Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 33 of 86
Dec 9, 2025Porto Theme - Functionality: Missing AuthorizationCVE-2025-63067 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3.
- Product
- Porto Theme - Functionality
- What to do
- Update Porto Theme - Functionality to the newest version.
Dec 9, 2025Yandex.Metrica: Missing AuthorizationCVE-2025-63063 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Yandex Metrika Yandex.Metrica wp-yandex-metrika allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yandex.Metrica: from n/a through <= 1.2.2.
- Product
- Yandex.Metrica
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Yandex.Metrica to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Contact Form by BestWebSoft: Missing AuthorizationCVE-2025-63056 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bestwebsoft Contact Form by BestWebSoft contact-form-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by BestWebSoft: from n/a through <= 4.3.6.
- Product
- Contact Form by BestWebSoft
- Affected
- up to 4.3.6
- What to do
- Affects up to 4.3.6. Update Contact Form by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Quiz And Survey Master: Missing AuthorizationCVE-2025-63054 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.2.
- Product
- Quiz And Survey Master
- Affected
- up to 10.3.2
- What to do
- Affects up to 10.3.2. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025ListingPro Lead Form: Missing AuthorizationCVE-2025-63049 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.
- Product
- ListingPro Lead Form
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update ListingPro Lead Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025ListingPro: Missing AuthorizationCVE-2025-63047 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.
- Product
- ListingPro
- Affected
- up to 2.9.9
- What to do
- Affects up to 2.9.9. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Page View Count: Missing AuthorizationCVE-2025-63034 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Steve Truman Page View Count page-views-count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page View Count: from n/a through <= 2.9.0.
- Product
- Page View Count
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update Page View Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Traveler: Missing AuthorizationCVE-2025-63028 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
- Product
- Traveler
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Xagio SEO: Missing AuthorizationCVE-2025-63025 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xagio SEO Xagio SEO xagio-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xagio SEO: from n/a through <= 7.1.0.37.
- Product
- Xagio SEO
- Affected
- up to 7.1.0.37
- What to do
- Affects up to 7.1.0.37. Update Xagio SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-63024 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.3.1.
- Product
- Order Delivery Date for WooCommerce
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Payment Gateway for PayPal on WooCommerce: Missing AuthorizationCVE-2025-63023 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Easy Payment Payment Gateway for PayPal on WooCommerce woo-paypal-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway for PayPal on WooCommerce: from n/a through <= 9.0.53.
- Product
- Payment Gateway for PayPal on WooCommerce
- Affected
- up to 9.0.53
- What to do
- Affects up to 9.0.53. Update Payment Gateway for PayPal on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WooCommerce Payment Gateway - Paysera: Missing AuthorizationCVE-2025-63015 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through <= 3.10.0.
- Product
- WooCommerce Payment Gateway - Paysera
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update WooCommerce Payment Gateway - Paysera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP ERP: Missing AuthorizationCVE-2025-63008 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.16.7.
- Product
- WP ERP
- Affected
- up to 1.16.7
- What to do
- Affects up to 1.16.7. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025EventPrime: Missing AuthorizationCVE-2025-63006 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.4.1.
- Product
- EventPrime
- Affected
- up to 4.2.4.1
- What to do
- Affects up to 4.2.4.1. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Litho Addons: Missing AuthorizationCVE-2025-62999 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through <= 3.5.
- Product
- Litho Addons
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update Litho Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Custom Layouts – Post + Product grids made easy: Missing AuthorizationCVE-2025-62996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Code Amp Custom Layouts – Post + Product grids made easy custom-layouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Layouts – Post + Product grids made easy: from n/a through <= 1.4.12.
- Product
- Custom Layouts – Post + Product grids made easy
- Affected
- up to 1.4.12
- What to do
- Affects up to 1.4.12. Update Custom Layouts – Post + Product grids made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025MultiParcels Shipping For WooCommerce: Missing AuthorizationCVE-2025-62995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through <= 1.30.12.
- Product
- MultiParcels Shipping For WooCommerce
- Affected
- up to 1.30.12
- What to do
- Affects up to 1.30.12. Update MultiParcels Shipping For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Notification for Telegram: Missing AuthorizationCVE-2025-62993 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through <= 3.5.1.
