Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,041 results · page 20 of 21
Dec 3, 2025WP Directory Kit: Authentication bypassCVE-2025-13390 · WordPress plugins & themes · reported by WordfenceCritical 10
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the feature using a cryptographically weak token generation mechanism. This makes it possible for unauthenticated attackers to gain administrative access and achieve full site takeover via the auto-login endpoint with a predictable token.
- Product
- WP Directory Kit
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 3, 2025Frontend Admin by DynamiApps: Unauthorized modification of arbitrary WordPress optionsCVE-2025-13342 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for unauthenticated attackers to modify critical WordPress options such as users_can_register, default_role, and admin_email via submitting crafted form data to public frontend forms.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.28.20
- What to do
- Affects up to 3.28.20. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 3, 2025Advanced Custom Fields: Extended: Remote Code ExecutionCVE-2025-13486 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func_array(). This makes it possible for unauthenticated attackers to execute arbitrary code on the server, which can be leveraged to inject backdoors or create new administrative user accounts.
- Product
- Advanced Custom Fields: Extended
- Affected
- up to 0.9.1.1
- What to do
- Affects up to 0.9.1.1. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2025DesignThemes LMS: Privilege EscalationCVE-2025-13542 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- DesignThemes LMS
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update DesignThemes LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2025StreamTube Core: Arbitrary User Password ChangeCVE-2025-13615 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if the 'registration password fields' enabled in theme options.
- Product
- StreamTube Core
- Affected
- up to 4.78
- What to do
- Affects up to 4.78. Update StreamTube Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2025Tiger: Privilege EscalationCVE-2025-13675 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- Tiger
- Affected
- up to 101.2.1
- What to do
- Affects up to 101.2.1. Update Tiger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2025Tiare Membership: Privilege EscalationCVE-2025-13540 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiare_membership_init_rest_api_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- Tiare Membership
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Tiare Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2025FindAll Membership: Authentication BypassCVE-2025-13539 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
- Product
- FindAll Membership
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update FindAll Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2025FindAll Listing: Privilege EscalationCVE-2025-13538 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin.
- Product
- FindAll Listing
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update FindAll Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 25, 2025AI Feeds: Arbitrary file uploadsCVE-2025-13597 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AI Feeds plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.0.11. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite plugin files on the affected site's server which may make remote code execution possible.
- Product
- AI Feeds
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update AI Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 25, 2025CIBELES AI: Arbitrary file uploadsCVE-2025-13595 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check in the 'actualizador_git.php' file in all versions up to, and including, 1.10.8. This makes it possible for unauthenticated attackers to download arbitrary GitHub repositories and overwrite plugin files on the affected site's server which may make remote code execution possible.
- Product
- CIBELES AI
- Affected
- up to 1.10.8
- What to do
- Affects up to 1.10.8. Update CIBELES AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 25, 2025EduKart Pro: Privilege EscalationCVE-2025-13559 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EduKart Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'edukart_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- EduKart Pro
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update EduKart Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 24, 2025Sneeit Framework: Remote Code ExecutionCVE-2025-6389 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated attackers to execute code on the server which can be leveraged to inject backdoors or, for example, create new administrative user accounts.
- Product
- Sneeit Framework
- Affected
- up to 8.3
- What to do
- Affects up to 8.3. Update Sneeit Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Mstoreapp Mobile App: And Mstoreapp Mobile Multivendor through 9CVE-2025-11127 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX action, allowing unauthenticated users to retrieve a valid session for arbitrary users by knowing their email address.
- Product
- Mstoreapp Mobile App
- Affected
- up to 2.08
- What to do
- Affects up to 2.08. Update Mstoreapp Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025ELEX WordPress HelpDesk & Customer Ticketing System: Arbitrary file uploadsCVE-2025-11456 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- ELEX WordPress HelpDesk & Customer Ticketing System
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2025WavePlayer: Does not have authorization in an AJAX actionCVE-2025-12057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
- Product
- WavePlayer
- Fixed in
- 3.8.0
- What to do
- Update WavePlayer to 3.8.0 or newer.
Nov 17, 2025W3 Total Cache: Is vulnerable to command injection via the _parse_dynamic_mfunc functionCVE-2025-9501 · WordPress plugins & themes · reported by WPScanCritical 9
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
- Product
- W3 Total Cache
- Fixed in
- 2.8.13
- What to do
- Update W3 Total Cache to 2.8.13 or newer.
Nov 11, 2025TNC Toolbox: Web Performance: Sensitive Information ExposureCVE-2025-12539 · WordPress plugins & themes · reported by WordfenceCritical 10
The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.
