Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,177 results · page 23 of 24
Nov 6, 2025Elated-Themes Search & Go search-and-go: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-62064 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7.
- Product
- Elated-Themes Search & Go search-and-go
- What to do
- Update Elated-Themes Search & Go search-and-go to the newest version.
Nov 6, 2025Case-Themes Case Addons case-addons: Unrestricted Upload of File with Dangerous TypeCVE-2025-62047 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issue affects Case Addons: from n/a through < 1.3.0.
- Product
- Case-Themes Case Addons case-addons
- What to do
- Update Case-Themes Case Addons case-addons to the newest version.
Nov 6, 2025hogash KALLYAS kallyas: Unrestricted Upload of File with Dangerous TypeCVE-2025-62016 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.
- Product
- hogash KALLYAS kallyas
- What to do
- Update hogash KALLYAS kallyas to the newest version.
Nov 6, 2025WP User Manager WP User Manager wp-user-manager: Deserialization of Untrusted DataCVE-2025-60245 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.
- Product
- WP User Manager WP User Manager wp-user-manager
- What to do
- Update WP User Manager WP User Manager wp-user-manager to the newest version.
Nov 6, 2025Holest Engineering Selling Commander for WooCommerce selling-commander-connector: Incorrect Privilege AssignmentCVE-2025-60243 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Holest Engineering Selling Commander for WooCommerce selling-commander-connector allows Privilege Escalation.This issue affects Selling Commander for WooCommerce: from n/a through <= 1.2.46.
- Product
- Holest Engineering Selling Commander for WooCommerce selling-commander-connector
- What to do
- Update Holest Engineering Selling Commander for WooCommerce selling-commander-connector to the newest version.
Nov 6, 2025Plugify Support Ticket System for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-60235 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Plugify Support Ticket System for WooCommerce (Premium) support-ticket-system-for-woocommerce allows Using Malicious Files.This issue affects Support Ticket System for WooCommerce (Premium): from n/a through <= 2.0.7.
- Product
- Plugify Support Ticket System for WooCommerce
- What to do
- Update Plugify Support Ticket System for WooCommerce to the newest version.
Nov 6, 2025Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-60207 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.
- Product
- Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce
- What to do
- Update Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce to the newest version.
Nov 6, 2025Vito Peleg Atarim atarim-visual-collaboration: Incorrect Privilege AssignmentCVE-2025-60195 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Privilege Escalation.This issue affects Atarim: from n/a through <= 4.2.1.
- Product
- Vito Peleg Atarim atarim-visual-collaboration
- What to do
- Update Vito Peleg Atarim atarim-visual-collaboration to the newest version.
Nov 6, 2025Cristián Lávaque s2Member s2member: Deserialization of Untrusted DataCVE-2025-58998 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
- Product
- Cristián Lávaque s2Member s2member
- What to do
- Update Cristián Lávaque s2Member s2member to the newest version.
Nov 6, 2025Helmut Wandl Advanced Settings advanced-settings: Unrestricted Upload of File with Dangerous TypeCVE-2025-58996 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Upload a Web Shell to a Web Server.This issue affects Advanced Settings: from n/a through <= 3.1.1.
- Product
- Helmut Wandl Advanced Settings advanced-settings
- What to do
- Update Helmut Wandl Advanced Settings advanced-settings to the newest version.
Nov 6, 2025CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft: Deserialization of Untrusted DataCVE-2025-58636 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
- Product
- CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft
- What to do
- Update CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft to the newest version.
Nov 6, 2025kamleshyadav Miraculous Core Plugin miraculouscore: Authorization Bypass Through User-Controlled KeyCVE-2025-58627 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
- Product
- kamleshyadav Miraculous Core Plugin miraculouscore
- What to do
- Update kamleshyadav Miraculous Core Plugin miraculouscore to the newest version.
Nov 6, 2025borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon: Unrestricted Upload of File with Dangerous TypeCVE-2025-53283 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through <= 2.4.1.
- Product
- borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon
- What to do
- Update borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon to the newest version.
Nov 6, 2025VictorThemes Seil seil: Deserialization of Untrusted DataCVE-2025-53242 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in VictorThemes Seil seil allows Object Injection.This issue affects Seil: from n/a through <= 1.7.1.