- Product
- Notification for Telegram
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Eupago Gateway For Woocommerce: Missing AuthorizationCVE-2025-62870 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Eupago Eupago Gateway For Woocommerce eupago-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eupago Gateway For Woocommerce: from n/a through <= 4.7.1.
- Product
- Eupago Gateway For Woocommerce
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Eupago Gateway For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Gravitec.net – Web Push Notifications: Missing AuthorizationCVE-2025-62869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gravitec.net - Web Push Notifications Gravitec.net – Web Push Notifications gravitec-net-web-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gravitec.net – Web Push Notifications: from n/a through <= 2.9.17.
- Product
- Gravitec.net – Web Push Notifications
- Affected
- up to 2.9.17
- What to do
- Affects up to 2.9.17. Update Gravitec.net – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Ergonet Cache: Missing AuthorizationCVE-2025-62867 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ergonet Cache: from n/a through <= 1.0.13.
- Product
- Ergonet Cache
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Ergonet Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Post Cloner: Missing AuthorizationCVE-2025-62865 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Evan Herman Post Cloner post-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Cloner: from n/a through <= 1.0.0.
- Product
- Post Cloner
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Post Cloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP-CRM System: Missing AuthorizationCVE-2025-62740 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.6.
- Product
- WP-CRM System
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Formstack Online Forms: Missing AuthorizationCVE-2025-62738 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mmattax Formstack Online Forms formstack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formstack Online Forms: from n/a through <= 2.0.2.
- Product
- Formstack Online Forms
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Formstack Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Image Cleanup: Missing AuthorizationCVE-2025-62736 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in opicron Image Cleanup image-cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Cleanup: from n/a through <= 1.9.2.
- Product
- Image Cleanup
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Quick Interest Slider: Missing AuthorizationCVE-2025-62153 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Graham Quick Interest Slider quick-interest-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Interest Slider: from n/a through <= 3.1.7.
- Product
- Quick Interest Slider
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025ConveyThis: Missing AuthorizationCVE-2025-62152 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.2.
- Product
- ConveyThis
- Affected
- up to 269.2
- What to do
- Affects up to 269.2. Update ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Virtuaria PagBank / PagSeguro para Woocommerce: Missing AuthorizationCVE-2025-62151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Virtuaria Virtuaria PagBank / PagSeguro para Woocommerce virtuaria-pagseguro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virtuaria PagBank / PagSeguro para Woocommerce: from n/a through <= 3.6.3.
- Product
- Virtuaria PagBank / PagSeguro para Woocommerce
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update Virtuaria PagBank / PagSeguro para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025ThemeRain Core: Missing AuthorizationCVE-2025-62100 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themerain ThemeRain Core themerain-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeRain Core: from n/a through <= 1.1.9.
- Product
- ThemeRain Core
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update ThemeRain Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons: Missing AuthorizationCVE-2025-62090 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jegstudio Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons gutenverse-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons: from n/a through <= 3.0.2.
- Product
- Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Яндекс Доставка (Boxberry): Missing AuthorizationCVE-2025-62086 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in akazanstev Яндекс Доставка (Boxberry) boxberry allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Яндекс Доставка (Boxberry): from n/a through <= 2.34.
- Product
- Яндекс Доставка (Boxberry)
- Affected
- up to 2.34
- What to do
- Affects up to 2.34. Update Яндекс Доставка (Boxberry) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025BERTHA AI: Missing AuthorizationCVE-2025-62085 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.
- Product
- BERTHA AI
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update BERTHA AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Actionwear products sync: Missing AuthorizationCVE-2025-49350 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Actionwear products sync: from n/a through <= 2.3.3.
- Product
- Actionwear products sync
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Actionwear products sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Hype: Missing AuthorizationCVE-2025-49348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hype Hype pico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hype: from n/a through <= 1.0.5.
- Product
- Hype
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Hype to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025CSV to SortTable: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-13070 · WordPress plugins & themes · reported by WPScanMedium 6.6
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
- Product
- CSV to SortTable
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update CSV to SortTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2025Helloprint: Missing AuthorizationCVE-2025-13666 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Helloprint plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.2. This is due to the plugin registering a public REST API endpoint without implementing authorization checks to verify request authenticity. This makes it possible for unauthenticated attackers to arbitrarily modify WooCommerce order statuses via the /wp-json/helloprint/v1/complete_order_from_helloprint_callback endpoint by providing a valid order reference ID.