- Product
- TNC Toolbox: Web Performance
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update TNC Toolbox: Web Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 10, 2025Holiday class post calendar: Remote Code ExecutionCVE-2025-12813 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.
- Product
- Holiday class post calendar
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update Holiday class post calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 10, 2025EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce: Privilege EscalationCVE-2025-11457 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 to 1.8.2. This is due to the /easycommerce/v1/orders REST API endpoint not properly restricting the ability for users to select roles during registration. This makes it possible for unauthenticated attackers to gain administrator-level access to a vulnerable site.
- Product
- EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce
- Affected
- 0.9.0-beta2 to 1.8.2
- What to do
- Affects 0.9.0-beta2 to 1.8.2. Update EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 10, 2025WP移行専用プラグイン for CPI: Arbitrary file uploadsCVE-2025-11170 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the Cpiwm_Import_Controller::import function in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WP移行専用プラグイン for CPI
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP移行専用プラグイン for CPI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2025Gravity Forms: Arbitrary file uploadsCVE-2025-12352 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post
- Product
- Gravity Forms
- Affected
- up to 2.9.20
- What to do
- Affects up to 2.9.20. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025KingAddons: Unrestricted Upload of File with Dangerous TypeCVE-2025-6327 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server.This issue affects King Addons for Elementor: from n/a through <= 51.1.36.
- Product
- KingAddons
- What to do
- Update KingAddons to the newest version.
Nov 6, 2025KingAddons: Incorrect Privilege AssignmentCVE-2025-6325 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in KingAddons.com King Addons for Elementor king-addons allows Privilege Escalation.This issue affects King Addons for Elementor: from n/a through <= 51.1.36.
- Product
- KingAddons
- What to do
- Update KingAddons to the newest version.
Nov 6, 2025Rometheme RTMKit rometheme-for-elementor: Unrestricted Upload of File with Dangerous TypeCVE-2025-62065 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.6.5.
- Product
- Rometheme RTMKit rometheme-for-elementor
- What to do
- Update Rometheme RTMKit rometheme-for-elementor to the newest version.
Nov 6, 2025Elated-Themes Search & Go search-and-go: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-62064 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7.
- Product
- Elated-Themes Search & Go search-and-go
- What to do
- Update Elated-Themes Search & Go search-and-go to the newest version.
Nov 6, 2025Case-Themes Case Addons case-addons: Unrestricted Upload of File with Dangerous TypeCVE-2025-62047 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issue affects Case Addons: from n/a through < 1.3.0.
- Product
- Case-Themes Case Addons case-addons
- What to do
- Update Case-Themes Case Addons case-addons to the newest version.
Nov 6, 2025hogash KALLYAS kallyas: Unrestricted Upload of File with Dangerous TypeCVE-2025-62016 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.
- Product
- hogash KALLYAS kallyas
- What to do
- Update hogash KALLYAS kallyas to the newest version.
Nov 6, 2025WP User Manager WP User Manager wp-user-manager: Deserialization of Untrusted DataCVE-2025-60245 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.
- Product
- WP User Manager WP User Manager wp-user-manager
- What to do
- Update WP User Manager WP User Manager wp-user-manager to the newest version.
Nov 6, 2025Holest Engineering Selling Commander for WooCommerce selling-commander-connector: Incorrect Privilege AssignmentCVE-2025-60243 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Holest Engineering Selling Commander for WooCommerce selling-commander-connector allows Privilege Escalation.This issue affects Selling Commander for WooCommerce: from n/a through <= 1.2.46.
- Product
- Holest Engineering Selling Commander for WooCommerce selling-commander-connector
- What to do
- Update Holest Engineering Selling Commander for WooCommerce selling-commander-connector to the newest version.
Nov 6, 2025Plugify Support Ticket System for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-60235 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Plugify Support Ticket System for WooCommerce (Premium) support-ticket-system-for-woocommerce allows Using Malicious Files.This issue affects Support Ticket System for WooCommerce (Premium): from n/a through <= 2.0.7.
- Product
- Plugify Support Ticket System for WooCommerce
- What to do
- Update Plugify Support Ticket System for WooCommerce to the newest version.
Nov 6, 2025Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-60207 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.
- Product
- Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce
- What to do
- Update Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce to the newest version.
Nov 6, 2025Vito Peleg Atarim atarim-visual-collaboration: Incorrect Privilege AssignmentCVE-2025-60195 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Privilege Escalation.This issue affects Atarim: from n/a through <= 4.2.1.
