Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,732 results · page 228 of 815
Dec 30, 2025Appointify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-59129 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injection.This issue affects Appointify: from n/a through <= 1.0.8.
- Product
- Appointify
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Appointify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WING WordPress Migrator: Cross-Site Request Forgery (CSRF)CVE-2025-52835 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through <= 1.2.0.
- Product
- WING WordPress Migrator
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WING WordPress Migrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64190 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.6.
- Product
- XStore Core
- What to do
- Update XStore Core to the newest version.
Dec 30, 2025WBC907 Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63027 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcreations907 WBC907 Core wbc907-core allows Stored XSS.This issue affects WBC907 Core: from n/a through <= 3.4.1.
- Product
- WBC907 Core
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update WBC907 Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Featured Video for WordPress – VideographyWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62746 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeFlavors Featured Video for WordPress – VideographyWP videographywp allows Stored XSS.This issue affects Featured Video for WordPress – VideographyWP: from n/a through <= 1.0.18.
- Product
- Featured Video for WordPress – VideographyWP
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Featured Video for WordPress – VideographyWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Strong Testimonials: Unauthorized modification of dataCVE-2025-14426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.
- Product
- Strong Testimonials
- Affected
- up to 3.2.18
- What to do
- Affects up to 3.2.18. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025Lucky Wheel for WooCommerce – Spin a Sale: PHP Code InjectionCVE-2025-14509 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13. This is due to the plugin using eval() to execute user-supplied input from the 'Conditional Tags' setting without proper validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server. In WordPress multisite installations, this allows Site Administrators to execute arbitrary code, a capability they should not have since plugin/theme file editing is disabled for non-Super Admins in multisite environments.
- Product
- Lucky Wheel for WooCommerce – Spin a Sale
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update Lucky Wheel for WooCommerce – Spin a Sale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025ShopMagic: Missing AuthorizationCVE-2025-69093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.
- Product
- ShopMagic
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Essential Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69092 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.5.3
- What to do
- Affects up to 6.5.3. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Demo Importer Plus: Missing AuthorizationCVE-2025-69091 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.
- Product
- Demo Importer Plus
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Demo Importer Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Auto Listings: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69089 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in autolistings Auto Listings auto-listings allows Stored XSS.This issue affects Auto Listings: from n/a through <= 2.7.1.
- Product
- Auto Listings
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Auto Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Combo Offers WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69088 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through <= 4.2.
- Product
- Combo Offers WooCommerce
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Combo Offers WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Lekker: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69034 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP Local File Inclusion.This issue affects Lekker: from n/a through <= 1.8.
- Product
- Lekker
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Lekker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Blog Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69033 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.3.
- Product
- Blog Filter
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Blog Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025FiveStar: Authorization Bypass Through User-Controlled KeyCVE-2025-69032 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiveStar: from n/a through <= 1.7.
- Product
- FiveStar
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update FiveStar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Arcane: Missing AuthorizationCVE-2025-69031 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.
- Product
- Arcane
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update Arcane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Backpack Traveler: Authorization Bypass Through User-Controlled KeyCVE-2025-69030 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3.
- Product
- Backpack Traveler
- Affected
- up to 2.10.3
- What to do
- Affects up to 2.10.3. Update Backpack Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Struktur: Authorization Bypass Through User-Controlled KeyCVE-2025-69029 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Struktur: from n/a through <= 2.5.1.
- Product
- Struktur
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Struktur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025weForms: Missing AuthorizationCVE-2025-69028 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.
- Product
- weForms
- Affected
- up to 1.6.25
- What to do
- Affects up to 1.6.25. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Product Delivery Date for WooCommerce – Lite: Missing AuthorizationCVE-2025-69027 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.
- Product
- Product Delivery Date for WooCommerce – Lite
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Product Delivery Date for WooCommerce – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025PopupKit: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-69026 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue affects PopupKit: from n/a through <= 2.1.5.
- Product
- PopupKit
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update PopupKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Poptics: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-69025 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.
- Product
- Poptics
- Affected
- up to 1.0.20
- What to do
- Affects up to 1.0.20. Update Poptics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025BizPrint: Missing AuthorizationCVE-2025-69024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.
- Product
- BizPrint
- Affected
- up to 4.6.7
- What to do
- Affects up to 4.6.7. Update BizPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Discussion Board: Missing AuthorizationCVE-2025-69023 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.
- Product
- Discussion Board
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025HR Management Lite: Missing AuthorizationCVE-2025-69022 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.
