Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,834 results · page 281 of 817
Sep 26, 2025The Tribal: Insertion of Sensitive Information Into Sent DataCVE-2025-60140 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue affects The Tribal: from n/a through <= 1.3.3.
- Product
- The Tribal
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update The Tribal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Sendle Shipping: Cross-Site Request Forgery (CSRF)CVE-2025-60139 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Cross Site Request Forgery.This issue affects Sendle Shipping: from n/a through <= 6.02.
- Product
- Sendle Shipping
- Affected
- up to 6.02
- What to do
- Affects up to 6.02. Update Sendle Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025SKT Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60138 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through <= 2.6.
- Product
- SKT Blocks
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update SKT Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Post Featured Video: Cross-Site Request Forgery (CSRF)CVE-2025-60137 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Post Featured Video post-featured-video allows Cross Site Request Forgery.This issue affects Post Featured Video: from n/a through <= 1.7.
- Product
- Post Featured Video
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Post Featured Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025User Notes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60136 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj User Notes user-notes allows Stored XSS.This issue affects User Notes: from n/a through <= 1.0.2.
- Product
- User Notes
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update User Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025PE Easy Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60133 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DJ-Extensions.com PE Easy Slider pe-easy-slider allows Stored XSS.This issue affects PE Easy Slider: from n/a through <= 1.1.0.
- Product
- PE Easy Slider
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update PE Easy Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WEDOS Global: Missing AuthorizationCVE-2025-60130 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS Global: from n/a through <= 1.2.2.
- Product
- WEDOS Global
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update WEDOS Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Yext: Missing AuthorizationCVE-2025-60129 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Yext Yext yext allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yext: from n/a through <= 1.1.3.
- Product
- Yext
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Yext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Delisho: Missing AuthorizationCVE-2025-60128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through <= 1.1.3.
- Product
- Delisho
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Delisho to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025CopySafe Web Protection: Missing AuthorizationCVE-2025-60127 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CopySafe Web Protection: from n/a through <= 5.1.
- Product
- CopySafe Web Protection
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update CopySafe Web Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Testimonial Slider: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60126 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider testimonial-add allows PHP Local File Inclusion.This issue affects Testimonial Slider: from n/a through <= 3.5.8.6.
- Product
- Testimonial Slider
- Affected
- up to 3.5.8.6
- What to do
- Affects up to 3.5.8.6. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025FoodBook: Insertion of Sensitive Information Into Sent DataCVE-2025-60125 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sensitive Data.This issue affects FoodBook: from n/a through <= 4.7.6.
- Product
- FoodBook
- Affected
- up to 4.7.6
- What to do
- Affects up to 4.7.6. Update FoodBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Simple Colorbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60124 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Colorbox simple-colorbox allows Stored XSS.This issue affects Simple Colorbox: from n/a through <= 1.6.1.
- Product
- Simple Colorbox
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Simple Colorbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025HivePress Claim Listings: Missing AuthorizationCVE-2025-60123 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.
- Product
- HivePress Claim Listings
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025HivePress Claim Listings: Missing AuthorizationCVE-2025-60122 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.
- Product
- HivePress Claim Listings
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WooEvents: Missing AuthorizationCVE-2025-60121 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooEvents: from n/a through <= 4.1.7.
- Product
- WooEvents
- Affected
- up to 4.1.7
- What to do
- Affects up to 4.1.7. Update WooEvents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WP Directory Kit: Missing AuthorizationCVE-2025-60120 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.
- Product
- WP Directory Kit
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025CoSchedule: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-60119 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.
- Product
- CoSchedule
- Affected
- up to 3.3.11
- What to do
- Affects up to 3.3.11. Update CoSchedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025PGS Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60118 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions PGS Core pgs-core allows SQL Injection.This issue affects PGS Core: from n/a through <= 5.9.0.
- Product
- PGS Core
- Affected
- up to 5.9.0
- What to do
- Affects up to 5.9.0. Update PGS Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Vehica Core: Cross-Site Request Forgery (CSRF)CVE-2025-60117 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.
- Product
- Vehica Core
- Affected
- up to 1.0.100
- What to do
- Affects up to 1.0.100. Update Vehica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Grand Conference Theme Custom Post Type: Missing AuthorizationCVE-2025-60116 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.
- Product
- Grand Conference Theme Custom Post Type
- Fixed in
- 2.6.4
- What to do
- Update Grand Conference Theme Custom Post Type to 2.6.4 or newer.
Sep 26, 2025Instapage: Cross-Site Request Forgery (CSRF)CVE-2025-60115 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin instapage allows Cross Site Request Forgery.This issue affects Instapage Plugin: from n/a through <= 3.7.0.
- Product
- Instapage
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update Instapage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025YayCurrency: Improper Control of Generation of Code ('Code Injection')CVE-2025-60114 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1.
