Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 34 of 86
Nov 21, 2025Accessibility Toolkit by WebYes: Missing AuthorizationCVE-2025-66112 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through <= 2.0.4.
- Product
- Accessibility Toolkit by WebYes
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Accessibility Toolkit by WebYes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Tiktok Feed: Missing AuthorizationCVE-2025-66110 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tiktok Feed: from n/a through <= 1.0.23.
- Product
- Tiktok Feed
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Tiktok Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Cart Weight for WooCommerce: Missing AuthorizationCVE-2025-66109 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cart Weight for WooCommerce: from n/a through <= 1.9.11.
- Product
- Cart Weight for WooCommerce
- Affected
- up to 1.9.11
- What to do
- Affects up to 1.9.11. Update Cart Weight for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025TNC Toolbox: Web Performance: Missing AuthorizationCVE-2025-66108 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TNC Toolbox: Web Performance: from n/a through <= 2.0.4.
- Product
- TNC Toolbox: Web Performance
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update TNC Toolbox: Web Performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Subscriptions & Memberships for PayPal: Missing AuthorizationCVE-2025-66107 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscriptions & Memberships for PayPal: from n/a through <= 1.1.7.
- Product
- Subscriptions & Memberships for PayPal
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Subscriptions & Memberships for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Featured Post Creative: Missing AuthorizationCVE-2025-66106 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through <= 1.5.5.
- Product
- Featured Post Creative
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Featured Post Creative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025CBX Bookmark & Favorite: Missing AuthorizationCVE-2025-66101 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CBX Bookmark & Favorite: from n/a through <= 2.0.1.
- Product
- CBX Bookmark & Favorite
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update CBX Bookmark & Favorite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Chat Help: Missing AuthorizationCVE-2025-66099 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chat Help: from n/a through <= 3.1.3.
- Product
- Chat Help
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Chat Help to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Table Block by Tableberg: Missing AuthorizationCVE-2025-66096 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by Tableberg: from n/a through <= 0.6.9.
- Product
- Table Block by Tableberg
- Affected
- up to 0.6.9
- What to do
- Affects up to 0.6.9. Update Table Block by Tableberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Product Feed for WooCommerce: Missing AuthorizationCVE-2025-66089 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.1.
- Product
- Product Feed for WooCommerce
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025PropertyHive: Missing AuthorizationCVE-2025-66087 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.
- Product
- PropertyHive
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025SMS Alert Order Notifications: Missing AuthorizationCVE-2025-66086 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.8.
- Product
- SMS Alert Order Notifications
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Arconix Shortcodes: Missing AuthorizationCVE-2025-66085 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.
- Product
- Arconix Shortcodes
- Affected
- up to 2.1.18
- What to do
- Affects up to 2.1.18. Update Arconix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025FluentCommunity: Missing AuthorizationCVE-2025-66084 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through <= 2.0.0.
- Product
- FluentCommunity
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update FluentCommunity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025WpEvently: Missing AuthorizationCVE-2025-66083 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4.
- Product
- WpEvently
- Affected
- up to 5.0.4
- What to do
- Affects up to 5.0.4. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025WpEvently: Missing AuthorizationCVE-2025-66082 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 5.0.4.
- Product
- WpEvently
- Affected
- up to 5.0.4
- What to do
- Affects up to 5.0.4. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Gutenverse Form: Missing AuthorizationCVE-2025-66079 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse Form: from n/a through <= 2.2.0.
- Product
- Gutenverse Form
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Gutenverse Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Legal Pages: Missing AuthorizationCVE-2025-66077 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.6.
- Product
- Legal Pages
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66075 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025UsersWP: Missing AuthorizationCVE-2025-66072 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through <= 1.2.47.
- Product
- UsersWP
- Affected
- up to 1.2.47
- What to do
- Affects up to 1.2.47. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Custom Order Numbers for WooCommerce: Missing AuthorizationCVE-2025-66071 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Order Numbers for WooCommerce: from n/a through <= 1.11.0.
- Product
- Custom Order Numbers for WooCommerce
- Affected
- up to 1.11.0
- What to do
- Affects up to 1.11.0. Update Custom Order Numbers for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025PPOM for WooCommerce: Missing AuthorizationCVE-2025-66069 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through <= 33.0.16.
- Product
- PPOM for WooCommerce
- Affected
- up to 33.0.16
- What to do
- Affects up to 33.0.16. Update PPOM for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Gutenverse: Missing AuthorizationCVE-2025-66065 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jegstudio Gutenverse gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through <= 3.2.1.
- Product
- Gutenverse
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Gutenverse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025WP Google Review Slider: Missing AuthorizationCVE-2025-66063 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Google Review Slider: from n/a through <= 17.4.
- Product
- WP Google Review Slider
- Affected
- up to 17.4
- What to do
- Affects up to 17.4. Update WP Google Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Seriously Simple Podcasting: Missing AuthorizationCVE-2025-66060 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.13.0
- What to do
- Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2025attention-bar: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-12502 · WordPress plugins & themes · reported by WPScanMedium 6.8
The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks
- Product
- attention-bar
- Affected
- up to 0.7.2.1
- What to do
- Affects up to 0.7.2.1. Update attention-bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2025-13206 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Avatars must be enabled in the WordPress install in order to exploit the vulnerability.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.13.0
- What to do
- Affects up to 4.13.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2025WP Login and Register using JWT: Unauthorized access of dataCVE-2025-12822 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo_jwt_generate_new_api_key' function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to generate a new API key on site's that do not have an API key configured and subsequently use that to access restricted endpoints.
