Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,273 results · page 25 of 86
Jan 22, 2026EventPrime: Missing AuthorizationCVE-2026-24380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.0.
- Product
- EventPrime
- Affected
- up to 4.2.8.0
- What to do
- Affects up to 4.2.8.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026BA Book Everything: Missing AuthorizationCVE-2026-24371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through <= 1.8.16.
- Product
- BA Book Everything
- Affected
- up to 1.8.16
- What to do
- Affects up to 1.8.16. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026The Grid: Missing AuthorizationCVE-2026-24368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
- Product
- The Grid
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026YITH WooCommerce Request A Quote: Missing AuthorizationCVE-2026-24366 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through <= 2.46.0.
- Product
- YITH WooCommerce Request A Quote
- Affected
- up to 2.46.0
- What to do
- Affects up to 2.46.0. Update YITH WooCommerce Request A Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Quiz And Survey Master: Missing AuthorizationCVE-2026-24358 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.3.
- Product
- Quiz And Survey Master
- Affected
- up to 10.3.3
- What to do
- Affects up to 10.3.3. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Recipe Maker: Missing AuthorizationCVE-2026-24357 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Recipe Maker: from n/a through <= 10.2.4.
- Product
- WP Recipe Maker
- Affected
- up to 10.2.4
- What to do
- Affects up to 10.2.4. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026GetGenie: Missing AuthorizationCVE-2026-24356 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Roxnor GetGenie getgenie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetGenie: from n/a through <= 4.3.0.
- Product
- GetGenie
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update GetGenie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026User Registration: Missing AuthorizationCVE-2026-24353 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.9.
- Product
- User Registration
- Affected
- up to 4.4.9
- What to do
- Affects up to 4.4.9. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Golo: Missing AuthorizationCVE-2026-23974 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5.
- Product
- Golo
- What to do
- Update Golo to the newest version.
Jan 22, 2026BD Courier Order Ratio Checker: Missing AuthorizationCVE-2026-22481 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rasedul Haque Rumi BD Courier Order Ratio Checker bd-courier-order-ratio-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BD Courier Order Ratio Checker: from n/a through <= 2.0.1.
- Product
- BD Courier Order Ratio Checker
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update BD Courier Order Ratio Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Easy Form Builder: Missing AuthorizationCVE-2026-22472 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.9.6.
- Product
- Easy Form Builder
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Absolute Addons For Elementor: Missing AuthorizationCVE-2026-22468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AbsolutePlugins Absolute Addons For Elementor absolute-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Absolute Addons For Elementor: from n/a through <= 1.0.14.
- Product
- Absolute Addons For Elementor
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP MapIt: Missing AuthorizationCVE-2026-22466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Chandni Patel WP MapIt wp-mapit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP MapIt: from n/a through <= 3.0.3.
- Product
- WP MapIt
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update WP MapIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026CTX Feed: Missing AuthorizationCVE-2026-22461 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebAppick CTX Feed webappick-product-feed-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CTX Feed: from n/a through <= 6.6.18.
- Product
- CTX Feed
- Affected
- up to 6.6.18
- What to do
- Affects up to 6.6.18. Update CTX Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Wanderland: Missing AuthorizationCVE-2026-22458 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mikado-Themes Wanderland wanderland allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wanderland: from n/a through <= 1.5.
- Product
- Wanderland
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Wanderland to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Don Peppe: Missing AuthorizationCVE-2026-22450 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Don Peppe: from n/a through <= 1.3.
- Product
- Don Peppe
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Don Peppe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Prowess: Missing AuthorizationCVE-2026-22447 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Select-Themes Prowess prowess allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prowess: from n/a through <= 1.8.1.
- Product
- Prowess
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Prowess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Apimo Connector: Missing AuthorizationCVE-2026-22445 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.
- Product
- Apimo Connector
- Affected
- up to 2.6.5.2
- What to do
- Affects up to 2.6.5.2. Update Apimo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Civic Cookie Control: Missing AuthorizationCVE-2026-22348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Civic Cookie Control: from n/a through <= 1.53.
- Product
- Civic Cookie Control
- Affected
- up to 1.53
- What to do
- Affects up to 1.53. Update Civic Cookie Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2025-69315 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.15.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.9.15
- What to do
- Affects up to 1.6.9.15. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026PostX: Missing AuthorizationCVE-2025-69313 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 5.0.3.
- Product
- PostX
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Broadstreet Ads: Missing AuthorizationCVE-2025-69311 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstreet Ads: from n/a through <= 1.52.1.