- Product
- VictorThemes Seil seil
- What to do
- Update VictorThemes Seil seil to the newest version.
Nov 6, 2025hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-52773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway allows SQL Injection.This issue affects HieCOR Payment Gateway Plugin: from n/a through <= 1.5.11.
- Product
- hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway
- What to do
- Update hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway to the newest version.
Nov 6, 2025Fetch Designs Sign-up Sheets sign-up-sheets: Deserialization of Untrusted DataCVE-2025-49393 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2.
- Product
- Fetch Designs Sign-up Sheets sign-up-sheets
- What to do
- Update Fetch Designs Sign-up Sheets sign-up-sheets to the newest version.
Nov 6, 2025VillaTheme HAPPY happy-helpdesk-support-ticket-system: Improper Control of Generation of Code ('Code Injection')CVE-2025-49372 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Remote Code Inclusion.This issue affects HAPPY: from n/a through <= 1.0.7.
- Product
- VillaTheme HAPPY happy-helpdesk-support-ticket-system
- What to do
- Update VillaTheme HAPPY happy-helpdesk-support-ticket-system to the newest version.
Nov 6, 2025Rainbow-Themes Education WordPress Theme | HiStudy histudy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48089 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histudy allows SQL Injection.This issue affects Education WordPress Theme | HiStudy: from n/a through < 3.1.0.
- Product
- Rainbow-Themes Education WordPress Theme | HiStudy histudy
- What to do
- Update Rainbow-Themes Education WordPress Theme | HiStudy histudy to the newest version.
Nov 6, 2025acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing: Improper Control of Generation of Code ('Code Injection')CVE-2025-47588 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.9.
- Product
- acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing
- What to do
- Update acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing to the newest version.
Nov 6, 2025Widgetlogic: Improper Control of Generation of Code ('Code Injection')CVE-2025-32222 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Widgetlogic.org Widget Logic widget-logic allows Code Injection.This issue affects Widget Logic: from n/a through <= 6.0.5.
- Product
- Widgetlogic
- What to do
- Update Widgetlogic to the newest version.
Nov 5, 2025KiotViet Sync: Arbitrary file uploadsCVE-2025-12674 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- KiotViet Sync
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2025AI Engine: Sensitive Information ExposureCVE-2025-11749 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creating a new administrator account, leading to privilege escalation.
- Product
- AI Engine
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 4, 2025Easy Upload Files During Checkout: Arbitrary JavaScript file uploadsCVE-2025-12682 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' function in all versions up to, and including, 2.9.8. This makes it possible for unauthenticated attackers to upload arbitrary JavaScript files on the affected site's server which may make remote code execution possible.
- Product
- Easy Upload Files During Checkout
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update Easy Upload Files During Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor): Local File InclusionCVE-2025-12493 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor)
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 4, 2025Simple User Capabilities: Privilege EscalationCVE-2025-12158 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.
- Product
- Simple User Capabilities
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple User Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2025CE21 Suite: Sensitive Information ExposureCVE-2025-11008 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers to extract sensitive data including authentication credentials, which can be used to log in as other users as long as they have used the plugin's custom authentication feature before. This may include administrators, which makes a complete site takeover possible.
- Product
- CE21 Suite
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update CE21 Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2025CE21 Suite: Unauthorized plugin settings updateCVE-2025-11007 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in versions 2.2.1 to 2.3.1. This makes it possible for unauthenticated attackers to update the plugin's API settings including a secret key used for authentication. This allows unauthenticated attackers to create new admin accounts on an affected site.
- Product
- CE21 Suite
- Affected
- 2.2.1 to 2.3.1
- What to do
- Affects 2.2.1 to 2.3.1. Update CE21 Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2025Doccure Core: Privilege escalationCVE-2025-8900 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
- Product
- Doccure Core
- What to do
- Update Doccure Core to the newest version.
Nov 1, 2025Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: Arbitrary file uploadsCVE-2025-11499 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in configurations where unauthenticated users have been provided with a method for adding featured images, and the workflow trigger is created.
- Product
- Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
- Affected
- up to 1.1.32
- What to do
- Affects up to 1.1.32. Update Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2025Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App: Unauthorized access of dataCVE-2025-11833 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. This makes it possible for unauthenticated attackers to read arbitrary logged emails sent through the Post SMTP plugin, including password reset emails containing password reset links, which can lead to account takeover.
