Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,732 results · page 230 of 815
Dec 24, 2025Editorial Calendar: Missing AuthorizationCVE-2025-68603 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editorial Calendar: from n/a through <= 3.8.8.
- Product
- Editorial Calendar
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Accept Donations with PayPal & Stripe: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-68602 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.5.2.
- Product
- Accept Donations with PayPal & Stripe
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Accept Donations with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Five Star Restaurant Reservations: Cross-Site Request Forgery (CSRF)CVE-2025-68601 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.8.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Link Library: Server-Side Request Forgery (SSRF)CVE-2025-68600 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Yannick Lefebvre Link Library link-library allows Server Side Request Forgery.This issue affects Link Library: from n/a through <= 7.8.7.
- Product
- Link Library
- Affected
- up to 7.8.7
- What to do
- Affects up to 7.8.7. Update Link Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025YouTube Embed: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68599 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through <= 5.4.
- Product
- YouTube Embed
- Affected
- up to 5.4
- What to do
- Affects up to 5.4. Update YouTube Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Page Builder: Live Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68598 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22.
- Product
- Page Builder: Live Composer
- Affected
- up to 2.1.22
- What to do
- Affects up to 2.1.22. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Jobs for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68597 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Stored XSS.This issue affects Jobs for WordPress: from n/a through <= 2.8.1.
- Product
- Jobs for
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Jobs for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Bit Assist: Missing AuthorizationCVE-2025-68596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bit Assist: from n/a through <= 1.5.11.
- Product
- Bit Assist
- Affected
- up to 1.5.11
- What to do
- Affects up to 1.5.11. Update Bit Assist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Widgets for Social Photo Feed: Missing AuthorizationCVE-2025-68595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.
- Product
- Widgets for Social Photo Feed
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Widgets for Social Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Missing AuthorizationCVE-2025-68594 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.12.0.
- Product
- Poll, Survey & Quiz Maker Plugin by Opinion Stage
- Affected
- up to 19.12.0
- What to do
- Affects up to 19.12.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Adminify: Missing AuthorizationCVE-2025-68593 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
- Product
- WP Adminify
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Adminify: Missing AuthorizationCVE-2025-68592 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
- Product
- WP Adminify
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Simple File List: Missing AuthorizationCVE-2025-68591 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.18.
- Product
- Simple File List
- Affected
- up to 6.1.18
- What to do
- Affects up to 6.1.18. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Integration for Contact Form 7 HubSpot: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68590 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Blind SQL Injection.This issue affects Integration for Contact Form 7 HubSpot: from n/a through <= 1.4.2.
- Product
- Integration for Contact Form 7 HubSpot
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Integration for Contact Form 7 HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Telegram Widget and Join Link: Missing AuthorizationCVE-2025-68589 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Telegram Widget and Join Link: from n/a through <= 2.2.12.
- Product
- WP Telegram Widget and Join Link
- Affected
- up to 2.2.12
- What to do
- Affects up to 2.2.12. Update WP Telegram Widget and Join Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025TS Poll: Missing AuthorizationCVE-2025-68588 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Poll: from n/a through <= 2.5.5.
- Product
- TS Poll
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update TS Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Watu Quiz: Missing AuthorizationCVE-2025-68587 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.
- Product
- Watu Quiz
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Cooked: Missing AuthorizationCVE-2025-68586 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.
- Product
- Cooked
- Affected
- up to 1.11.3
- What to do
- Affects up to 1.11.3. Update Cooked to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Document Revisions: Missing AuthorizationCVE-2025-68585 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Ben Balter WP Document Revisions wp-document-revisions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Document Revisions: from n/a through <= 3.7.2.
- Product
- WP Document Revisions
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WP Document Revisions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Vimeotheque: Cross-Site Request Forgery (CSRF)CVE-2025-68584 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.
- Product
- Vimeotheque
- Affected
- up to 2.3.5.2
- What to do
- Affects up to 2.3.5.2. Update Vimeotheque to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Fast User Switching: Cross-Site Request Forgery (CSRF)CVE-2025-68583 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affects Fast User Switching: from n/a through <= 1.4.10.
- Product
- Fast User Switching
- Affected
- up to 1.4.10
- What to do
- Affects up to 1.4.10. Update Fast User Switching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Funnelforms Free: Missing AuthorizationCVE-2025-68582 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Funnelforms Free: from n/a through <= 3.8.
- Product
- Funnelforms Free
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Funnelforms Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025YITH Slider for page builders: Missing AuthorizationCVE-2025-68581 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through <= 1.0.11.
- Product
- YITH Slider for page builders
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update YITH Slider for page builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Advanced Classifieds & Directory Pro: Cross-Site Request Forgery (CSRF)CVE-2025-68580 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Request Forgery.This issue affects Advanced Classifieds & Directory Pro: from n/a through <= 3.2.9.