- Product
- Helloprint
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Helloprint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2025Search, Filters & Merchandising for WooCommerce: Unauthorized modification of dataCVE-2025-12091 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.67. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin.
- Product
- Search, Filters & Merchandising for WooCommerce
- Affected
- up to 3.0.67
- What to do
- Affects up to 3.0.67. Update Search, Filters & Merchandising for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 5, 2025Wp Social Login and Register Social Counter: Missing authorizationCVE-2025-13620 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
- Product
- Wp Social Login and Register Social Counter
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Dec 5, 2025CoSign Single Signon: Reflected Cross-Site ScriptingCVE-2025-13512 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- CoSign Single Signon
- Affected
- up to 0.3.1
- What to do
- Affects up to 0.3.1. Update CoSign Single Signon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 2, 2025Upload.am: Is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX request handlerCVE-2025-12630 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Upload.am WordPress plugin before 1.0.1 is vulnerable to arbitrary option disclosure due to a missing capability check on its AJAX request handler, allowing users such as contributor to view site options.
- Product
- Upload.am
- Fixed in
- 1.0.1
- What to do
- Update Upload.am to 1.0.1 or newer.
Dec 2, 2025Beaver Builder – WordPress Page Builder: Missing AuthorizationCVE-2025-11726 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.
- Product
- Beaver Builder – WordPress Page Builder
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update Beaver Builder – WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 2, 2025donation: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-13001 · WordPress plugins & themes · reported by WPScanMedium 4.1
The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks
- Product
- donation
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2025Hide Category by User Role for WooCommerce: Missing AuthorizationCVE-2025-13441 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admin_init hook that executes wp_cache_flush(). This makes it possible for unauthenticated attackers to flush the site's object cache via forged requests, potentially degrading site performance.
- Product
- Hide Category by User Role for WooCommerce
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Hide Category by User Role for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 25, 2025Admin and Customer Messages After Order for WooCommerce: OrderConvo: Missing AuthorizationCVE-2025-13452 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14. This is due to a flawed permission check in the REST API permission callback that returns true when no nonce is provided. This makes it possible for unauthenticated attackers to impersonate any WordPress user and inject arbitrary messages into any WooCommerce order conversation by directly calling the REST endpoint with controlled user_id, order_id, and context parameters.
- Product
- Admin and Customer Messages After Order for WooCommerce: OrderConvo
- Affected
- up to 14
- What to do
- Affects up to 14. Update Admin and Customer Messages After Order for WooCommerce: OrderConvo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 24, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Time-based SQL InjectionCVE-2025-7402 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.95
- What to do
- Affects up to 4.95. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 22, 2025Booking Calendar Contact Form: Missing AuthorizationCVE-2025-13318 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and bypass payment requirements via the 'dex_bccf_ipn' parameter.
- Product
- Booking Calendar Contact Form
- Affected
- up to 1.2.60
- What to do
- Affects up to 1.2.60. Update Booking Calendar Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 22, 2025CP Contact Form with PayPal: Missing AuthorizationCVE-2025-13384 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint (via the 'cp_contactformpp_ipncheck' query parameter) that processes payment confirmations without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthenticated attackers to mark form submissions as paid without making actual payments by sending forged payment notification requests with arbitrary POST data (payment_status, txn_id, payer_email).
- Product
- CP Contact Form with PayPal
- Affected
- up to 1.3.56
- What to do
- Affects up to 1.3.56. Update CP Contact Form with PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 22, 2025Appointment Booking Calendar: Missing AuthorizationCVE-2025-13317 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.
- Product
- Appointment Booking Calendar
- Affected
- up to 1.3.96
- What to do
- Affects up to 1.3.96. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2025Show Variations as Single Products Woocommerce: Missing AuthorizationCVE-2025-66114 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show Variations as Single Products Woocommerce: from n/a through <= 2.0.
- Product
- Show Variations as Single Products Woocommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Show Variations as Single Products Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Better Chat Support for Messenger: Missing AuthorizationCVE-2025-66113 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Chat Support for Messenger: from n/a through <= 1.2.18.
- Product
- Better Chat Support for Messenger
- Affected
- up to 1.2.18
- What to do
- Affects up to 1.2.18. Update Better Chat Support for Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.