Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,732 results · page 231 of 815
Dec 24, 2025Spiffy Calendar: Missing AuthorizationCVE-2025-68523 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.
- Product
- Spiffy Calendar
- Affected
- up to 5.0.7
- What to do
- Affects up to 5.0.7. Update Spiffy Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WpStream: Missing AuthorizationCVE-2025-68522 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.
- Product
- WpStream
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update WpStream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WpStream: Missing AuthorizationCVE-2025-68521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.
- Product
- WpStream
- Affected
- up to 4.9.5
- What to do
- Affects up to 4.9.5. Update WpStream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Brands for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68519 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Blind SQL Injection.This issue affects Brands for WooCommerce: from n/a through <= 3.8.6.3.
- Product
- Brands for WooCommerce
- Affected
- up to 3.8.6.3
- What to do
- Affects up to 3.8.6.3. Update Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Tablesome: Missing AuthorizationCVE-2025-68517 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.35.1.
- Product
- Tablesome
- Affected
- up to 1.1.35.1
- What to do
- Affects up to 1.1.35.1. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Tablesome: Insertion of Sensitive Information Into Sent DataCVE-2025-68516 · WordPress plugins & themes · reported by PatchstackMedium 5
Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Tablesome: from n/a through <= 1.1.35.1.
- Product
- Tablesome
- Affected
- up to 1.1.35.1
- What to do
- Affects up to 1.1.35.1. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Bold Timeline Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Stored XSS.This issue affects Bold Timeline Lite: from n/a through <= 1.2.7.
- Product
- Bold Timeline Lite
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Bold Timeline Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Real 3D FlipBook: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68512 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Stored XSS.This issue affects Real 3D FlipBook: from n/a through <= 4.11.4.
- Product
- Real 3D FlipBook
- Affected
- up to 4.11.4
- What to do
- Affects up to 4.11.4. Update Real 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Gutenverse Form: Missing AuthorizationCVE-2025-68511 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through <= 2.3.1.
- Product
- Gutenverse Form
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Gutenverse Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025User Submitted Posts: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-68509 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121.
- Product
- User Submitted Posts
- Affected
- up to 20251121
- What to do
- Affects up to 20251121. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Brave: Missing AuthorizationCVE-2025-68508 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brave Brave brave-popup-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brave: from n/a through <= 0.8.3.
- Product
- Brave
- Affected
- up to 0.8.3
- What to do
- Affects up to 0.8.3. Update Brave to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Docket Cache: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68506 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cache allows PHP Local File Inclusion.This issue affects Docket Cache: from n/a through <= 24.07.03.
- Product
- Docket Cache
- Affected
- up to 24.07.03
- What to do
- Affects up to 24.07.03. Update Docket Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025H5P: Missing AuthorizationCVE-2025-68505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in icc0rz H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through <= 1.16.1.
- Product
- H5P
- Affected
- up to 1.16.1
- What to do
- Affects up to 1.16.1. Update H5P to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Prime Slider – Addons For Elementor: Server-Side Request Forgery (SSRF)CVE-2025-68500 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in bdthemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Server Side Request Forgery.This issue affects Prime Slider – Addons For Elementor: from n/a through <= 4.0.10.
- Product
- Prime Slider – Addons For Elementor
- Affected
- up to 4.0.10
- What to do
- Affects up to 4.0.10. Update Prime Slider – Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Astra Widgets: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68497 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.16.
- Product
- Astra Widgets
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update Astra Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025User Feedback: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68496 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.
- Product
- User Feedback
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Premium Addons for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68494 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.53.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.53
- What to do
- Affects up to 4.11.53. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Icegram Express Pro: Deserialization of Untrusted DataCVE-2025-68038 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Express Pro: from n/a through < 5.9.14.
- Product
- Icegram Express Pro
- What to do
- Update Icegram Express Pro to the newest version.
Dec 24, 2025Membership For WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2025-67909 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Membership For WooCommerce: from n/a through <= 3.0.3.
- Product
- Membership For WooCommerce
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Greenhouse Job Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67633 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brownbagmarketing Greenhouse Job Board greenhouse-job-board allows DOM-Based XSS.This issue affects Greenhouse Job Board: from n/a through <= 2.7.3.
- Product
- Greenhouse Job Board
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update Greenhouse Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Google AdSense for Responsive Design – GARD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67632 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design – GARD google-adsense-for-responsive-design-gard allows DOM-Based XSS.This issue affects Google AdSense for Responsive Design – GARD: from n/a through <= 2.23.
- Product
- Google AdSense for Responsive Design – GARD
- Affected
- up to 2.23
- What to do
- Affects up to 2.23. Update Google AdSense for Responsive Design – GARD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Gift Hunt: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67631 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecommerce Platforms Gift Hunt gift-hunt allows Stored XSS.This issue affects Gift Hunt: from n/a through <= 2.0.2.
- Product
- Gift Hunt
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Gift Hunt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WH Tweaks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67630 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WH Tweaks wh-tweaks allows Stored XSS.This issue affects WH Tweaks: from n/a through <= 1.0.2.
- Product
- WH Tweaks
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WH Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Basticom Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67629 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basticom Basticom Framework basticom-framework allows Stored XSS.This issue affects Basticom Framework: from n/a through <= 1.5.2.
- Product
- Basticom Framework
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Basticom Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Review Disclaimer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AMP-MODE Review Disclaimer review-disclaimer allows Stored XSS.This issue affects Review Disclaimer: from n/a through <= 2.0.3.
- Product
- Review Disclaimer
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Review Disclaimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Draft Notify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67627 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TouchOfTech Draft Notify draft-notify allows Stored XSS.This issue affects Draft Notify: from n/a through <= 1.5.
