Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,758 results · page 244 of 816
Dec 9, 2025Simple Download Counter: Path TraversalCVE-2025-13677 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path validation in the `simple_download_counter_parse_path()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which may contain sensitive information such as database credentials (wp-config.php) or system files. Please note that the vendor opted to continue to allow remote file downloads from arbitrary locations on the server, however, has disabled this functionality on multi-sites and provided a warning to site owners in the readme.txt when they install the plugin. While not an optimal patch, we have considered this sufficient and recommend users proceed to use the plugin with caution.
- Product
- Simple Download Counter
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Simple Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025Elated Membership: Authentication BypassCVE-2025-13613 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
- Product
- Elated Membership
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Elated Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Dec 9, 2025Advanced Product Fields (Product Addons) for WooCommerce: Cross-Site Request ForgeryCVE-2025-13924 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Advanced Product Fields (Product Addons) for WooCommerce
- Affected
- up to 1.6.17
- What to do
- Affects up to 1.6.17. Update Advanced Product Fields (Product Addons) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Dec 9, 2025Spectra: Missing AuthorizationCVE-2023-23729 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.
- Product
- Spectra
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP Fast Cache: Cross-Site Request Forgery (CSRF)CVE-2023-22675 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Taylor Hawkes WP Fast Cache allows Cross Site Request Forgery.This issue affects WP Fast Cache: from n/a through 1.5.
- Product
- WP Fast Cache
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WP Fast Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025ARMember: Missing AuthorizationCVE-2022-47425 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10.
- Product
- ARMember
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update ARMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Slider a SlidersPack: Missing AuthorizationCVE-2022-46845 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Essential Plugin Slider a SlidersPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider a SlidersPack: from n/a before 2.3.
- Product
- Slider a SlidersPack
- Fixed in
- 2.3
- What to do
- Update Slider a SlidersPack to 2.3 or newer.
Dec 9, 2025WebToffee eCommerce Marketing Automation: Missing AuthorizationCVE-2025-67599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee WebToffee eCommerce Marketing Automation decorator-woocommerce-email-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebToffee eCommerce Marketing Automation: from n/a through <= 2.1.1.
- Product
- WebToffee eCommerce Marketing Automation
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update WebToffee eCommerce Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025SupportCandy: Cross-Site Request Forgery (CSRF)CVE-2025-67598 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through <= 3.4.1.
- Product
- SupportCandy
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Fluent Booking: Missing AuthorizationCVE-2025-67597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjahan Jewel Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through <= 1.9.11.
- Product
- Fluent Booking
- Affected
- up to 1.9.11
- What to do
- Affects up to 1.9.11. Update Fluent Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Business Directory: Cross-Site Request Forgery (CSRF)CVE-2025-67596 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Cross Site Request Forgery.This issue affects Business Directory: from n/a through <= 6.4.19.
- Product
- Business Directory
- Affected
- up to 6.4.19
- What to do
- Affects up to 6.4.19. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Quiz Maker: Cross-Site Request Forgery (CSRF)CVE-2025-67595 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.0.82.
- Product
- Quiz Maker
- Affected
- up to 6.7.0.82
- What to do
- Affects up to 6.7.0.82. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Thim Elementor Kit: Authorization Bypass Through User-Controlled KeyCVE-2025-67594 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thim Elementor Kit: from n/a through <= 1.3.3.
- Product
- Thim Elementor Kit
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Thim Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025UsersWP: Cross-Site Request Forgery (CSRF)CVE-2025-67593 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.48.
- Product
- UsersWP
- Affected
- up to 1.2.48
- What to do
- Affects up to 1.2.48. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025My Calendar: Missing AuthorizationCVE-2025-67592 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Calendar: from n/a through <= 3.6.16.
- Product
- My Calendar
- Affected
- up to 3.6.16
- What to do
- Affects up to 3.6.16. Update My Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025JNews Paywall: Cross-Site Request Forgery (CSRF)CVE-2025-67591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross Site Request Forgery.This issue affects JNews Paywall: from n/a through < 12.0.1.
- Product
- JNews Paywall
- What to do
- Update JNews Paywall to the newest version.
Dec 9, 2025Ultimate FAQ: Cross-Site Request Forgery (CSRF)CVE-2025-67590 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: from n/a through <= 2.4.3.
- Product
- Ultimate FAQ
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Ultimate FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2025-67589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Elementor Website Builder: Missing AuthorizationCVE-2025-67588 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.
- Product
- Elementor Website Builder
- Affected
- up to 3.33.0
- What to do
- Affects up to 3.33.0. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP Gravity Forms FreshDesk: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-67587 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
- Product
- WP Gravity Forms FreshDesk
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WP Gravity Forms FreshDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Highlight and Share: Missing AuthorizationCVE-2025-67586 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.
- Product
- Highlight and Share
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update Highlight and Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Flexmls® IDX: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-67585 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a through <= 3.15.7.
- Product
- Flexmls® IDX
- Affected
- up to 3.15.7
- What to do
- Affects up to 3.15.7. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025GoDAM: Missing AuthorizationCVE-2025-67584 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in rtCamp GoDAM godam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDAM: from n/a through <= 1.4.6.
