Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,729 results · page 214 of 815
Jan 22, 2026Booking Ultra Pro: Insertion of Sensitive Information Into Sent DataCVE-2025-68006 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through <= 1.1.23.
- Product
- Booking Ultra Pro
- Affected
- up to 1.1.23
- What to do
- Affects up to 1.1.23. Update Booking Ultra Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026My Post Order: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kapil Chugh My Post Order my-posts-order allows Reflected XSS.This issue affects My Post Order: from n/a through <= 1.2.1.1.
- Product
- My Post Order
- Affected
- up to 1.2.1.1
- What to do
- Affects up to 1.2.1.1. Update My Post Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Shown Connector: Missing AuthorizationCVE-2025-68003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.
- Product
- Shown Connector
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Shown Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026g-FFL Checkout: Unrestricted Upload of File with Dangerous TypeCVE-2025-68001 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: from n/a through <= 2.1.0.
- Product
- g-FFL Checkout
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update g-FFL Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Real Homes CRM: Unrestricted Upload of File with Dangerous TypeCVE-2025-67968 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a through <= 1.0.0.
- Product
- Real Homes CRM
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Real Homes CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Lawyer Directory: Missing AuthorizationCVE-2025-67967 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.
- Product
- Lawyer Directory
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Lawyer Directory: Incorrect Privilege AssignmentCVE-2025-67966 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3.3.
- Product
- Lawyer Directory
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Homey Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67964 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.
- Product
- Homey Core
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Homey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Movie Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-67963 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5.
- Product
- Movie Booking
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Movie Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WPO365: Server-Side Request Forgery (SSRF)CVE-2025-67961 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0.
- Product
- WPO365
- Affected
- up to 40.0
- What to do
- Affects up to 40.0. Update WPO365 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through <= 1.7.06.
- Product
- WorkScout-Core
- Affected
- up to 1.7.06
- What to do
- Affects up to 1.7.06. Update WorkScout-Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WorkScout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67959 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScout: from n/a through <= 4.1.07.
- Product
- WorkScout
- Affected
- up to 4.1.07
- What to do
- Affects up to 4.1.07. Update WorkScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026TaxCloud for WooCommerce: Missing AuthorizationCVE-2025-67958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TaxCloud for WooCommerce: from n/a through <= 8.3.8.
- Product
- TaxCloud for WooCommerce
- Affected
- up to 8.3.8
- What to do
- Affects up to 8.3.8. Update TaxCloud for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Listivo Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67957 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File Inclusion.This issue affects Listivo Core: from n/a through <= 2.3.77.
- Product
- Listivo Core
- Affected
- up to 2.3.77
- What to do
- Affects up to 2.3.77. Update Listivo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026User Registration: Missing AuthorizationCVE-2025-67956 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.6.
- Product
- User Registration
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026MyHome Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67955 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP MyHome Core myhome-core allows PHP Local File Inclusion.This issue affects MyHome Core: from n/a through <= 4.1.0.
- Product
- MyHome Core
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Salon booking system: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67954 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.
- Product
- Salon booking system
- Affected
- up to 10.30.3
- What to do
- Affects up to 10.30.3. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Booking Activities: Incorrect Privilege AssignmentCVE-2025-67953 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in Booking Activities Team Booking Activities booking-activities allows Privilege Escalation.This issue affects Booking Activities: from n/a through <= 1.16.44.
- Product
- Booking Activities
- Affected
- up to 1.16.44
- What to do
- Affects up to 1.16.44. Update Booking Activities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Grand Tour: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67952 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through < 5.6.2.
- Product
- Grand Tour
- What to do
- Update Grand Tour to the newest version.
Jan 22, 2026Hostiko: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67949 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This issue affects Hostiko: from n/a through < 94.3.6.
- Product
- Hostiko
- What to do
- Update Hostiko to the newest version.
Jan 22, 2026AdForest Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle AdForest Elementor adforest-elementor allows Reflected XSS.This issue affects AdForest Elementor: from n/a through <= 3.0.11.
- Product
- AdForest Elementor
- Affected
- up to 3.0.11
- What to do
- Affects up to 3.0.11. Update AdForest Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026AdForest: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67946 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through <= 6.0.11.
- Product
- AdForest
- Affected
- up to 6.0.11
- What to do
- Affects up to 6.0.11. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026MailerLite – WooCommerce integration: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67945 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2.
- Product
- MailerLite – WooCommerce integration
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update MailerLite – WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Nelio AB Testing: Improper Control of Generation of Code ('Code Injection')CVE-2025-67944 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.1.8.
- Product
- Nelio AB Testing
- Affected
- up to 8.1.8
- What to do
- Affects up to 8.1.8. Update Nelio AB Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026My auctions allegro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67943 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.32.
