Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
124 results · page 2 of 3
Dec 24, 2025PostX: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.This issue affects PostX: from n/a through <= 5.0.3.
- Product
- PostX
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Virusdie: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6.
- Product
- Virusdie
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Virusdie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Premium Addons for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68494 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.53.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.53
- What to do
- Affects up to 4.11.53. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Eight Day Week Print Workflow: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67621 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.
- Product
- Eight Day Week Print Workflow
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Eight Day Week Print Workflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025VPSUForm: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vikas Ratudi VPSUForm v-form allows Retrieve Embedded Sensitive Data.This issue affects VPSUForm: from n/a through <= 3.2.24.
- Product
- VPSUForm
- Affected
- up to 3.2.24
- What to do
- Affects up to 3.2.24. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 21, 2025TempTool [Show Current Template Info]: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62955 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-name allows Retrieve Embedded Sensitive Data.This issue affects TempTool [Show Current Template Info]: from n/a through <= 1.3.1.
- Product
- TempTool [Show Current Template Info]
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update TempTool [Show Current Template Info] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP ERP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67546 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs WP ERP erp allows Retrieve Embedded Sensitive Data.This issue affects WP ERP: from n/a through <= 1.16.6.
- Product
- WP ERP
- Affected
- up to 1.16.6
- What to do
- Affects up to 1.16.6. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Email marketing for WordPress by GetResponse Official: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64272 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Retrieve Embedded Sensitive Data.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
- Product
- Email marketing for WordPress by GetResponse Official
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Email marketing for WordPress by GetResponse Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Masteriyo - LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64270 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects Masteriyo - LMS: from n/a through <= 2.0.3.
- Product
- Masteriyo - LMS
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Follow My Blog Post: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64258 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Retrieve Embedded Sensitive Data.This issue affects Follow My Blog Post: from n/a through <= 2.3.9.
- Product
- Follow My Blog Post
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update Follow My Blog Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Restaurant Menu by MotoPress: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-49914 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Retrieve Embedded Sensitive Data.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.7.
- Product
- Restaurant Menu by MotoPress
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update Restaurant Menu by MotoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025SendPulse Email Marketing Newsletter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.2.1.
- Product
- SendPulse Email Marketing Newsletter
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Sober: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67567 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This issue affects Sober: from n/a through <= 3.5.11.
- Product
- Sober
- Affected
- up to 3.5.11
- What to do
- Affects up to 3.5.11. Update Sober to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Rehub: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67565 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.
- Product
- Rehub
- Affected
- up to 19.9.9.1
- What to do
- Affects up to 19.9.9.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Pixel Manager for WooCommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects Pixel Manager for WooCommerce: from n/a through <= 1.51.1.
- Product
- Pixel Manager for WooCommerce
- Affected
- up to 1.51.1
- What to do
- Affects up to 1.51.1. Update Pixel Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Portfolio and Projects: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.
- Product
- Portfolio and Projects
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Download Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63070 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.32.
- Product
- Download Manager
- Affected
- up to 3.3.32
- What to do
- Affects up to 3.3.32. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Custom Field Template: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63058 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Retrieve Embedded Sensitive Data.This issue affects Custom Field Template: from n/a through <= 2.7.6.
- Product
- Custom Field Template
- Affected
- up to 2.7.6
- What to do
- Affects up to 2.7.6. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP Hotel Booking: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63013 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedded Sensitive Data.This issue affects WP Hotel Booking: from n/a through <= 2.2.7.
- Product
- WP Hotel Booking
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP Google Analytics Events: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows Retrieve Embedded Sensitive Data.This issue affects WP Google Analytics Events: from n/a through <= 2.8.2.
- Product
- WP Google Analytics Events
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update WP Google Analytics Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Image Cleanup: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62737 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in opicron Image Cleanup image-cleanup allows Retrieve Embedded Sensitive Data.This issue affects Image Cleanup: from n/a through <= 1.9.2.
- Product
- Image Cleanup
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025User Spam Remover: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Joel User Spam Remover user-spam-remover allows Retrieve Embedded Sensitive Data.This issue affects User Spam Remover: from n/a through <= 1.1.
- Product
- User Spam Remover
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update User Spam Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Seriously Simple Podcasting: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-66059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Retrieve Embedded Sensitive Data.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.13.0
- What to do
- Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Uncanny Automator: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-66056 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Embedded Sensitive Data.This issue affects Uncanny Automator: from n/a through < 6.10.0.
- Product
- Uncanny Automator
- What to do
- Update Uncanny Automator to the newest version.
Nov 13, 2025WooCommerce Ultimate Points And Rewards: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultimate-points-and-rewards allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Ultimate Points And Rewards: from n/a through <= 2.10.2.