- Product
- YayCurrency
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update YayCurrency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Groovy Menu: Cross-Site Request Forgery (CSRF)CVE-2025-60113 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through <= 1.4.3.
- Product
- Groovy Menu
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Groovy Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025aThemes Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60112 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.
- Product
- aThemes Addons for Elementor
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update aThemes Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Javo Core: Cross-Site Request Forgery (CSRF)CVE-2025-60111 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through <= 3.0.0.266.
- Product
- Javo Core
- Affected
- up to 3.0.0.266
- What to do
- Affects up to 3.0.0.266. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025AllInOne - Banner Rotator: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60110 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows SQL Injection.This issue affects AllInOne - Banner Rotator: from n/a through <= 3.8.
- Product
- AllInOne - Banner Rotator
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update AllInOne - Banner Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025LambertGroup - AllInOne - Content Slider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60109 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Content Slider
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025LambertGroup - AllInOne - Banner with Thumbnails: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60108 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Banner with Thumbnails
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025LambertGroup - AllInOne - Banner with Playlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60107 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.
- Product
- LambertGroup - AllInOne - Banner with Playlist
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025EmailKit: Missing AuthorizationCVE-2025-60106 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Roxnor EmailKit emailkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmailKit: from n/a through <= 1.6.0.
- Product
- EmailKit
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update EmailKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Ditty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60105 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.
- Product
- Ditty
- Affected
- up to 3.1.58
- What to do
- Affects up to 3.1.58. Update Ditty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Gallery Custom Links: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60104 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Custom Links gallery-custom-links allows Stored XSS.This issue affects Gallery Custom Links: from n/a through <= 2.2.5.
- Product
- Gallery Custom Links
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update Gallery Custom Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025ListingPro: Missing AuthorizationCVE-2025-60103 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.8.
- Product
- ListingPro
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WPFront User Role Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60102 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront User Role Editor wpfront-user-role-editor allows Stored XSS.This issue affects WPFront User Role Editor: from n/a through <= 4.2.3.
- Product
- WPFront User Role Editor
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update WPFront User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Woostify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60101 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through <= 2.4.2.
- Product
- Woostify
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Woostify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025XStore: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-60100 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.
- Product
- XStore
- What to do
- Update XStore to the newest version.
Sep 26, 2025Embed Any Document: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60099 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Embed Any Document embed-any-document allows Stored XSS.This issue affects Embed Any Document: from n/a through <= 2.7.7.
- Product
- Embed Any Document
- Affected
- up to 2.7.7
- What to do
- Affects up to 2.7.7. Update Embed Any Document to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Theme My Login: Missing AuthorizationCVE-2025-60098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jeff Farthing Theme My Login theme-my-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theme My Login: from n/a through <= 7.1.12.
- Product
- Theme My Login
- Affected
- up to 7.1.12
- What to do
- Affects up to 7.1.12. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025TheGem: Missing AuthorizationCVE-2025-60097 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5.
- Product
- TheGem
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update TheGem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025TheGem (Elementor): Missing AuthorizationCVE-2025-60096 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.
- Product
- TheGem (Elementor)
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update TheGem (Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Stackable: Insertion of Sensitive Information Into Sent DataCVE-2025-60095 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Retrieve Embedded Sensitive Data.This issue affects Stackable: from n/a through <= 3.18.1.
- Product
- Stackable
- Affected
- up to 3.18.1
- What to do
- Affects up to 3.18.1. Update Stackable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Stackable: Missing AuthorizationCVE-2025-60094 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through <= 3.18.1.
- Product
- Stackable
- Affected
- up to 3.18.1
- What to do
- Affects up to 3.18.1. Update Stackable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Download Manager: Cross-Site Request Forgery (CSRF)CVE-2025-60093 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager download-manager allows Cross Site Request Forgery.This issue affects Download Manager: from n/a through <= 3.3.24.
- Product
- Download Manager
- Affected
- up to 3.3.24
- What to do
- Affects up to 3.3.24. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Download Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-60092 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25.
- Product
- Download Manager
- Affected
- up to 3.3.25
- What to do
- Affects up to 3.3.25. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025wp-mpdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60040 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fkrauthan wp-mpdf wp-mpdf allows Stored XSS.This issue affects wp-mpdf: from n/a through <= 3.9.1.
- Product
- wp-mpdf
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update wp-mpdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Traveler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59012 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.3.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Sep 26, 2025Traveler: Missing AuthorizationCVE-2025-59011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Sep 26, 2025Permalink Manager Lite: Insertion of Sensitive Information Into Sent DataCVE-2025-59010 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Retrieve Embedded Sensitive Data.This issue affects Permalink Manager Lite: from n/a through <= 2.5.1.3.
- Product
- Permalink Manager Lite
- Affected
- up to 2.5.1.3
- What to do
- Affects up to 2.5.1.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025BM Content Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-59002 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
- Product
- BM Content Builder
- What to do
- Update BM Content Builder to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.