Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 31 of 86
Dec 16, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-67929 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
- Product
- TI WooCommerce Wishlist
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Lottier: Missing AuthorizationCVE-2025-66167 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Lottier lottier-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier: from n/a through <= 1.1.1.
- Product
- Lottier
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Lottier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Lottier for Elementor: Missing AuthorizationCVE-2025-66166 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Lottier for Elementor lottier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for Elementor: from n/a through <= 1.0.9.
- Product
- Lottier for Elementor
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Lottier for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Lottier for WPBakery: Missing AuthorizationCVE-2025-66165 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Lottier for WPBakery lottier-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for WPBakery: from n/a through <= 1.1.7.
- Product
- Lottier for WPBakery
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Lottier for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Laser: Missing AuthorizationCVE-2025-66164 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser: from n/a through <= 1.1.1.
- Product
- Laser
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Laser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Masker for Elementor: Missing AuthorizationCVE-2025-66163 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masker for Elementor: from n/a through <= 1.1.4.
- Product
- Masker for Elementor
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Masker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Spoter for Elementor: Missing AuthorizationCVE-2025-66162 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spoter for Elementor: from n/a through <= 1.04.
- Product
- Spoter for Elementor
- Affected
- up to 1.04
- What to do
- Affects up to 1.04. Update Spoter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Grider for Elementor: Missing AuthorizationCVE-2025-66161 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grider for Elementor: from n/a through <= 1.0.8.
- Product
- Grider for Elementor
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Grider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Coder for Elementor: Missing AuthorizationCVE-2025-66147 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Coder for Elementor coder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coder for Elementor: from n/a through <= 1.0.13.
- Product
- Coder for Elementor
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Coder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025FileBird Pro: Missing AuthorizationCVE-2025-66134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FileBird Pro: from n/a through <= 6.5.1.
- Product
- FileBird Pro
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update FileBird Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66133 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.7.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Yaad Sarig Payment Gateway For WC: Missing AuthorizationCVE-2025-66131 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yaad Sarig Payment Gateway For WC: from n/a through <= 2.2.11.
- Product
- Yaad Sarig Payment Gateway For WC
- Affected
- up to 2.2.11
- What to do
- Affects up to 2.2.11. Update Yaad Sarig Payment Gateway For WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Views Counter: Missing AuthorizationCVE-2025-66130 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Views Counter: from n/a through <= 2.1.2.
- Product
- WP Views Counter
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update WP Views Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Pochipp: Missing AuthorizationCVE-2025-66129 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through <= 1.18.0.
- Product
- Pochipp
- Affected
- up to 1.18.0
- What to do
- Affects up to 1.18.0. Update Pochipp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Sendinblue for WooCommerce: Missing AuthorizationCVE-2025-66128 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendinblue for WooCommerce: from n/a through <= 4.0.49.
- Product
- Sendinblue for WooCommerce
- Affected
- up to 4.0.49
- What to do
- Affects up to 4.0.49. Update Sendinblue for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Essential Real Estate: Missing AuthorizationCVE-2025-66127 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.
- Product
- Essential Real Estate
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Leaky Paywall: Missing AuthorizationCVE-2025-66124 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leaky Paywall: from n/a through <= 4.22.6.
- Product
- Leaky Paywall
- Affected
- up to 4.22.6
- What to do
- Affects up to 4.22.6. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Stylish Price List: Missing AuthorizationCVE-2025-66122 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Design Stylish Price List stylish-price-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stylish Price List: from n/a through <= 7.2.2.
- Product
- Stylish Price List
- Affected
- up to 7.2.2
- What to do
- Affects up to 7.2.2. Update Stylish Price List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025SiteGround Security: Missing AuthorizationCVE-2025-66121 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through <= 1.5.8.
- Product
- SiteGround Security
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025CatFolders: Missing AuthorizationCVE-2025-66120 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CatFolders: from n/a through <= 2.5.3.
- Product
- CatFolders
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update CatFolders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Compress for MainWP: Missing AuthorizationCVE-2025-64639 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.50.17.
- Product
- WP Compress for MainWP
- Affected
- up to 6.50.17
- What to do
- Affects up to 6.50.17. Update WP Compress for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025OnPay.io for WooCommerce: Missing AuthorizationCVE-2025-64638 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47.
- Product
- OnPay.io for WooCommerce
- Affected
- up to 1.0.47
- What to do
- Affects up to 1.0.47. Update OnPay.io for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Feeds for YouTube: Missing AuthorizationCVE-2025-64635 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Feeds for YouTube: from n/a through <= 2.4.0.
- Product
- Feeds for YouTube
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Feeds for YouTube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Avada: Missing AuthorizationCVE-2025-64634 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through <= 7.13.2.
- Product
- Avada
- Affected
- up to 7.13.2
- What to do
- Affects up to 7.13.2. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Google XML Sitemaps: Missing AuthorizationCVE-2025-64632 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google XML Sitemaps: from n/a through <= 4.1.22.
- Product
- Google XML Sitemaps
- Affected
- up to 4.1.22
- What to do
- Affects up to 4.1.22. Update Google XML Sitemaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WCFM Marketplace: Missing AuthorizationCVE-2025-64631 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.
- Product
- WCFM Marketplace
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Business Directory: Missing AuthorizationCVE-2025-64630 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.19.
- Product
- Business Directory
- Affected
- up to 6.4.19
- What to do
- Affects up to 6.4.19. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Ultimate Learning Pro: Missing AuthorizationCVE-2025-64251 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Learning Pro: from n/a through <= 3.9.3.