- Product
- WooCommerce Ultimate Points And Rewards
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update WooCommerce Ultimate Points And Rewards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025SUMO Affiliates Pro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64228 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded Sensitive Data.This issue affects SUMO Affiliates Pro: from n/a through <= 11.0.0.
- Product
- SUMO Affiliates Pro
- Affected
- up to 11.0.0
- What to do
- Affects up to 11.0.0. Update SUMO Affiliates Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP Popup Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62902 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through <= 1.3.8.
- Product
- WP Popup Builder
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MasterStudy LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59575 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025IDonatePro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-52752 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.
- Product
- IDonatePro
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update IDonatePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Page Manager for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-60167 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.
- Product
- Page Manager for Elementor
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Page Manager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025CoSchedule: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-60119 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.
- Product
- CoSchedule
- Affected
- up to 3.3.11
- What to do
- Affects up to 3.3.11. Update CoSchedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Download Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-60092 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25.
- Product
- Download Manager
- Affected
- up to 3.3.25
- What to do
- Affects up to 3.3.25. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Ajax Load More: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59582 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through <= 7.6.0.2.
- Product
- Ajax Load More
- Affected
- up to 7.6.0.2
- What to do
- Affects up to 7.6.0.2. Update Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Quiz Maker: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58015 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Data.This issue affects Quiz Maker: from n/a through <= 6.7.0.65.
- Product
- Quiz Maker
- Affected
- up to 6.7.0.65
- What to do
- Affects up to 6.7.0.65. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Hubbub Lite: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through <= 1.35.2.
- Product
- Hubbub Lite
- Affected
- up to 1.35.2
- What to do
- Affects up to 1.35.2. Update Hubbub Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WPeMatico RSS Feed Fetcher: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-57937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Retrieve Embedded Sensitive Data.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.10.
- Product
- WPeMatico RSS Feed Fetcher
- Affected
- up to 2.8.10
- What to do
- Affects up to 2.8.10. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP System Information: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-57916 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Nurul Amin WP System Information wp-system-info allows Retrieve Embedded Sensitive Data.This issue affects WP System Information: from n/a through <= 1.5.
- Product
- WP System Information
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WP System Information to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Site Info: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58866 · WordPress plugins & themes · reported by PatchstackLow 2.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Rami Yushuvaev Site Info site-info-dashboard-widget allows Retrieve Embedded Sensitive Data.This issue affects Site Info: from n/a through <= 1.1.
- Product
- Site Info
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Site Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ninja Charts: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58797 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embedded Sensitive Data.This issue affects Ninja Charts: from n/a through <= 3.3.5.
- Product
- Ninja Charts
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Ninja Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2025Jobmonster: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-57888 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensitive Data.This issue affects Jobmonster: from n/a through <= 4.8.0.
- Product
- Jobmonster
- Affected
- up to 4.8.0
- What to do
- Affects up to 4.8.0. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2025ProveSource Social Proof: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-48355 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ProveSource LTD ProveSource Social Proof provesource allows Retrieve Embedded Sensitive Data.This issue affects ProveSource Social Proof: from n/a through <= 3.1.2.
- Product
- ProveSource Social Proof
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update ProveSource Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Savoy: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-54736 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This issue affects Savoy: from n/a through <= 3.0.8.
- Product
- Savoy
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Savoy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2025360 Photo Spheres: Stored Cross-Site ScriptingCVE-2025-4588 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- 360 Photo Spheres
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update 360 Photo Spheres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jun 27, 2025Audio Editor & Recorder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-53211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Retrieve Embedded Sensitive Data.This issue affects Audio Editor & Recorder: from n/a through <= 2.2.3.
- Product
- Audio Editor & Recorder
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Audio Editor & Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025ProfileGrid: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-52719 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Retrieve Embedded Sensitive Data.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
- Product
- ProfileGrid
- Affected
- up to 5.9.5.2
- What to do
- Affects up to 5.9.5.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025elfsight Contact Form widget: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31045 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows Retrieve Embedded Sensitive Data.This issue affects elfsight Contact Form widget: from n/a through <= 2.3.1.
- Product
- elfsight Contact Form widget
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update elfsight Contact Form widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Foxit eSign for: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-49419 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Foxit eSign for WordPress: from n/a through <= 2.0.3.
- Product
- Foxit eSign for
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Foxit eSign for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025KI Live Video Conferences: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-23969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Retrieve Embedded Sensitive Data.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
- Product
- KI Live Video Conferences
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update KI Live Video Conferences to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025AnalyticsWP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-39394 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.This issue affects AnalyticsWP: from n/a through 2.1.2.
- Product
- AnalyticsWP
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update AnalyticsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025QuickCal - Appointment Booking Calendar for: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-32299 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.
- Product
- QuickCal - Appointment Booking Calendar for
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update QuickCal - Appointment Booking Calendar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.