Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,273 results · page 26 of 86
Jan 22, 2026onepay Payment Gateway For WooCommerce: Missing AuthorizationCVE-2025-68016 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooCommerce: from n/a through <= 1.1.2.
- Product
- onepay Payment Gateway For WooCommerce
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update onepay Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Payment Gateway Authorize.Net CIM for WooCommerce: Missing AuthorizationCVE-2025-68013 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.
- Product
- Payment Gateway Authorize.Net CIM for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Payment Gateway Authorize.Net CIM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Slider Templates: Missing AuthorizationCVE-2025-68009 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3.
- Product
- Slider Templates
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Slider Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Event Espresso 4 Decaf: Missing AuthorizationCVE-2025-68007 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.37.decaf.
- Product
- Event Espresso 4 Decaf
- Affected
- up to 5.0.37.decaf
- What to do
- Affects up to 5.0.37.decaf. Update Event Espresso 4 Decaf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Shown Connector: Missing AuthorizationCVE-2025-68003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.
- Product
- Shown Connector
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Shown Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Lawyer Directory: Missing AuthorizationCVE-2025-67967 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.
- Product
- Lawyer Directory
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Lawyer Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026TaxCloud for WooCommerce: Missing AuthorizationCVE-2025-67958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TaxCloud for WooCommerce: from n/a through <= 8.3.8.
- Product
- TaxCloud for WooCommerce
- Affected
- up to 8.3.8
- What to do
- Affects up to 8.3.8. Update TaxCloud for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026User Registration: Missing AuthorizationCVE-2025-67956 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.6.
- Product
- User Registration
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Peach Payments Gateway: Missing AuthorizationCVE-2025-67942 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.
- Product
- Peach Payments Gateway
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Peach Payments Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Tickera: Missing AuthorizationCVE-2025-67939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.2.
- Product
- Tickera
- Affected
- up to 3.5.6.2
- What to do
- Affects up to 3.5.6.2. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Crumber: Missing AuthorizationCVE-2025-66143 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through <= 1.0.10.
- Product
- Crumber
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Crumber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Comparimager for Elementor: Missing AuthorizationCVE-2025-66142 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comparimager for Elementor: from n/a through <= 1.0.1.
- Product
- Comparimager for Elementor
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Comparimager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Scroller: Missing AuthorizationCVE-2025-66141 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a through <= 2.0.2.
- Product
- Scroller
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Scroller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Uper for Elementor: Missing AuthorizationCVE-2025-66140 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.
- Product
- Uper for Elementor
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Uper for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Audier For Elementor: Missing AuthorizationCVE-2025-66139 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.
- Product
- Audier For Elementor
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Audier For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Motionger for Elementor: Missing AuthorizationCVE-2025-66138 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motionger for Elementor: from n/a through <= 2.0.4.
- Product
- Motionger for Elementor
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Motionger for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Searcher for Elementor: Missing AuthorizationCVE-2025-66137 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.
- Product
- Searcher for Elementor
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Searcher for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Carter for Elementor: Missing AuthorizationCVE-2025-66136 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2.
- Product
- Carter for Elementor
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Carter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Imager for Elementor: Missing AuthorizationCVE-2025-66135 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4.
- Product
- Imager for Elementor
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Imager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Bard: Missing AuthorizationCVE-2025-63018 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wproyal Bard bard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bard: from n/a through <= 2.229.
- Product
- Bard
- Affected
- up to 2.229
- What to do
- Affects up to 2.229. Update Bard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Payment Gateway bKash for WC: Missing AuthorizationCVE-2025-62754 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway bKash for WC: from n/a through <= 3.1.0.
- Product
- Payment Gateway bKash for WC
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Payment Gateway bKash for WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP-CRM System: Missing AuthorizationCVE-2025-62106 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.5.
- Product
- WP-CRM System
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Electron: Missing AuthorizationCVE-2025-5805 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ninetheme Electron electron allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electron: from n/a through <= 1.8.2.
- Product
- Electron
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update Electron to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026xSmart: Missing AuthorizationCVE-2025-54002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects xSmart: from n/a through <= 1.2.9.4.
- Product
- xSmart
- Affected
- up to 1.2.9.4
- What to do
- Affects up to 1.2.9.4. Update xSmart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026HomeLancer: Missing AuthorizationCVE-2025-49375 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeLancer: from n/a through <= 1.0.1.
- Product
- HomeLancer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update HomeLancer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 17, 2026PAYGENT for WooCommerce: Missing AuthorizationCVE-2025-14078 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PAYGENT for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.6. This is due to missing authorization checks on the paygent_check_webhook function combined with the paygent_permission_callback function unconditionally returning true on line 199. This makes it possible for unauthenticated attackers to manipulate payment callbacks and modify order statuses by sending forged payment notifications via the `/wp-json/paygent/v1/check/` endpoint.
- Product
- PAYGENT for WooCommerce
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update PAYGENT for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 17, 2026User Registration Using Contact Form 7: Unauthorized access of dataCVE-2025-12825 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_form_data' function in all versions up to, and including, 2.5. This makes it possible for unauthenticated attackers to retrieve form settings which includes Facebook app secrets.
- Product
- User Registration Using Contact Form 7
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update User Registration Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2026Membership Plugin – Restrict Content: Missing AuthenticationCVE-2025-14844 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp_stripe_create_setup_intent_for_saved_card' function due to missing capability check. Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership.
