Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
296 results · page 3 of 6
Jan 22, 2026Homey Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67964 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.
- Product
- Homey Core
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Homey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through <= 1.7.06.
- Product
- WorkScout-Core
- Affected
- up to 1.7.06
- What to do
- Affects up to 1.7.06. Update WorkScout-Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Listivo Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67957 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File Inclusion.This issue affects Listivo Core: from n/a through <= 2.3.77.
- Product
- Listivo Core
- Affected
- up to 2.3.77
- What to do
- Affects up to 2.3.77. Update Listivo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026MyHome Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67955 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP MyHome Core myhome-core allows PHP Local File Inclusion.This issue affects MyHome Core: from n/a through <= 4.1.0.
- Product
- MyHome Core
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026JupiterX Core: Deserialization of Untrusted DataCVE-2025-50004 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.
- Product
- JupiterX Core
- Affected
- up to 4.10.1
- What to do
- Affects up to 4.10.1. Update JupiterX Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Listeo Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67932 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through < 2.0.19.
- Product
- Listeo Core
- What to do
- Update Listeo Core to the newest version.
Jan 8, 2026Woffice Core: Authorization Bypass Through User-Controlled KeyCVE-2025-67919 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.
- Product
- Woffice Core
- Affected
- up to 5.4.30
- What to do
- Affects up to 5.4.30. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026Thim Core: Cross-Site Request Forgery (CSRF)CVE-2025-53344 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3.
- Product
- Thim Core
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Thim Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2026Machic Core: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2023-49186 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This issue affects Machic Core: from n/a through 1.2.6.
- Product
- Machic Core
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Machic Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Core Web Vitals & PageSpeed Booster: Missing AuthorizationCVE-2025-62144 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mohammed Kaludi Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through <= 1.0.28.
- Product
- Core Web Vitals & PageSpeed Booster
- Affected
- up to 1.0.28
- What to do
- Affects up to 1.0.28. Update Core Web Vitals & PageSpeed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64190 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through < 5.6.
- Product
- XStore Core
- What to do
- Update XStore Core to the newest version.
Dec 30, 2025WBC907 Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63027 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcreations907 WBC907 Core wbc907-core allows Stored XSS.This issue affects WBC907 Core: from n/a through <= 3.4.1.
- Product
- WBC907 Core
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update WBC907 Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025DesignThemes Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68978 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.
- Product
- DesignThemes Core
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update DesignThemes Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025BBP Core: Missing AuthorizationCVE-2025-68572 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Spider Themes BBP Core bbp-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BBP Core: from n/a through <= 1.4.1.
- Product
- BBP Core
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update BBP Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64189 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through < 5.6.
- Product
- XStore Core
- What to do
- Update XStore Core to the newest version.
Dec 18, 2025Javo Core: Improper Control of Generation of Code ('Code Injection')CVE-2025-60068 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in javothemes Javo Core javo-core allows Code Injection.This issue affects Javo Core: from n/a through <= 3.0.0.266.
- Product
- Javo Core
- Affected
- up to 3.0.0.266
- What to do
- Affects up to 3.0.0.266. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Javo Core: Missing AuthorizationCVE-2025-58877 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.529.
- Product
- Javo Core
- Affected
- up to 3.0.0.529
- What to do
- Affects up to 3.0.0.529. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Stockholm Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68076 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored XSS.This issue affects Stockholm Core: from n/a through <= 2.4.6.
- Product
- Stockholm Core
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Stockholm Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Stockholm Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68067 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm Core stockholm-core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through <= 2.4.6.
- Product
- Stockholm Core
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Stockholm Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Hub Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68065 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local File Inclusion. This issue affects Hub Core: from n/a before 6.0.2.
- Product
- Hub Core
- Fixed in
- 6.0.2
- What to do
- Update Hub Core to 6.0.2 or newer.
Dec 16, 2025Homey Core: Missing AuthorizationCVE-2025-67965 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.
- Product
- Homey Core
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Homey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Salient Core: Missing AuthorizationCVE-2025-59001 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8.
- Product
- Salient Core
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Salient Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 11, 2025IMAQ Core: Cross-Site Request ForgeryCVE-2025-13363 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the URL structure settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's URL structure settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- IMAQ Core
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update IMAQ Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025Woffice Core: Missing AuthorizationCVE-2025-67566 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.
- Product
- Woffice Core
- Affected
- up to 5.4.30
- What to do
- Affects up to 5.4.30. Update Woffice Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Walker Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67552 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WalkerWP Walker Core walker-core allows DOM-Based XSS.This issue affects Walker Core: from n/a through <= 1.3.17.
- Product
- Walker Core
- Affected
- up to 1.3.17
- What to do
- Affects up to 1.3.17. Update Walker Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Select Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Select Core select-core allows DOM-Based XSS.This issue affects Select Core: from n/a through < 2.6.
- Product
- Select Core
- What to do
- Update Select Core to the newest version.
Dec 9, 2025Select Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67521 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Select Core select-core allows PHP Local File Inclusion.This issue affects Select Core: from n/a through < 2.6.
- Product
- Select Core
- What to do
- Update Select Core to the newest version.
Dec 9, 2025UDesign Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63062 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AndonDesign UDesign Core u-design-core allows PHP Local File Inclusion.This issue affects UDesign Core: from n/a through <= 4.14.0.
