Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,822 results · page 273 of 817
Oct 22, 2025WP Smart Flexslider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49955 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rajan Vijayan WP Smart Flexslider wp-smart-flexslider allows Reflected XSS.This issue affects WP Smart Flexslider: from n/a through <= 2.5.
- Product
- WP Smart Flexslider
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update WP Smart Flexslider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP-Click-Tracker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49954 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mithra62 WP-Click-Tracker wp-click-track allows Reflected XSS.This issue affects WP-Click-Tracker: from n/a through <= 0.7.3.
- Product
- WP-Click-Tracker
- Affected
- up to 0.7.3
- What to do
- Affects up to 0.7.3. Update WP-Click-Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025ShareBang, Ultimate Social Share Buttons for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49953 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeinity ShareBang, Ultimate Social Share Buttons for WordPress sharebang allows Reflected XSS.This issue affects ShareBang, Ultimate Social Share Buttons for WordPress: from n/a through <= 1.4.
- Product
- ShareBang, Ultimate Social Share Buttons for
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update ShareBang, Ultimate Social Share Buttons for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Houzez: Authorization Bypass Through User-Controlled KeyCVE-2025-49952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.
- Product
- Houzez
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025gAppointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49951 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcrunch gAppointments gAppointments allows Reflected XSS.This issue affects gAppointments: from n/a through <= 1.14.1.
- Product
- gAppointments
- Affected
- up to 1.14.1
- What to do
- Affects up to 1.14.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Official Integration for Billingo: Missing AuthorizationCVE-2025-49950 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in billingo Official Integration for Billingo billingo allows Privilege Escalation.This issue affects Official Integration for Billingo: from n/a through <= 4.3.0.
- Product
- Official Integration for Billingo
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update Official Integration for Billingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Templazee: Missing AuthorizationCVE-2025-49949 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in templazee Templazee templazee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templazee: from n/a through <= 1.0.2.
- Product
- Templazee
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Templazee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WP Super Edit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49948 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through <= 2.5.4.
- Product
- WP Super Edit
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update WP Super Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Registration Fields Plugin - Custom Signup Fields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Reflected XSS.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.
- Product
- WooCommerce Registration Fields Plugin - Custom Signup Fields
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update WooCommerce Registration Fields Plugin - Custom Signup Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Auto Login After Registration: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49946 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cynob IT Consultancy Auto Login After Registration auto-login-after-registration allows Reflected XSS.This issue affects Auto Login After Registration: from n/a through <= 1.0.0.
- Product
- Auto Login After Registration
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Auto Login After Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Shortcode Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49945 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kylegetson Shortcode Generator shortcode-generator allows Reflected XSS.This issue affects Shortcode Generator: from n/a through <= 1.1.
- Product
- Shortcode Generator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Shortcode Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPCode Content Ratio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49944 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonatan Jumbert WPCode Content Ratio wpcode-content-ratio allows Reflected XSS.This issue affects WPCode Content Ratio: from n/a through <= 2.0.
- Product
- WPCode Content Ratio
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WPCode Content Ratio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Fusion Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49940 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Based XSS.This issue affects Fusion Builder: from n/a through <= 3.13.2.
- Product
- Fusion Builder
- Affected
- up to 3.13.2
- What to do
- Affects up to 3.13.2. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.8.
- Product
- JetElements For Elementor
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.
- Product
- JetEngine
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Smash Balloon Social Post Feed: Missing AuthorizationCVE-2025-49937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.
- Product
- Smash Balloon Social Post Feed
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update Smash Balloon Social Post Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WoodMart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49936 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through < 8.3.2.
- Product
- WoodMart
- What to do
- Update WoodMart to the newest version.
Oct 22, 2025WoodMart: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49935 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in xtemos WoodMart woodmart allows PHP Local File Inclusion.This issue affects WoodMart: from n/a through < 8.3.2.
- Product
- WoodMart
- What to do
- Update WoodMart to the newest version.
Oct 22, 2025JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49934 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.
- Product
- JetBlocks For Elementor
- Affected
- up to 1.3.18
- What to do
- Affects up to 1.3.18. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetBlog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49933 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through <= 2.4.4.
- Product
- JetBlog
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetBlog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49932 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Stored XSS.This issue affects JetBlog: from n/a through <= 2.4.4.1.
- Product
- JetBlog
- Affected
- up to 2.4.4.1
- What to do
- Affects up to 2.4.4.1. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetSearch: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49931 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injection.This issue affects JetSearch: from n/a through 3.5.10.
- Product
- JetSearch
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49930 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Reflected XSS.This issue affects JetSearch: from n/a through <= 3.5.10.
- Product
- JetSearch
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Ultimate Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows Stored XSS.This issue affects Ultimate Blocks: from n/a through <= 3.3.6.