- Product
- Advanced Classifieds & Directory Pro
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Advanced Classifieds & Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025FV Simpler SEO: Missing AuthorizationCVE-2025-68579 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Simpler SEO: from n/a through <= 1.9.6.
- Product
- FV Simpler SEO
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update FV Simpler SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Addonify: Missing AuthorizationCVE-2025-68578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Addonify Addonify addonify-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify: from n/a through <= 2.0.4.
- Product
- Addonify
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Addonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Virusdie: Missing AuthorizationCVE-2025-68577 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through <= 1.1.6.
- Product
- Virusdie
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Virusdie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Virusdie: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6.
- Product
- Virusdie
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Virusdie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Wappointment: Missing AuthorizationCVE-2025-68575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wappointment: from n/a through <= 2.7.6.
- Product
- Wappointment
- Affected
- up to 2.7.6
- What to do
- Affects up to 2.7.6. Update Wappointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WPBakery Visual Composer WHMCS Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68574 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3.
- Product
- WPBakery Visual Composer WHMCS Elements
- Affected
- up to 1.0.4.3
- What to do
- Affects up to 1.0.4.3. Update WPBakery Visual Composer WHMCS Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Simple Keyword to Link: Cross-Site Request Forgery (CSRF)CVE-2025-68573 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through <= 1.5.
- Product
- Simple Keyword to Link
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Simple Keyword to Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025BBP Core: Missing AuthorizationCVE-2025-68572 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Spider Themes BBP Core bbp-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BBP Core: from n/a through <= 1.4.1.
- Product
- BBP Core
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update BBP Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025SALESmanago & Leadoo: Missing AuthorizationCVE-2025-68571 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.9.0.
- Product
- SALESmanago & Leadoo
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Captivate Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68570 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through <= 3.2.2.
- Product
- Captivate Sync
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Captivate Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Time Slots Booking Form: Missing AuthorizationCVE-2025-68569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.39.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.2.39
- What to do
- Affects up to 1.2.39. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Claspo – Popups, Spin the Wheel & Email Capture: Missing AuthorizationCVE-2025-68568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: from n/a through <= 1.0.7.
- Product
- Claspo – Popups, Spin the Wheel & Email Capture
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Claspo – Popups, Spin the Wheel & Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025My auctions allegro: Cross-Site Request Forgery (CSRF)CVE-2025-68567 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Cross Site Request Forgery.This issue affects My auctions allegro: from n/a through <= 3.6.33.
- Product
- My auctions allegro
- Affected
- up to 3.6.33
- What to do
- Affects up to 3.6.33. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025My auctions allegro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68566 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.35.
- Product
- My auctions allegro
- Affected
- up to 3.6.35
- What to do
- Affects up to 3.6.35. Update My auctions allegro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Twitch Player: Missing AuthorizationCVE-2025-68565 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JayBee Twitch Player ttv-easy-embed-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Twitch Player: from n/a through <= 2.1.3.
- Product
- Twitch Player
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Twitch Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Subscribe to Unlock Lite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68563 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Unlock Lite subscribe-to-unlock-lite allows PHP Local File Inclusion.This issue affects Subscribe to Unlock Lite: from n/a through <= 1.3.0.
- Product
- Subscribe to Unlock Lite
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Subscribe to Unlock Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Fana: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68540 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.35.
- Product
- Fana
- Affected
- up to 1.1.35
- What to do
- Affects up to 1.1.35. Update Fana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Zota: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68537 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.14.
- Product
- Zota
- Affected
- up to 1.3.14
- What to do
- Affects up to 1.3.14. Update Zota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Sunshine Photo Cart: Missing AuthorizationCVE-2025-68535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.5.7.1
- What to do
- Affects up to 3.5.7.1. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WC Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68533 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS.This issue affects WC Builder: from n/a through <= 1.2.0.
- Product
- WC Builder
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WC Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025ModelTheme Addons for WPBakery and Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68532 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Stored XSS.This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.
- Product
- ModelTheme Addons for WPBakery and Elementor
- What to do
- Update ModelTheme Addons for WPBakery and Elementor to the newest version.
Dec 24, 2025Bookory: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68530 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Bookory bookory allows PHP Local File Inclusion.This issue affects Bookory: from n/a through <= 2.2.7.
- Product
- Bookory
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Bookory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Email Capture: Cross-Site Request Forgery (CSRF)CVE-2025-68529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.
- Product
- WP Email Capture
- Affected
- up to 3.12.5
- What to do
- Affects up to 3.12.5. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68528 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through <= 2.4.9.
- Product
- Free Shipping Bar: Amount Left for Free Shipping for WooCommerce
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Free Shipping Bar: Amount Left for Free Shipping for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Academy LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC Academy LMS academy allows Stored XSS.This issue affects Academy LMS: from n/a through <= 3.4.0.
- Product
- Academy LMS
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Category Icon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68525 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS.This issue affects Category Icon: from n/a through <= 1.0.2.
- Product
- Category Icon
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Category Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.