- Product
- Draft Notify
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Draft Notify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Trade Runner: Cross-Site Request Forgery (CSRF)CVE-2025-67625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: from n/a through <= 3.14.
- Product
- Trade Runner
- Affected
- up to 3.14
- What to do
- Affects up to 3.14. Update Trade Runner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 20256Storage Rentals: Server-Side Request Forgery (SSRF)CVE-2025-67623 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through <= 2.22.0.
- Product
- 6Storage Rentals
- Affected
- up to 2.22.0
- What to do
- Affects up to 2.22.0. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Evergreen Post Tweeter: Cross-Site Request Forgery (CSRF)CVE-2025-67622 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in titopandub Evergreen Post Tweeter evergreen-post-tweeter allows Stored XSS.This issue affects Evergreen Post Tweeter: from n/a through <= 1.8.9.
- Product
- Evergreen Post Tweeter
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update Evergreen Post Tweeter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Eight Day Week Print Workflow: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67621 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.
- Product
- Eight Day Week Print Workflow
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Eight Day Week Print Workflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Master Addons for Elementor: Missing AuthorizationCVE-2023-40679 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through 2.0.5.3.
- Product
- Master Addons for Elementor
- Affected
- up to 2.0.5.3
- What to do
- Affects up to 2.0.5.3. Update Master Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WPJobBoard: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-36525 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPJobBoard allows Blind SQL Injection.This issue affects WPJobBoard: from n/a through 5.9.0.
- Product
- WPJobBoard
- Affected
- up to 5.9.0
- What to do
- Affects up to 5.9.0. Update WPJobBoard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Hostel: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2023-32120 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bob Hostel allows DOM-Based XSS.This issue affects Hostel: from n/a through 1.1.5.1.
- Product
- Hostel
- Affected
- up to 1.1.5.1
- What to do
- Affects up to 1.1.5.1. Update Hostel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Resoto: Missing AuthorizationCVE-2023-28619 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bnayawpguy Resoto allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Resoto: from n/a through 1.0.8.
- Product
- Resoto
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Resoto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Gravity Forms: Does not properly prevent users from uploading dangerous files through its chunked upload functionalityCVE-2025-13407 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Gravity Forms WordPress plugin before 2.9.23.1 does not properly prevent users from uploading dangerous files through its chunked upload functionality, allowing attackers to upload PHP files to affected sites and achieve Remote Code Execution, granted they can discover or enumerate the upload path.
- Product
- Gravity Forms
- Fixed in
- 2.9.23.1
- What to do
- Update Gravity Forms to 2.9.23.1 or newer.
Dec 24, 2025Print Invoice & Delivery Notes for WooCommerce: Remote Code ExecutionCVE-2025-13773 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 23, 2025AutomatorWP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68561 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.4.
- Product
- AutomatorWP
- Affected
- up to 5.2.4
- What to do
- Affects up to 5.2.4. Update AutomatorWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025TheGem Theme Elements (for Elementor): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68560 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.
- Product
- TheGem Theme Elements (for Elementor)
- Affected
- up to 5.10.5.1
- What to do
- Affects up to 5.10.5.1. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025TheGem Theme Elements (for Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.
- Product
- TheGem Theme Elements (for Elementor)
- Affected
- up to 5.10.5.1
- What to do
- Affects up to 5.10.5.1. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025Chakra test: Missing AuthorizationCVE-2025-68557 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vikas Ratudi Chakra test chakra-test allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chakra test: from n/a through <= 1.0.1.
- Product
- Chakra test
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Chakra test to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025HAPPY: Missing AuthorizationCVE-2025-68556 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.9.
- Product
- HAPPY
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025VPSUForm: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vikas Ratudi VPSUForm v-form allows Retrieve Embedded Sensitive Data.This issue affects VPSUForm: from n/a through <= 3.2.24.
- Product
- VPSUForm
- Affected
- up to 3.2.24
- What to do
- Affects up to 3.2.24. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025WPBulky: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-68550 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme WPBulky wpbulky-wp-bulk-edit-post-types allows Blind SQL Injection.This issue affects WPBulky: from n/a through <= 1.1.13.
- Product
- WPBulky
- Affected
- up to 1.1.13
- What to do
- Affects up to 1.1.13. Update WPBulky to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025Responsive Posts Carousel Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68548 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Stored XSS.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.2.
- Product
- Responsive Posts Carousel Pro
- Affected
- up to 15.2
- What to do
- Affects up to 15.2. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025Nika: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68546 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14.
- Product
- Nika
- Affected
- up to 1.2.14
- What to do
- Affects up to 1.2.14. Update Nika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025Diza: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68544 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15.
- Product
- Diza
- Affected
- up to 1.3.15
- What to do
- Affects up to 1.3.15. Update Diza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2025-14635 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, despite the intended role restriction of Custom JS to Administrators.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.20.3
- What to do
- Affects up to 3.20.3. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 23, 2025Membership Plugin – Restrict Content: Stored Cross-Site ScriptingCVE-2025-14000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'register_form' and 'restrict' shortcodes in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Membership Plugin – Restrict Content
- Affected
- up to 3.2.15
- What to do
- Affects up to 3.2.15. Update Membership Plugin – Restrict Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 23, 2025PowerPack Pro for Elementor: Missing AuthorizationCVE-2024-24844 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Pro for Elementor: from n/a through 2.10.6.
- Product
- PowerPack Pro for Elementor
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update PowerPack Pro for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through CVE-2023-52210 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Vulnerability in Tyche softwares Product Delivery Date for WooCommerce – Lite.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.0.
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.