- Product
- UDesign Core
- Affected
- up to 4.14.0
- What to do
- Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Ronneby Theme Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-63037 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows DOM-Based XSS.This issue affects Ronneby Theme Core: from n/a through <= 1.5.68.
- Product
- Ronneby Theme Core
- Affected
- up to 1.5.68
- What to do
- Affects up to 1.5.68. Update Ronneby Theme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Ronneby Theme Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63036 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows PHP Local File Inclusion.This issue affects Ronneby Theme Core: from n/a through <= 1.5.68.
- Product
- Ronneby Theme Core
- Affected
- up to 1.5.68
- What to do
- Affects up to 1.5.68. Update Ronneby Theme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Hercules Core: Server-Side Request Forgery (SSRF)CVE-2025-63010 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in ThemesInflow Hercules Core hercules-core allows Server Side Request Forgery.This issue affects Hercules Core : from n/a through <= 7.4.
- Product
- Hercules Core
- Affected
- up to 7.4
- What to do
- Affects up to 7.4. Update Hercules Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025ThemeRain Core: Missing AuthorizationCVE-2025-62100 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themerain ThemeRain Core themerain-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeRain Core: from n/a through <= 1.1.9.
- Product
- ThemeRain Core
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update ThemeRain Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2025StreamTube Core: Arbitrary User Password ChangeCVE-2025-13615 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if the 'registration password fields' enabled in theme options.
- Product
- StreamTube Core
- Affected
- up to 4.78
- What to do
- Affects up to 4.78. Update StreamTube Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Nov 21, 2025Zegen Core: Cross-Site Request Forgery to Arbitrary File UploadCVE-2025-11087 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due to missing nonce validation and missing file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Zegen Core
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Zegen Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Nov 13, 2025Comment Edit Core – Simple Comment Editing: Sensitive Information ExposureCVE-2025-12681 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0 via the 'ajax_get_comment' function. This makes it possible for unauthenticated attackers to extract sensitive data including user IDs, IP addresses, and email addresses.
- Product
- Comment Edit Core – Simple Comment Editing
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Comment Edit Core – Simple Comment Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 10, 2025Mementor Core: Privilege EscalationCVE-2025-11168 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality.
- Product
- Mementor Core
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update Mementor Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 6, 2025UDesign Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-62051 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign Core u-design-core.This issue affects UDesign Core: from n/a through <= 4.14.1.
- Product
- UDesign Core
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Miraculous Core: Authorization Bypass Through User-Controlled KeyCVE-2025-58627 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
- Product
- Miraculous Core
- What to do
- Update Miraculous Core to the newest version.
Nov 3, 2025Doccure Core: Privilege escalationCVE-2025-8900 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
- Product
- Doccure Core
- What to do
- Update Doccure Core to the newest version.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 29, 2025Rey Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64220 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReyCommerce Rey Core rey-core allows Stored XSS.This issue affects Rey Core: from n/a through <= 3.1.8.
- Product
- Rey Core
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update Rey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Goodlayers Core: Incorrect Privilege AssignmentCVE-2025-59580 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in GoodLayers Goodlayers Core goodlayers-core allows Privilege Escalation.This issue affects Goodlayers Core: from n/a through < 2.1.7.
- Product
- Goodlayers Core
- What to do
- Update Goodlayers Core to the newest version.
Oct 22, 2025WorkScout-Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-59571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through < 1.7.06.
- Product
- WorkScout-Core
- What to do
- Update WorkScout-Core to the newest version.
Oct 22, 2025UDesign Core: Missing AuthorizationCVE-2025-53236 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in AndonDesign UDesign Core u-design-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UDesign Core: from n/a through <= 4.14.0.
- Product
- UDesign Core
- Affected
- up to 4.14.0
- What to do
- Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025UDesign Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53234 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign Core u-design-core allows Reflected XSS.This issue affects UDesign Core: from n/a through <= 4.14.0.
- Product
- UDesign Core
- Affected
- up to 4.14.0
- What to do
- Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2025Truelysell Core: Arbitrary User Password ChangeCVE-2025-10742 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.
- Product
- Truelysell Core
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Truelysell Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 15, 2025Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity: Privilege escalationCVE-2025-6042 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.0. This is due to the plugin assigning the editor role by default. While limitations with respect to capabilities are put in place, use of the API is not restricted. This vulnerability can be leveraged together with CVE-2025-6038 to obtain admin privileges.
- Product
- Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Oct 9, 2025Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity: Privilege escalationCVE-2025-6038 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including those of administrators.
- Product
- Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Sep 26, 2025PGS Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60118 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions PGS Core pgs-core allows SQL Injection.This issue affects PGS Core: from n/a through <= 5.9.0.
- Product
- PGS Core
- Affected
- up to 5.9.0
- What to do
- Affects up to 5.9.0. Update PGS Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Vehica Core: Cross-Site Request Forgery (CSRF)CVE-2025-60117 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.
- Product
- Vehica Core
- Affected
- up to 1.0.100
- What to do
- Affects up to 1.0.100. Update Vehica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Javo Core: Cross-Site Request Forgery (CSRF)CVE-2025-60111 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through <= 3.0.0.266.
- Product
- Javo Core
- Affected
- up to 3.0.0.266
- What to do
- Affects up to 3.0.0.266. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.