
- WP Cost Estimation
- Affected
- up to 9.642
- What to do
- Affects up to 9.642. Update WP Cost Estimation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026Optional Email: Privilege EscalationCVE-2025-15018 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts.
- Product
- Optional Email
- Affected
- up to 1.3.11
- What to do
- Affects up to 1.3.11. Update Optional Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2026Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide: Unrestricted Upload of File withCVE-2025-30996 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.
- Product
- Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2026FS Registration Password: Privilege escalationCVE-2025-15001 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- FS Registration Password
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update FS Registration Password to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 6, 2026AS Password Field In Default Registration Form: Privilege escalationCVE-2025-14996 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- AS Password Field In Default Registration Form
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update AS Password Field In Default Registration Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 1, 2026Branda: Privilege escalationCVE-2025-14998 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- Branda
- Affected
- up to 3.4.24
- What to do
- Affects up to 3.4.24. Update Branda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025ConoHa by GMO WING WordPress Migrator wing-migrator: Cross-Site Request Forgery (CSRF)CVE-2025-52835 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through <= 1.2.0.
- Product
- ConoHa by GMO WING WordPress Migrator wing-migrator
- What to do
- Update ConoHa by GMO WING WordPress Migrator wing-migrator to the newest version.
Dec 24, 2025Print Invoice & Delivery Notes for WooCommerce: Remote Code ExecutionCVE-2025-13773 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 23, 2025PhastPress: Unauthenticated Arbitrary File ReadCVE-2025-14388 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
- Product
- PhastPress
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update PhastPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2025Flex Store Users: Privilege EscalationCVE-2025-13619 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can be exploited with the 'fs_type' parameter if the Flex Store Seller plugin is also activated.
- Product
- Flex Store Users
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Flex Store Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2025File Uploader for WooCommerce: Arbitrary file uploadsCVE-2025-13329 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for the 'add-image-data' REST API endpoint in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to upload arbitrary files to the Uploadcare service and subsequently download them on the affected site's server which may make remote code execution possible.
- Product
- File Uploader for WooCommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update File Uploader for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf: Unrestricted Upload of File with Dangerous TypeCVE-2025-64231 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from n/a through <= 3.0.0.
- Product
- RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf
- What to do
- Update RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf to the newest version.
Dec 15, 2025Fox LMS – WordPress LMS: Privilege escalationCVE-2025-14156 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.
- Product
- Fox LMS – WordPress LMS
- Affected
- up to 1.0.5.1
- What to do
- Affects up to 1.0.5.1. Update Fox LMS – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025JAY Login & Register: Authentication bypassCVE-2025-14440 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_register_process_switch_back' cookie value. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the user id.
- Product
- JAY Login & Register
- Affected
- up to 2.4.01
- What to do
- Affects up to 2.4.01. Update JAY Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025Export WP Page to Static HTML & PDF: Sensitive Information ExposureCVE-2025-11693 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.4 through publicly exposed cookies.txt files containing authentication cookies. This makes it possible for unauthenticated attackers to cookies that may have been injected into the log file if the site administrator triggered a back-up using a specific user role like 'administrator.'
- Product
- Export WP Page to Static HTML & PDF
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update Export WP Page to Static HTML & PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2025URL Shortener Plugin For WordPress: SQL InjectionCVE-2025-10738 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the ‘analytic_id’ parameter in all versions up to, and including, 3.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- URL Shortener Plugin For WordPress
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update URL Shortener Plugin For WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 11, 2025Multi Uploader for Gravity Forms: Arbitrary file deletionCVE-2025-14344 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_ajax_delete_file' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
- Product
- Multi Uploader for Gravity Forms
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart: Privilege escalationCVE-2025-12963 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin
- Product
- LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart
- Affected
- up to 1.2.29
- What to do
- Affects up to 1.2.29. Update LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 10, 2025WP CarDealer: Privilege EscalationCVE-2025-13764 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- WP CarDealer
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update WP CarDealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Elated Membership: Authentication BypassCVE-2025-13613 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
- Product
- Elated Membership
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Elated Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 202510Web Booster – Website speed optimization, Cache & Page Speed optimizer: Arbitrary folder deletionCVE-2025-13377 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
- Product
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
- Affected
- up to 2.32.7
- What to do
- Affects up to 2.32.7. Update 10Web Booster – Website speed optimization, Cache & Page Speed optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2025Flex QR Code Generator: Arbitrary file uploadsCVE-2025-12673 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Flex QR Code Generator
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2025Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification: Authentication bypassCVE-2025-12374 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.44. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.
- Product
- Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification
- Affected
- up to 2.0.44
- What to do
- Affects up to 2.0.44. Update Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 5, 2025CRM Memberships: Privilege escalationCVE-2025-13313 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and authentication checks on the `ntzcrm_changepassword` AJAX action. This makes it possible for unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts via the `ntzcrm_changepassword` endpoint, granted they can obtain or enumerate a target user's email address. The plugin also exposes the `ntzcrm_get_users` endpoint without authentication, allowing attackers to enumerate subscriber email addresses, facilitating the exploitation of the password reset vulnerability.
- Product
- CRM Memberships
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update CRM Memberships to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.