- Product
- Broadstreet Ads
- Affected
- up to 1.52.1
- What to do
- Affects up to 1.52.1. Update Broadstreet Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Premium Addons for Elementor: Missing AuthorizationCVE-2025-69300 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.63.
- Product
- Premium Addons for Elementor
- Affected
- up to 4.11.63
- What to do
- Affects up to 4.11.63. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Membership: Missing AuthorizationCVE-2025-69193 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.4.
- Product
- WP Membership
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update WP Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Real Estate Pro: Missing AuthorizationCVE-2025-69192 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Pro: from n/a through <= 2.1.5.
- Product
- Real Estate Pro
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Real Estate Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026ListingHub: Missing AuthorizationCVE-2025-69191 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingHub: from n/a through <= 1.2.7.
- Product
- ListingHub
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update ListingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Listihub: Missing AuthorizationCVE-2025-69190 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through <= 1.0.6.
- Product
- Listihub
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Listihub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026fitness-trainer: Missing AuthorizationCVE-2025-69188 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fitness-trainer: from n/a through <= 1.7.1.
- Product
- fitness-trainer
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update fitness-trainer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Final User: Missing AuthorizationCVE-2025-69187 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through <= 1.2.5.
- Product
- Final User
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Final User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-69186 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
- Product
- Hospital Doctor Directory
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hotel Listing: Missing AuthorizationCVE-2025-69185 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.
- Product
- Hotel Listing
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Hotel Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Institutions Directory: Missing AuthorizationCVE-2025-69184 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3.4.
- Product
- Institutions Directory
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Lawyer Directory: Missing AuthorizationCVE-2025-69181 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.4.
- Product
- Lawyer Directory
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Workreap Core: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-69101 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from n/a through <= 3.4.1.
- Product
- Workreap Core
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Workreap Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Reservation: Missing AuthorizationCVE-2025-69095 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.
- Product
- Reservation
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Registration & Login with Mobile Phone Number for WooCommerce: Missing AuthorizationCVE-2025-69052 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registration & Login with Mobile Phone Number for WooCommerce: from n/a through <= 1.3.1.
- Product
- Registration & Login with Mobile Phone Number for WooCommerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Registration & Login with Mobile Phone Number for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Solace: Missing AuthorizationCVE-2025-68911 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in solacewp Solace solace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Solace: from n/a through <= 2.1.16.
- Product
- Solace
- Affected
- up to 2.1.16
- What to do
- Affects up to 2.1.16. Update Solace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WDV One Page Docs: Missing AuthorizationCVE-2025-68896 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vrpr WDV One Page Docs wdv-one-page-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WDV One Page Docs: from n/a through <= 1.2.4.
- Product
- WDV One Page Docs
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update WDV One Page Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Scalenut: Missing AuthorizationCVE-2025-68882 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Scalenut Scalenut scalenut allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scalenut: from n/a through <= 1.1.5.
- Product
- Scalenut
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Scalenut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Depicter Slider: Missing AuthorizationCVE-2025-68558 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through <= 4.0.4.
- Product
- Depicter Slider
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Depicter Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Icegram: Missing AuthorizationCVE-2025-68507 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35.
- Product
- Icegram
- Affected
- up to 3.1.35
- What to do
- Affects up to 3.1.35. Update Icegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-68073 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Easy Property Listings: Missing AuthorizationCVE-2025-68072 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.
- Product
- Easy Property Listings
- Affected
- up to 3.5.20
- What to do
- Affects up to 3.5.20. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hotel Listing: Missing AuthorizationCVE-2025-68059 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.
- Product
- Hotel Listing
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Hotel Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Institutions Directory: Missing AuthorizationCVE-2025-68058 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3..4.
- Product
- Institutions Directory
- Affected
- up to 1.3..4
- What to do
- Affects up to 1.3..4. Update Institutions Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hospital Doctor Directory: Missing AuthorizationCVE-2025-68057 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.
- Product
- Hospital Doctor Directory
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Hospital Doctor Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP BackItUp: Missing AuthorizationCVE-2025-68039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: from n/a through <= 2.1.0.
- Product
- WP BackItUp
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP BackItUp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Notifier: Missing AuthorizationCVE-2025-68020 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.13.
- Product
- Notifier
- Affected
- up to 2.7.13
- What to do
- Affects up to 2.7.13. Update Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026SEO Booster: Missing AuthorizationCVE-2025-68019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.
- Product
- SEO Booster
- Affected
- up to 6.1.8
- What to do
- Affects up to 6.1.8. Update SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Order Listener for WooCommerce: Missing AuthorizationCVE-2025-68018 · WordPress plugins & themes · reported by PatchstackCritical 9.4
Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1.
- Product
- Order Listener for WooCommerce
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Order Listener for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.