- Product
- GoDAM
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update GoDAM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025IDonate: Missing AuthorizationCVE-2025-67583 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.
- Product
- IDonate
- Affected
- up to 2.1.15
- What to do
- Affects up to 2.1.15. Update IDonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Wbcom Designs: Missing AuthorizationCVE-2025-67582 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wbcomdesigns Wbcom Designs lock-my-bp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wbcom Designs: from n/a through <= 2.1.1.
- Product
- Wbcom Designs
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Wbcom Designs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025TrueBooker: Missing AuthorizationCVE-2025-67581 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.0.
- Product
- TrueBooker
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Constant Contact + WooCommerce: Missing AuthorizationCVE-2025-67580 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= 2.4.1.
- Product
- Constant Contact + WooCommerce
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Constant Contact + WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025User Extra Fields: Missing AuthorizationCVE-2025-67579 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.
- Product
- User Extra Fields
- Affected
- up to 16.8
- What to do
- Affects up to 16.8. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP Email Capture: Missing AuthorizationCVE-2025-67578 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Email Capture: from n/a through <= 3.12.4.
- Product
- WP Email Capture
- Affected
- up to 3.12.4
- What to do
- Affects up to 3.12.4. Update WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Easy Form Builder: Missing AuthorizationCVE-2025-67577 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.
- Product
- Easy Form Builder
- Affected
- up to 3.8.20
- What to do
- Affects up to 3.8.20. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Simple Link Directory: Missing AuthorizationCVE-2025-67576 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through <= 8.8.3.
- Product
- Simple Link Directory
- Affected
- up to 8.8.3
- What to do
- Affects up to 8.8.3. Update Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Sitewide Notice WP: Missing AuthorizationCVE-2025-67575 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sitewide Notice WP: from n/a through <= 2.4.1.
- Product
- Sitewide Notice WP
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Sitewide Notice WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2025-67574 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.30.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.30
- What to do
- Affects up to 3.2.30. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Sailing: Missing AuthorizationCVE-2025-67573 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sailing: from n/a through < 4.4.6.
- Product
- Sailing
- What to do
- Update Sailing to the newest version.
Dec 9, 2025PenNews: Missing AuthorizationCVE-2025-67572 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PenNews: from n/a through < 6.7.4.
- Product
- PenNews
- What to do
- Update PenNews to the newest version.
Dec 9, 2025WPFunnels: Missing AuthorizationCVE-2025-67571 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.
- Product
- WPFunnels
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WPForms Google Sheet Connector: Missing AuthorizationCVE-2025-67570 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.
- Product
- WPForms Google Sheet Connector
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025AdForest: Missing AuthorizationCVE-2025-67569 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdForest: from n/a through <= 6.0.11.
- Product
- AdForest
- Affected
- up to 6.0.11
- What to do
- Affects up to 6.0.11. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Basel: Missing AuthorizationCVE-2025-67568 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: from n/a through <= 5.9.1.
- Product
- Basel
- Affected
- up to 5.9.1
- What to do
- Affects up to 5.9.1. Update Basel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Sober: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67567 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This issue affects Sober: from n/a through <= 3.5.11.
- Product
- Sober
- Affected
- up to 3.5.11
- What to do
- Affects up to 3.5.11. Update Sober to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Woffice Core: Missing AuthorizationCVE-2025-67566 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.
- Product
- Woffice Core
- Affected
- up to 5.4.30
- What to do
- Affects up to 5.4.30. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Rehub: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67565 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.
- Product
- Rehub
- Affected
- up to 19.9.9.1
- What to do
- Affects up to 19.9.9.1. Update Rehub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Pixel Manager for WooCommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects Pixel Manager for WooCommerce: from n/a through <= 1.51.1.
- Product
- Pixel Manager for WooCommerce
- Affected
- up to 1.51.1
- What to do
- Affects up to 1.51.1. Update Pixel Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Post SMTP: Missing AuthorizationCVE-2025-67563 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 3.6.1.
- Product
- Post SMTP
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Image Caption Hover Pro: Missing AuthorizationCVE-2025-67562 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Caption Hover Pro: from n/a through < 20.0.
- Product
- Image Caption Hover Pro
- What to do
- Update Image Caption Hover Pro to the newest version.
Dec 9, 2025Debug Log Viewer: Missing AuthorizationCVE-2025-67561 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Oleksandr Lysyi Debug Log Viewer debug-log-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Log Viewer: from n/a through <= 2.0.3.
- Product
- Debug Log Viewer
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Debug Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Listdom: Missing AuthorizationCVE-2025-67560 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listdom: from n/a through <= 5.0.1.
- Product
- Listdom
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update Listdom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Online Booking & Scheduling Calendar for WordPress by vcita: Missing AuthorizationCVE-2025-67559 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Rencontre: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67558 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS.This issue affects Rencontre: from n/a through <= 3.13.7.
- Product
- Rencontre
- Affected
- up to 3.13.7
- What to do
- Affects up to 3.13.7. Update Rencontre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP eBay Product Feeds: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67557 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Stored XSS.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.9.
- Product
- WP eBay Product Feeds
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update WP eBay Product Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.