- Product
- Membership Plugin – Restrict Content
- Affected
- up to 3.2.16
- What to do
- Affects up to 3.2.16. Update Membership Plugin – Restrict Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcwe.mitre.orgdocs.stripe.com
Jan 16, 2026Booking Calendar: Missing Authorization leading to Sensitive Information ExposureCVE-2025-14982 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all booking records in the database, including personally identifiable information (PII) such as names, email addresses, phone numbers, physical addresses, payment status, booking costs, and booking hashes belonging to other users.
- Product
- Booking Calendar
- Affected
- up to 10.14.11
- What to do
- Affects up to 10.14.11. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 15, 2026process_upload.php due to missing file type validation: Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file uploadCVE-2011-10041 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.
- Product
- process_upload.php due to missing file type validation
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update process_upload.php due to missing file type validation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstorm.newswpscan.com
Jan 14, 2026Perfit WooCommerce: Missing AuthorizationCVE-2025-14173 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Perfit WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. This is due to missing authorization checks on the `logout` function called via the `actions` function hooked to `admin_init`. This makes it possible for unauthenticated attackers to delete arbitrary plugin settings via the `action` parameter.
- Product
- Perfit WooCommerce
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Perfit WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 13, 2026Dreamer Blog: Is vulnerable to arbitrary installations due to a missing capability checkCVE-2025-10915 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.
- Product
- Dreamer Blog
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Dreamer Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2026WP Page Permalink Extension: Missing AuthorizationCVE-2025-14172 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the `cwpp_trigger_flush_rewrite_rules` function hooked to `wp_ajax_cwpp_trigger_flush_rewrite_rules`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to flush the site's rewrite rules via the `action` parameter.
- Product
- WP Page Permalink Extension
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update WP Page Permalink Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 9, 2026Frontend Admin by DynamiApps: Missing authorization to unauthorized data modification and deletionCVE-2025-14741 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on the 'delete_object' function in all versions up to, and including, 3.28.25. This makes it possible for unauthenticated attackers to delete arbitrary posts, pages, products, taxonomy terms, and user accounts.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.28.25
- What to do
- Affects up to 3.28.25. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 8, 2026Block Slider: Missing AuthorizationCVE-2026-22522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Munir Kamal Block Slider block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Block Slider: from n/a through <= 2.2.3.
- Product
- Block Slider
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Block Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026GA4WP: Google Analytics for: Missing AuthorizationCVE-2026-22517 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through <= 2.10.0.
- Product
- GA4WP: Google Analytics for
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update GA4WP: Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Docket Cache: Missing AuthorizationCVE-2026-22492 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nawawi Jamili Docket Cache docket-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Docket Cache: from n/a through <= 24.07.04.
- Product
- Docket Cache
- Affected
- up to 24.07.04
- What to do
- Affects up to 24.07.04. Update Docket Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Bulk Landing Page Creator for WordPress LPagery: Missing AuthorizationCVE-2026-22490 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Landing Page Creator for WordPress LPagery: from n/a through <= 2.4.9.
- Product
- Bulk Landing Page Creator for WordPress LPagery
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Bulk Landing Page Creator for WordPress LPagery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Dashboard Welcome for Beaver Builder: Missing AuthorizationCVE-2026-22488 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Welcome for Beaver Builder: from n/a through <= 1.0.8.
- Product
- Dashboard Welcome for Beaver Builder
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Dashboard Welcome for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Speed Kit: Missing AuthorizationCVE-2026-22487 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in baqend Speed Kit baqend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Speed Kit: from n/a through <= 2.0.2.
- Product
- Speed Kit
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Speed Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Re Gallery: Missing AuthorizationCVE-2026-22486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Re Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Re Gallery: from n/a through 1.18.9.
- Product
- Re Gallery
- Affected
- up to 1.18.9
- What to do
- Affects up to 1.18.9. Update Re Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Zorka: Missing AuthorizationCVE-2026-0676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: from n/a through <= 1.5.7.
- Product
- Zorka
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Zorka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Campaign Monitor for: Missing AuthorizationCVE-2026-0674 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Campaign Monitor for WordPress: from n/a through 2.9.1.
- Product
- Campaign Monitor for
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Campaign Monitor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Fluent Support: Missing AuthorizationCVE-2025-67926 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.10.4.
- Product
- Fluent Support
- Affected
- up to 1.10.4
- What to do
- Affects up to 1.10.4. Update Fluent Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Traveler: Missing AuthorizationCVE-2025-67917 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
- Product
- Traveler
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Timetics: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-67915 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.
- Product
- Timetics
- Affected
- up to 1.0.46
- What to do
- Affects up to 1.0.46. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Aruba HiSpeed Cache: Missing AuthorizationCVE-2025-67913 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Aruba HiSpeed Cache: from n/a through < 3.0.3.
- Product
- Aruba HiSpeed Cache
- What to do
- Update Aruba HiSpeed Cache to the newest version.
Jan 8, 2026Felan Framework: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-23504 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.
- Product
- Felan Framework
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026WP Attractive Donations System - Easy Stripe & Paypal donations: Missing AuthorizationCVE-2025-22715 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.
- Product
- WP Attractive Donations System - Easy Stripe & Paypal donations
- Affected
- up to 1.25
- What to do
- Affects up to 1.25. Update WP Attractive Donations System - Easy Stripe & Paypal donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Blockons: Missing AuthorizationCVE-2025-14360 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: from n/a through <= 1.2.19.
- Product
- Blockons
- Affected
- up to 1.2.19
- What to do
- Affects up to 1.2.19. Update Blockons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.