- Product
- My auctions allegro
- Affected
- up to 3.6.32
- What to do
- Affects up to 3.6.32. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Peach Payments Gateway: Missing AuthorizationCVE-2025-67942 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.
- Product
- Peach Payments Gateway
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Peach Payments Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026The Aisle: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67941 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle theaisle allows PHP Local File Inclusion.This issue affects The Aisle: from n/a through < 2.9.1.
- Product
- The Aisle
- What to do
- Update The Aisle to the newest version.
Jan 22, 2026Powerlift: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67940 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through < 3.2.1.
- Product
- Powerlift
- What to do
- Update Powerlift to the newest version.
Jan 22, 2026Tickera: Missing AuthorizationCVE-2025-67939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.2.
- Product
- Tickera
- Affected
- up to 3.5.6.2
- What to do
- Affects up to 3.5.6.2. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Biagiotti: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67938 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Biagiotti biagiotti allows PHP Local File Inclusion.This issue affects Biagiotti: from n/a through < 3.5.2.
- Product
- Biagiotti
- What to do
- Update Biagiotti to the newest version.
Jan 22, 2026JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67923 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7.
- Product
- JetEngine
- Affected
- up to 3.7.7
- What to do
- Affects up to 3.7.7. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP SEO Search: Cross-Site Request Forgery (CSRF)CVE-2025-67626 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request Forgery.This issue affects WP SEO Search: from n/a through <= 1.1.
- Product
- WP SEO Search
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP SEO Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Anon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67620 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CleverSoft Anon anon2x allows Reflected XSS.This issue affects Anon: from n/a through <= 2.2.10.
- Product
- Anon
- Affected
- up to 2.2.10
- What to do
- Affects up to 2.2.10. Update Anon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Kids Heaven: Deserialization of Untrusted DataCVE-2025-67619 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Kids Heaven kids-world allows Object Injection.This issue affects Kids Heaven: from n/a through <= 3.2.
- Product
- Kids Heaven
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Kids Heaven to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Consult Aid: Deserialization of Untrusted DataCVE-2025-67617 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
- Product
- Consult Aid
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Consult Aid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Mella: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67616 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through <= 1.2.29.
- Product
- Mella
- Affected
- up to 1.2.29
- What to do
- Affects up to 1.2.29. Update Mella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Myour: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67615 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through <= 1.5.1.
- Product
- Myour
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Myour to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026TheNa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67614 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree TheNa thena allows Reflected XSS.This issue affects TheNa: from n/a through <= 1.5.5.
- Product
- TheNa
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update TheNa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Crumber: Missing AuthorizationCVE-2025-66143 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through <= 1.0.10.
- Product
- Crumber
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Crumber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Comparimager for Elementor: Missing AuthorizationCVE-2025-66142 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comparimager for Elementor: from n/a through <= 1.0.1.
- Product
- Comparimager for Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Comparimager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Scroller: Missing AuthorizationCVE-2025-66141 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a through <= 2.0.2.
- Product
- Scroller
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Uper for Elementor: Missing AuthorizationCVE-2025-66140 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.
- Product
- Uper for Elementor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Uper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Audier For Elementor: Missing AuthorizationCVE-2025-66139 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.
- Product
- Audier For Elementor
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Audier For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Motionger for Elementor: Missing AuthorizationCVE-2025-66138 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motionger for Elementor: from n/a through <= 2.0.4.
- Product
- Motionger for Elementor
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Motionger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Searcher for Elementor: Missing AuthorizationCVE-2025-66137 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.
- Product
- Searcher for Elementor
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Searcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Carter for Elementor: Missing AuthorizationCVE-2025-66136 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2.
- Product
- Carter for Elementor
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Carter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Imager for Elementor: Missing AuthorizationCVE-2025-66135 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4.
- Product
- Imager for Elementor
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Imager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026ANAC XML Viewer: Server-Side Request Forgery (SSRF)CVE-2025-64252 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Marco Milesi ANAC XML Viewer anac-xml-viewer allows Server Side Request Forgery.This issue affects ANAC XML Viewer: from n/a through <= 1.8.2.
- Product
- ANAC XML Viewer
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update ANAC XML Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026REHub Framework: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63051 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue affects REHub Framework: from n/a through < 19.9.9.4.
- Product
- REHub Framework
- What to do
- Update REHub Framework to the newest version.
Jan 22, 2026Grand Restaurant Theme Elements for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63026 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor allows Stored XSS.This issue affects Grand Restaurant Theme Elements for Elementor: from n/a through <= 2.1.1.
- Product
- Grand Restaurant Theme Elements for Elementor
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Grand Restaurant Theme Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.