- Product
- Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2025King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor: Privilege escalationCVE-2025-8489 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.
- Product
- King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor
- Affected
- 24.12.92 to 51.1.14
- What to do
- Affects 24.12.92 to 51.1.14. Update King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2025Noo JobMonster: Authentication BypassCVE-2025-5397 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes it possible for unauthenticated attackers to bypass standard authentication and access administrative user accounts. Please note social login needs to be enabled in order for a site to be impacted by this vulnerability.
- Product
- Noo JobMonster
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update Noo JobMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2025WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecCVE-2025-4665 · WordPress plugins & themes · reported by mandiant-cve@google.comCritical 9.6
WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully.
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2025The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploCVE-2025-6440 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Affected
- up to 1.9.26
- What to do
- Affects up to 1.9.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025eyecix JobSearch wp-jobsearch: Deserialization of Untrusted DataCVE-2025-62025 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.
- Product
- eyecix JobSearch wp-jobsearch
- What to do
- Update eyecix JobSearch wp-jobsearch to the newest version.
Oct 22, 20257oroof Medcity medcity: Unrestricted Upload of File with Dangerous TypeCVE-2025-58963 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Shell to a Web Server.This issue affects Medcity: from n/a through < 1.1.9.
- Product
- 7oroof Medcity medcity
- What to do
- Update 7oroof Medcity medcity to the newest version.
Oct 22, 2025Crocoblock JetSearch jet-search: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49931 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through 3.5.10.
- Product
- Crocoblock JetSearch jet-search
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update Crocoblock JetSearch jet-search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025quantumcloud Simple Link Directory qc-simple-link-directory: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-49901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
- Product
- quantumcloud Simple Link Directory qc-simple-link-directory
- What to do
- Update quantumcloud Simple Link Directory qc-simple-link-directory to the newest version.
Oct 21, 2025FormGent: Is vulnerable to arbitrary file deletion due to insufficient file path validationCVE-2025-10916 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
- Product
- FormGent
- Fixed in
- 1.0.4
- What to do
- Update FormGent to 1.0.4 or newer.
Oct 18, 2025PPOM – Product Addons & Custom Fields for WooCommerce: Arbitrary file uploadsCVE-2025-11391 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated.
- Product
- PPOM – Product Addons & Custom Fields for WooCommerce
- Affected
- up to 33.0.15
- What to do
- Affects up to 33.0.15. Update PPOM – Product Addons & Custom Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2025PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.CVE-2025-61922 · Websites & servers · reported by GitHubCritical 9.1
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2025Felan Framework: Improper authenticationCVE-2025-10850 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue.
- Product
- Felan Framework
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2025Truelysell Core: Arbitrary User Password ChangeCVE-2025-10742 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.
- Product
- Truelysell Core
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Truelysell Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025Orion SMS OTP Verification: Privilege escalationCVE-2025-9967 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number
- Product
- Orion SMS OTP Verification
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Orion SMS OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2025OwnID Passwordless Login: Authentication BypassCVE-2025-10294 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownid_shared_secret value is empty prior to authenticating a user via JWT. This makes it possible for unauthenticated attackers to log in as other users, including administrators, on instances where the plugin has not been fully configured yet.
- Product
- OwnID Passwordless Login
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update OwnID Passwordless Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025Flex QR Code Generator: Arbitrary file uploadsCVE-2025-10041 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Flex QR Code Generator
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Flex QR Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 11, 2025The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deleCVE-2025-6439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to delete all files in an arbitrary directory on the server, which can lead to remote code execution, data loss, or site unavailability.
- Affected
- up to 1.9.26
- What to do
- Affects up to 1.9.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2025Ovatheme Events Manager: Arbitrary file uploadsCVE-2025-6553 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Ovatheme Events Manager
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update Ovatheme Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2025WP Freeio: Privilege EscalationCVE-2025-11533 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- WP Freeio
- Affected
- up to 1.2.21
- What to do
- Affects up to 1.2.21. Update WP Freeio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2025Search & Go - Directory: Authentication BypassCVE-2025-11522 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. CVE-2025-62064 is likely a duplicate of this CVE.
- Product
- Search & Go - Directory
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Search & Go - Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.