- Product
- Ultimate Blocks
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Ultimate Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetWooBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49928 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows DOM-Based XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.
- Product
- JetWooBuilder
- Affected
- up to 2.1.20
- What to do
- Affects up to 2.1.20. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetWooBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49927 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Stored XSS.This issue affects JetWooBuilder: from n/a through <= 2.1.20.1.
- Product
- JetWooBuilder
- Affected
- up to 2.1.20.1
- What to do
- Affects up to 2.1.20.1. Update JetWooBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Kalium: Improper Control of Generation of Code ('Code Injection')CVE-2025-49926 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Control of Generation of Code ('Code Injection') vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a through <= 3.25.
- Product
- Kalium
- Affected
- up to 3.25
- What to do
- Affects up to 3.25. Update Kalium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPLMS: Missing AuthorizationCVE-2025-49925 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.
- Product
- WPLMS
- Affected
- up to 1.9.9.7
- What to do
- Affects up to 1.9.9.7. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Wholesale Suite: Incorrect Privilege AssignmentCVE-2025-49924 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through <= 2.2.4.2.
- Product
- Wholesale Suite
- Affected
- up to 2.2.4.2
- What to do
- Affects up to 2.2.4.2. Update Wholesale Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49923 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.11.1
- What to do
- Affects up to 3.11.1. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPeMatico RSS Feed Fetcher: Missing AuthorizationCVE-2025-49922 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.3.
- Product
- WPeMatico RSS Feed Fetcher
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025JetReviews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49921 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 3.0.0.
- Product
- JetReviews
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update JetReviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Web Accessibility By accessiBe: Missing AuthorizationCVE-2025-49920 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10.
- Product
- Web Accessibility By accessiBe
- Affected
- up to 2.10
- What to do
- Affects up to 2.10. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Icegram Express Pro: Server-Side Request Forgery (SSRF)CVE-2025-49917 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro: from n/a through <= 5.9.5.
- Product
- Icegram Express Pro
- Affected
- up to 5.9.5
- What to do
- Affects up to 5.9.5. Update Icegram Express Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MultiVendorX: Missing AuthorizationCVE-2025-49916 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.
- Product
- MultiVendorX
- Affected
- up to 4.2.23
- What to do
- Affects up to 4.2.23. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025SMS Alert Order Notifications: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49915 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.5.
- Product
- SMS Alert Order Notifications
- Affected
- up to 3.8.5
- What to do
- Affects up to 3.8.5. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025CoSchedule: Missing AuthorizationCVE-2025-49913 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.
- Product
- CoSchedule
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update CoSchedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Email Subscription Popup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49912 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nks Email Subscription Popup email-subscribe allows Stored XSS.This issue affects Email Subscription Popup: from n/a through <= 1.2.26.
- Product
- Email Subscription Popup
- Affected
- up to 1.2.26
- What to do
- Affects up to 1.2.26. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Vehicle Parts Finder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49911 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
- Product
- WooCommerce Vehicle Parts Finder
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WooCommerce Vehicle Parts Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPGuppy: Missing AuthorizationCVE-2025-49910 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4.
- Product
- WPGuppy
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPC Countdown Timer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49908 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4.
- Product
- WPC Countdown Timer for WooCommerce
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update WPC Countdown Timer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MDTF: Missing AuthorizationCVE-2025-49907 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.3.9.
- Product
- MDTF
- Affected
- up to 1.3.3.9
- What to do
- Affects up to 1.3.3.9. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPComplete: Missing AuthorizationCVE-2025-49906 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3.
- Product
- WPComplete
- Affected
- up to 2.9.5.3
- What to do
- Affects up to 2.9.5.3. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025ZoloBlocks: Missing AuthorizationCVE-2025-49903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in bdthemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through <= 2.3.11.
- Product
- ZoloBlocks
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update ZoloBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Simple Link Directory: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-49901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
- Product
- Simple Link Directory
- What to do
- Update Simple Link Directory to the newest version.
Oct 22, 2025Whydonate: Missing AuthorizationCVE-2025-49899 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.
- Product
- Whydonate
- Affected
- up to 4.0.15
- What to do
- Affects up to 4.0.15. Update Whydonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WooCommerce Vehicle Parts Finder: Deserialization of Untrusted DataCVE-2025-49380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.
- Product
- WooCommerce Vehicle Parts Finder
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WooCommerce Vehicle Parts Finder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Hydra Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-49378 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.
- Product
- Hydra Booking
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Hydra Booking: Missing AuthorizationCVE-2025-49377 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.
- Product
- Hydra Booking
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025DELUCKS SEO: Missing AuthorizationCVE-2025-49376 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects DELUCKS SEO: from n/a through <= 2.5.9.
- Product
- DELUCKS SEO
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.