- Product
- WP Login and Register using JWT
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update WP Login and Register using JWT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 18, 2025Live sales notification for WooCommerce: Missing AuthorizationCVE-2025-12955 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the "getOrders" function lacking proper authorization and capability checks when the plugin is configured to display recent order information. This makes it possible for unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details.
- Product
- Live sales notification for WooCommerce
- Affected
- up to 2.3.39
- What to do
- Affects up to 2.3.39. Update Live sales notification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 18, 2025WP Duplicate Page: Missing AuthorizationCVE-2025-12481 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify plugin settings that control role capabilities, and subsequently exploit the misconfigured capabilities to duplicate and view password-protected posts containing sensitive information.
- Product
- WP Duplicate Page
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update WP Duplicate Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 18, 2025Permalinks Cascade: Missing AuthorizationCVE-2025-12372 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Permalinks Cascade plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action in the handleTPCAdminAjaxRequest function. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized administrative actions such as enabling or disabling automatic pinging settings and modifying page exclusion settings.
- Product
- Permalinks Cascade
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Permalinks Cascade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 13, 2025JetFormBuilder: Missing AuthorizationCVE-2025-64384 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through <= 3.5.3.
- Product
- JetFormBuilder
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Order Export & Order Import for WooCommerce: Missing AuthorizationCVE-2025-64382 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Export & Order Import for WooCommerce: from n/a through <= 2.6.7.
- Product
- Order Export & Order Import for WooCommerce
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Booster for WooCommerce: Missing AuthorizationCVE-2025-64379 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through <= 7.4.0.
- Product
- Booster for WooCommerce
- Affected
- up to 7.4.0
- What to do
- Affects up to 7.4.0. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025YOP Poll: Missing AuthorizationCVE-2025-64370 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YOP YOP Poll yop-poll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YOP Poll: from n/a through <= 6.5.38.
- Product
- YOP Poll
- Affected
- up to 6.5.38
- What to do
- Affects up to 6.5.38. Update YOP Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Contact Form Email: Missing AuthorizationCVE-2025-64369 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.58.
- Product
- Contact Form Email
- Affected
- up to 1.3.58
- What to do
- Affects up to 1.3.58. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025ChatBot: Missing AuthorizationCVE-2025-64277 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.3.9.
- Product
- ChatBot
- Affected
- up to 7.3.9
- What to do
- Affects up to 7.3.9. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Survey Maker: Missing AuthorizationCVE-2025-64276 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ays Pro Survey Maker survey-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Survey Maker: from n/a through <= 5.1.9.4.
- Product
- Survey Maker
- Affected
- up to 5.1.9.4
- What to do
- Affects up to 5.1.9.4. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025WPKoi Templates for Elementor: Missing AuthorizationCVE-2025-64274 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.4.4.
- Product
- WPKoi Templates for Elementor
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025WooCommerce PDF Invoice Builder: Missing AuthorizationCVE-2025-64269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 1.2.150
- What to do
- Affects up to 1.2.150. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Frontend File Manager: Missing AuthorizationCVE-2025-64265 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.2.
- Product
- Frontend File Manager
- Affected
- up to 23.2
- What to do
- Affects up to 23.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025WP Content Pilot: Missing AuthorizationCVE-2025-64263 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in PluginEver WP Content Pilot wp-content-pilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Content Pilot: from n/a through <= 2.1.7.
- Product
- WP Content Pilot
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update WP Content Pilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Appointment Booking Calendar: Missing AuthorizationCVE-2025-64261 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.95.
- Product
- Appointment Booking Calendar
- Affected
- up to 1.3.95
- What to do
- Affects up to 1.3.95. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2025Theater for: Missing AuthorizationCVE-2025-64259 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.18.8.
- Product
- Theater for
- Affected
- up to 0.18.8
- What to do
- Affects up to 0.18.8. Update Theater for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Missing payment verification to unauthenticated payment bypassCVE-2025-12788 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to missing payment verification to unauthenticated payment bypass in all versions up to, and including, 1.1.27. This is due to the plugin accepting client-controlled payment confirmation data in the tfhb_meeting_paypal_payment_confirmation_callback function without server-side verification with PayPal's API. This makes it possible for unauthenticated attackers to bypass payment requirements and confirm bookings as paid without any actual payment transaction occurring.
- Product
- Hydra Booking — Appointment Scheduling & Booking Calendar
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update Hydra Booking — Appointment Scheduling & Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 10, 2025Double the Donation – A workplace giving tool to help your fundraising efforts: Stored Cross-Site ScriptingCVE-2025-12020 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Double the Donation – A workplace giving tool to help your fundraising efforts
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Double the Donation – A workplace giving tool to help your fundraising efforts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2025Effect Maker: Missing AuthorizationCVE-2025-62914 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Effect Maker: from n/a through <= 1.2.1.
- Product
- Effect Maker
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Effect Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Search & Go: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-62064 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7.
- Product
- Search & Go
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Search & Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Cost Calculator Builder: Missing AuthorizationCVE-2025-62049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <= 3.5.32.
- Product
- Cost Calculator Builder
- Affected
- up to 3.5.32
- What to do
- Affects up to 3.5.32. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025TheGem Demo Import (for WPBakery): Missing AuthorizationCVE-2025-62046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CodexThemes TheGem Demo Import (for WPBakery) thegem-importer.This issue affects TheGem Demo Import (for WPBakery): from n/a through <= 5.10.5.
- Product
- TheGem Demo Import (for WPBakery)
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update TheGem Demo Import (for WPBakery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.