- Product
- Vito Peleg Atarim atarim-visual-collaboration
- What to do
- Update Vito Peleg Atarim atarim-visual-collaboration to the newest version.
Nov 6, 2025Cristián Lávaque s2Member s2member: Deserialization of Untrusted DataCVE-2025-58998 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
- Product
- Cristián Lávaque s2Member s2member
- What to do
- Update Cristián Lávaque s2Member s2member to the newest version.
Nov 6, 2025Helmut Wandl Advanced Settings advanced-settings: Unrestricted Upload of File with Dangerous TypeCVE-2025-58996 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Upload a Web Shell to a Web Server.This issue affects Advanced Settings: from n/a through <= 3.1.1.
- Product
- Helmut Wandl Advanced Settings advanced-settings
- What to do
- Update Helmut Wandl Advanced Settings advanced-settings to the newest version.
Nov 6, 2025CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft: Deserialization of Untrusted DataCVE-2025-58636 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
- Product
- CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft
- What to do
- Update CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft to the newest version.
Nov 6, 2025kamleshyadav Miraculous Core Plugin miraculouscore: Authorization Bypass Through User-Controlled KeyCVE-2025-58627 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
- Product
- kamleshyadav Miraculous Core Plugin miraculouscore
- What to do
- Update kamleshyadav Miraculous Core Plugin miraculouscore to the newest version.
Nov 6, 2025borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon: Unrestricted Upload of File with Dangerous TypeCVE-2025-53283 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through <= 2.4.1.
- Product
- borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon
- What to do
- Update borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon to the newest version.
Nov 6, 2025VictorThemes Seil seil: Deserialization of Untrusted DataCVE-2025-53242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
- Product
- VictorThemes Seil seil
- What to do
- Update VictorThemes Seil seil to the newest version.
Nov 6, 2025hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway allows SQL Injection.This issue affects HieCOR Payment Gateway Plugin: from n/a through <= 1.5.11.
- Product
- hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway
- What to do
- Update hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway to the newest version.
Nov 6, 2025Fetch Designs Sign-up Sheets sign-up-sheets: Deserialization of Untrusted DataCVE-2025-49393 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
- Product
- Fetch Designs Sign-up Sheets sign-up-sheets
- What to do
- Update Fetch Designs Sign-up Sheets sign-up-sheets to the newest version.
Nov 6, 2025VillaTheme HAPPY happy-helpdesk-support-ticket-system: Improper Control of Generation of Code ('Code Injection')CVE-2025-49372 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Remote Code Inclusion.This issue affects HAPPY: from n/a through <= 1.0.7.
- Product
- VillaTheme HAPPY happy-helpdesk-support-ticket-system
- What to do
- Update VillaTheme HAPPY happy-helpdesk-support-ticket-system to the newest version.
Nov 6, 2025Rainbow-Themes Education WordPress Theme | HiStudy histudy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48089 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histudy allows SQL Injection.This issue affects Education WordPress Theme | HiStudy: from n/a through < 3.1.0.
- Product
- Rainbow-Themes Education WordPress Theme | HiStudy histudy
- What to do
- Update Rainbow-Themes Education WordPress Theme | HiStudy histudy to the newest version.
Nov 6, 2025acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing: Improper Control of Generation of Code ('Code Injection')CVE-2025-47588 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.9.
- Product
- acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing
- What to do
- Update acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing to the newest version.
Nov 6, 2025Widgetlogic: Improper Control of Generation of Code ('Code Injection')CVE-2025-32222 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Widgetlogic.org Widget Logic widget-logic allows Code Injection.This issue affects Widget Logic: from n/a through <= 6.0.5.
- Product
- Widgetlogic
- What to do
- Update Widgetlogic to the newest version.
Nov 5, 2025KiotViet Sync: Arbitrary file uploadsCVE-2025-12674 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- KiotViet Sync
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2025AI Engine: Sensitive Information ExposureCVE-2025-11749 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.
- Product
- AI Engine
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 4, 2025Easy Upload Files During Checkout: Arbitrary JavaScript file uploadsCVE-2025-12682 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' function in all versions up to, and including, 2.9.8. This makes it possible for unauthenticated attackers to upload arbitrary JavaScript files on the affected site's server which may make remote code execution possible.
- Product
- Easy Upload Files During Checkout
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update Easy Upload Files During Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor): Local File InclusionCVE-2025-12493 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor)
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 4, 2025Simple User Capabilities: Privilege EscalationCVE-2025-12158 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.
- Product
- Simple User Capabilities
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple User Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.