- Product
- HR Management Lite
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update HR Management Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Popup box: Cross-Site Request Forgery (CSRF)CVE-2025-69021 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.
- Product
- Popup box
- Affected
- up to 6.0.7
- What to do
- Affects up to 6.0.7. Update Popup box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Newsletters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.
- Product
- Newsletters
- Affected
- up to 4.12
- What to do
- Affects up to 4.12. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025FlippingBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based XSS.This issue affects FlippingBook: from n/a through <= 2.0.1.
- Product
- FlippingBook
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update FlippingBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Web Directory Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69018 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.
- Product
- Web Directory Free
- Affected
- up to 1.7.12
- What to do
- Affects up to 1.7.12. Update Web Directory Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025RestroPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69017 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.
- Product
- RestroPress
- Affected
- up to 3.2.8.6
- What to do
- Affects up to 3.2.8.6. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Shortcodes and extra features for Phlox: Missing AuthorizationCVE-2025-69016 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.
- Product
- Shortcodes and extra features for Phlox
- Affected
- up to 2.17.22
- What to do
- Affects up to 2.17.22. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Crowdsignal Forms: Missing AuthorizationCVE-2025-69015 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.
- Product
- Crowdsignal Forms
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Crowdsignal Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Youzify: Server-Side Request Forgery (SSRF)CVE-2025-69014 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.
- Product
- Youzify
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Youzify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Stratum: Missing AuthorizationCVE-2025-69013 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.
- Product
- Stratum
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Stratum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Event Organiser: Missing AuthorizationCVE-2025-69012 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.
- Product
- Event Organiser
- Affected
- up to 3.12.8
- What to do
- Affects up to 3.12.8. Update Event Organiser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Themebeez Toolkit: Missing AuthorizationCVE-2025-69010 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.
- Product
- Themebeez Toolkit
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Themebeez Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Medicalequipment: Missing AuthorizationCVE-2025-69009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.
- Product
- Medicalequipment
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Medicalequipment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Inboxify Sign Up Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69008 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allows Stored XSS.This issue affects Inboxify Sign Up Form: from n/a through <= 1.0.4.
- Product
- Inboxify Sign Up Form
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Inboxify Sign Up Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Popping Sidebars and Widgets Light: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69007 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Stored XSS.This issue affects Popping Sidebars and Widgets Light: from n/a through <= 1.27.
- Product
- Popping Sidebars and Widgets Light
- Affected
- up to 1.27
- What to do
- Affects up to 1.27. Update Popping Sidebars and Widgets Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025AM Events: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69006 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This issue affects AM Events: from n/a through <= 1.13.1.
- Product
- AM Events
- Affected
- up to 1.13.1
- What to do
- Affects up to 1.13.1. Update AM Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Heateor Social Login: Cross-Site Request Forgery (CSRF)CVE-2025-68998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.
- Product
- Heateor Social Login
- Affected
- up to 1.1.39
- What to do
- Affects up to 1.1.39. Update Heateor Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025wpDiscuz: Authorization Bypass Through User-Controlled KeyCVE-2025-68997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.
- Product
- wpDiscuz
- Affected
- up to 7.6.43
- What to do
- Affects up to 7.6.43. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Responsive Posts Carousel Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68996 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.
- Product
- Responsive Posts Carousel Pro
- Affected
- up to 15.1
- What to do
- Affects up to 15.1. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025My Sticky Elements: Missing AuthorizationCVE-2025-68995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.
- Product
- My Sticky Elements
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Product Loops for WooCommerce: Missing AuthorizationCVE-2025-68994 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce: from n/a through <= 2.1.2.
- Product
- Product Loops for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Product Loops for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Share, Print and PDF Products for WooCommerce: Missing AuthorizationCVE-2025-68993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share, Print and PDF Products for WooCommerce: from n/a through <= 3.1.2.
- Product
- Share, Print and PDF Products for WooCommerce
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Share, Print and PDF Products for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025BWL Knowledge Base Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68992 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allows Stored XSS.This issue affects BWL Knowledge Base Manager: from n/a through <= 1.6.3.
- Product
- BWL Knowledge Base Manager
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update BWL Knowledge Base Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025BWL Pro Voting Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows DOM-Based XSS.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.
- Product
- BWL Pro Voting Manager
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update BWL Pro Voting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025BWL Pro Voting Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68990 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows Blind SQL Injection.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.
- Product
- BWL Pro Voting Manager
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update BWL Pro Voting Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.