Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,729 results · page 213 of 815
Jan 22, 2026Synergy Project Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68898 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XSS.This issue affects Synergy Project Manager: from n/a through <= 1.5.
- Product
- Synergy Project Manager
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Synergy Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WDV One Page Docs: Missing AuthorizationCVE-2025-68896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vrpr WDV One Page Docs wdv-one-page-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WDV One Page Docs: from n/a through <= 1.2.4.
- Product
- WDV One Page Docs
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update WDV One Page Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026ShoutOut: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68894 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shoutoutglobal ShoutOut shoutout allows Reflected XSS.This issue affects ShoutOut: from n/a through <= 4.0.2.
- Product
- ShoutOut
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update ShoutOut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Simple Redirect: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68884 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arevico WP Simple Redirect wp-simple-redirect allows Reflected XSS.This issue affects WP Simple Redirect: from n/a through <= 1.1.
- Product
- WP Simple Redirect
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Simple Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026bidorbuy Store Integrator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68883 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Reflected XSS.This issue affects bidorbuy Store Integrator: from n/a through <= 2.12.0.
- Product
- bidorbuy Store Integrator
- Affected
- up to 2.12.0
- What to do
- Affects up to 2.12.0. Update bidorbuy Store Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Scalenut: Missing AuthorizationCVE-2025-68882 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Scalenut Scalenut scalenut allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scalenut: from n/a through <= 1.1.5.
- Product
- Scalenut
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Scalenut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026AppExperts: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68881 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.This issue affects AppExperts: from n/a through <= 1.4.5.
- Product
- AppExperts
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update AppExperts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Dooodl: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68871 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in noCreativity Dooodl dooodl allows Reflected XSS.This issue affects Dooodl: from n/a through <= 2.3.0.
- Product
- Dooodl
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Dooodl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026LazyTasks: Incorrect Privilege AssignmentCVE-2025-68869 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37.
- Product
- LazyTasks
- Affected
- up to 1.2.37
- What to do
- Affects up to 1.2.37. Update LazyTasks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Dinatur: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68866 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofer696 Dinatur dinatur allows Stored XSS.This issue affects Dinatur: from n/a through <= 1.18.
- Product
- Dinatur
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Dinatur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Infility Global: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68864 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Stored XSS.This issue affects Infility Global: from n/a through <= 2.15.11.
- Product
- Infility Global
- Affected
- up to 2.15.11
- What to do
- Affects up to 2.15.11. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Syntax Highlighter Compress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68859 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in agmorpheus Syntax Highlighter Compress syntax-highlighter-compress allows Reflected XSS.This issue affects Syntax Highlighter Compress: from n/a through <= 3.0.83.3.
- Product
- Syntax Highlighter Compress
- Affected
- up to 3.0.83.3
- What to do
- Affects up to 3.0.83.3. Update Syntax Highlighter Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026wpCAS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68858 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Casey Bisson wpCAS wpcas allows Reflected XSS.This issue affects wpCAS: from n/a through <= 1.07.
- Product
- wpCAS
- Affected
- up to 1.07
- What to do
- Affects up to 1.07. Update wpCAS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Paid Downloads: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68857 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through <= 3.15.
- Product
- Paid Downloads
- Affected
- up to 3.15
- What to do
- Affects up to 3.15. Update Paid Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Quote Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68849 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank Corso Quote Master quote-master allows Reflected XSS.This issue affects Quote Master: from n/a through <= 7.1.1.
- Product
- Quote Master
- Affected
- up to 7.1.1
- What to do
- Affects up to 7.1.1. Update Quote Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Easy Theme Options: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Theme Options easy-theme-options allows Reflected XSS.This issue affects Easy Theme Options: from n/a through <= 1.0.
- Product
- Easy Theme Options
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Theme Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026MemberPress Discord Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68838 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discord Addon expresstechsoftwares-memberpress-discord-add-on allows Reflected XSS.This issue affects MemberPress Discord Addon: from n/a through <= 1.1.4.
- Product
- MemberPress Discord Addon
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update MemberPress Discord Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Ravpage: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68835 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matiskiba Ravpage ravpage allows Reflected XSS.This issue affects Ravpage: from n/a through <= 2.33.
- Product
- Ravpage
- Affected
- up to 2.33
- What to do
- Affects up to 2.33. Update Ravpage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Depicter Slider: Missing AuthorizationCVE-2025-68558 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through <= 4.0.4.
- Product
- Depicter Slider
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Craft: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68538 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: from n/a through <= 2.3.6.
- Product
- Craft
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Craft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026DotLife: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods DotLife dotlife allows Reflected XSS.This issue affects DotLife: from n/a through < 4.9.5.
- Product
- DotLife
- What to do
- Update DotLife to the newest version.
Jan 22, 2026Hoteller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68518 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Hoteller hoteller allows Reflected XSS.This issue affects Hoteller: from n/a through < 6.8.9.
- Product
- Hoteller
- What to do
- Update Hoteller to the newest version.
Jan 22, 2026Photography: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68510 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through < 7.7.5.
- Product
- Photography
- What to do
- Update Photography to the newest version.