- Product
- Ultimate Learning Pro
- Affected
- up to 3.9.3
- What to do
- Affects up to 3.9.3. Update Ultimate Learning Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Protect WP Admin: Missing AuthorizationCVE-2025-64249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protect WP Admin: from n/a through <= 4.1.
- Product
- Protect WP Admin
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Protect WP Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Request a Quote: Missing AuthorizationCVE-2025-64248 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.
- Product
- Request a Quote
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Read More & Accordion: Missing AuthorizationCVE-2025-64247 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through <= 3.5.5.1.
- Product
- Read More & Accordion
- Affected
- up to 3.5.5.1
- What to do
- Affects up to 3.5.5.1. Update Read More & Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Accessibility by AudioEye: Missing AuthorizationCVE-2025-64246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through <= 1.0.49.
- Product
- Accessibility by AudioEye
- Affected
- up to 1.0.49
- What to do
- Affects up to 1.0.49. Update Accessibility by AudioEye to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Import external attachments: Missing AuthorizationCVE-2025-64245 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through <= 1.5.12.
- Product
- Import external attachments
- Affected
- up to 1.5.12
- What to do
- Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Restrict Elementor Widgets, Columns and Sections: Missing AuthorizationCVE-2025-64244 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Elementor Widgets, Columns and Sections: from n/a through <= 1.12.
- Product
- Restrict Elementor Widgets, Columns and Sections
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Restrict Elementor Widgets, Columns and Sections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Directory Pro: Missing AuthorizationCVE-2025-64243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.
- Product
- Directory Pro
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Easy Property Listings: Missing AuthorizationCVE-2025-64242 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.22.
- Product
- Easy Property Listings
- Affected
- up to 3.5.22
- What to do
- Affects up to 3.5.22. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Coupons and Deals: Missing AuthorizationCVE-2025-64241 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Coupons and Deals: from n/a through <= 3.2.4.
- Product
- WP Coupons and Deals
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update WP Coupons and Deals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WPS Bidouille: Missing AuthorizationCVE-2025-64238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through <= 1.33.1.
- Product
- WPS Bidouille
- Affected
- up to 1.33.1
- What to do
- Affects up to 1.33.1. Update WPS Bidouille to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Salient Core: Missing AuthorizationCVE-2025-59001 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8.
- Product
- Salient Core
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Salient Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025CM On Demand Search And Replace: Missing AuthorizationCVE-2025-54045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.5.
- Product
- CM On Demand Search And Replace
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025SKT Page Builder: Missing AuthorizationCVE-2025-54005 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SKT Page Builder: from n/a through <= 4.9.
- Product
- SKT Page Builder
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update SKT Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WCFM – Frontend Manager for WooCommerce: Missing AuthorizationCVE-2025-54004 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through <= 6.7.24.
- Product
- WCFM – Frontend Manager for WooCommerce
- Affected
- up to 6.7.24
- What to do
- Affects up to 6.7.24. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 15, 2025FileBird – WordPress Media Library Folders & File Manager: Missing authorizationCVE-2025-12900 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author level access and above, to inject global folders and reassign arbitrary media attachments to those folders under certain circumstances.
- Product
- FileBird – WordPress Media Library Folders & File Manager
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 13, 2025Easy Theme Options: Missing AuthorizationCVE-2025-14367 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Theme Options plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0. This is due to missing authorization checks in the eto_import_settings function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import arbitrary plugin settings via the 'eto_import_settings' parameter.
- Product
- Easy Theme Options
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Theme Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025Eyewear prescription form: Missing AuthorizationCVE-2025-14366 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it possible for unauthenticated attackers to create arbitrary WooCommerce products with custom names, prices, and category assignments via the 'Name', 'Price', and 'Parent' parameters.
- Product
- Eyewear prescription form
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update Eyewear prescription form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025Eyewear prescription form: Missing AuthorizationCVE-2025-14365 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing capability checks on the RemoveItems AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary WooCommerce product categories, including all of their child categories, via the 'catIds' parameter.
- Product
- Eyewear prescription form
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update Eyewear prescription form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 13, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12362 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to approve withdrawal requests, modify user point balances, and manipulate the payment processing system via the cashcred_pay_now AJAX action.
- Product
- myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program
- Affected
- up to 2.9.7
- What to do
- Affects up to 2.9.7. Update myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 12, 2025Icegram Express - Email Subscribers, Newsletters and Marketing Automation: Missing AuthorizationCVE-2025-12348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `run_action_scheduler_task` function. This makes it possible for unauthenticated attackers to execute scheduled actions early or repeatedly by guessing action IDs, potentially triggering email sends, maintenance tasks, or other privileged operations, causing unexpected state changes and resource usage.
- Product
- Icegram Express - Email Subscribers, Newsletters and Marketing Automation
- Affected
- up to 5.9.10
- What to do
- Affects up to 5.9.10. Update Icegram Express - Email Subscribers, Newsletters and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025Vimeo SimpleGallery: Missing AuthorizationCVE-2025-14170 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2. This is due to missing authorization checks on the `vimeogallery_admin` function hooked to `admin_menu`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings via the `action` parameter.
- Product
- Vimeo SimpleGallery
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Vimeo SimpleGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 11, 2025Premmerce Wishlist for WooCommerce: Missing AuthorizationCVE-2025-13440 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
- Product
- Premmerce Wishlist for WooCommerce
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Premmerce Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.