Jan 22, 2026Icegram: Missing AuthorizationCVE-2025-68507 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35.
- Product
- Icegram
- Affected
- up to 3.1.35
- What to do
- Affects up to 3.1.35. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-68073 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Easy Property Listings: Missing AuthorizationCVE-2025-68072 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.
- Product
- Easy Property Listings
- Affected
- up to 3.5.20
- What to do
- Affects up to 3.5.20. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hotel Listing: Missing AuthorizationCVE-2025-68059 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.
- Product
- Hotel Listing
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Hotel Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Institutions Directory: Missing AuthorizationCVE-2025-68058 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3..4.
- Product
- Institutions Directory
- Affected
- up to 1.3..4
- What to do
- Affects up to 1.3..4. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-68057 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
- Product
- Hospital Doctor Directory
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Eventin: Deserialization of Untrusted DataCVE-2025-68047 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.
- Product
- Eventin
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Contact Form & Lead Form Elementor Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.
- Product
- Contact Form & Lead Form Elementor Builder
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Contact Form & Lead Form Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Omnichannel for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.This issue affects Omnichannel for WooCommerce: from n/a through <= 1.3.65.
- Product
- Omnichannel for WooCommerce
- Affected
- up to 1.3.65
- What to do
- Affects up to 1.3.65. Update Omnichannel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP BackItUp: Missing AuthorizationCVE-2025-68039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: from n/a through <= 2.1.0.
- Product
- WP BackItUp
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP BackItUp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Tabby Checkout: Insertion of Sensitive Information Into Sent DataCVE-2025-68035 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4.
- Product
- Tabby Checkout
- Affected
- up to 5.8.4
- What to do
- Affects up to 5.8.4. Update Tabby Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026CleverReach® WP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68034 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.21.
- Product
- CleverReach® WP
- Affected
- up to 1.5.21
- What to do
- Affects up to 1.5.21. Update CleverReach® WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Frontis Blocks: Server-Side Request Forgery (SSRF)CVE-2025-68030 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in WP Messiah Frontis Blocks frontis-blocks allows Server Side Request Forgery.This issue affects Frontis Blocks: from n/a through <= 1.1.5.
- Product
- Frontis Blocks
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Frontis Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hydra Booking: Incorrect Privilege AssignmentCVE-2025-68027 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a through <= 1.1.32.
- Product
- Hydra Booking
- Affected
- up to 1.1.32
- What to do
- Affects up to 1.1.32. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Notifier: Missing AuthorizationCVE-2025-68020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.13.
- Product
- Notifier
- Affected
- up to 2.7.13
- What to do
- Affects up to 2.7.13. Update Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026SEO Booster: Missing AuthorizationCVE-2025-68019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.
- Product
- SEO Booster
- Affected
- up to 6.1.8
- What to do
- Affects up to 6.1.8. Update SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Order Listener for WooCommerce: Missing AuthorizationCVE-2025-68018 · WordPress plugins & themes · reported by PatchstackCritical 9.4
Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1.
- Product
- Order Listener for WooCommerce
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Order Listener for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Antideo Email Validator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68017 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator allows Blind SQL Injection.This issue affects Antideo Email Validator: from n/a through <= 1.0.10.
- Product
- Antideo Email Validator
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Antideo Email Validator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026onepay Payment Gateway For WooCommerce: Missing AuthorizationCVE-2025-68016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooCommerce: from n/a through <= 1.1.2.
- Product
- onepay Payment Gateway For WooCommerce
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update onepay Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Event Tickets with Ticket Scanner: Improper Control of Generation of Code ('Code Injection')CVE-2025-68015 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.5.
- Product
- Event Tickets with Ticket Scanner
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update Event Tickets with Ticket Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Payment Gateway Authorize.Net CIM for WooCommerce: Missing AuthorizationCVE-2025-68013 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.
- Product
- Payment Gateway Authorize.Net CIM for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Payment Gateway Authorize.Net CIM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026CodeColorer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68012 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmytro Shteflyuk CodeColorer codecolorer allows Stored XSS.This issue affects CodeColorer: from n/a through <= 0.10.1.
- Product
- CodeColorer
- Affected
- up to 0.10.1
- What to do
- Affects up to 0.10.1. Update CodeColorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026GLS Shipping for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68011 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GLS GLS Shipping for WooCommerce gls-shipping-for-woocommerce allows Reflected XSS.This issue affects GLS Shipping for WooCommerce: from n/a through <= 1.4.0.
- Product
- GLS Shipping for WooCommerce
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update GLS Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Netgsm: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68010 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through <= 2.9.63.
- Product
- Netgsm
- Affected
- up to 2.9.63
- What to do
- Affects up to 2.9.63. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Slider Templates: Missing AuthorizationCVE-2025-68009 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3.
- Product
- Slider Templates
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Slider Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Mail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68008 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: from n/a through <= 1.3.
- Product
- WP Mail
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Event Espresso 4 Decaf: Missing AuthorizationCVE-2025-68007 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.37.decaf.
- Product
- Event Espresso 4 Decaf
- Affected
- up to 5.0.37.decaf
- What to do
- Affects up to 5.0.37.decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.