Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 35 of 86
Nov 6, 2025Togo: Missing AuthorizationCVE-2025-62037 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
- Product
- Togo
- What to do
- Update Togo to the newest version.
Nov 6, 2025Togo: Missing AuthorizationCVE-2025-62033 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
- Product
- Togo
- What to do
- Update Togo to the newest version.
Nov 6, 2025Salient: Missing AuthorizationCVE-2025-62028 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a through < 17.4.0.
- Product
- Salient
- What to do
- Update Salient to the newest version.
Nov 6, 2025KALLYAS: Missing AuthorizationCVE-2025-62018 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.
- Product
- KALLYAS
- Affected
- up to 4.22.0
- What to do
- Affects up to 4.22.0. Update KALLYAS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025KALLYAS: Missing AuthorizationCVE-2025-62017 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.
- Product
- KALLYAS
- Affected
- up to 4.22.0
- What to do
- Affects up to 4.22.0. Update KALLYAS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Bux Woocommerce: Missing AuthorizationCVE-2025-60247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Bux Bux Woocommerce bux-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bux Woocommerce: from n/a through <= 1.2.3.
- Product
- Bux Woocommerce
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Bux Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025VikBooking Hotel Booking Engine & PMS: Missing AuthorizationCVE-2025-5803 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.2.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Jock On Air Now (JOAN): Missing AuthorizationCVE-2025-58986 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jock On Air Now (JOAN): from n/a through <= 6.0.4.
- Product
- Jock On Air Now (JOAN)
- Affected
- up to 6.0.4
- What to do
- Affects up to 6.0.4. Update Jock On Air Now (JOAN) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Miraculous: Missing AuthorizationCVE-2025-58629 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous: from n/a through < 2.0.9.
- Product
- Miraculous
- What to do
- Update Miraculous to the newest version.
Nov 6, 2025imEvent: Missing AuthorizationCVE-2025-58243 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects imEvent: from n/a through <= 3.4.0.
- Product
- imEvent
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update imEvent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2025-58207 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.5.
- Product
- Ai Image Alt Text Generator for WP
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Info Cards: Missing AuthorizationCVE-2025-54711 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info Cards: from n/a through <= 1.0.11.
- Product
- Info Cards
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Info Cards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Backup and Move: Missing AuthorizationCVE-2025-53246 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup and Move: from n/a through <= 0.1.
- Product
- Backup and Move
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Backup and Move to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Sertifier Certificate & Badge Maker: Missing AuthorizationCVE-2025-53214 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in sertifier Sertifier Certificate & Badge Maker sertifier-certificates-open-badges allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sertifier Certificate & Badge Maker: from n/a through <= 1.21.
- Product
- Sertifier Certificate & Badge Maker
- Affected
- up to 1.21
- What to do
- Affects up to 1.21. Update Sertifier Certificate & Badge Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Image Gallery block – Create and display photo gallery/photo album.: Missing AuthorizationCVE-2025-49394 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through <= 1.0.7.
- Product
- Image Gallery block – Create and display photo gallery/photo album.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Image Gallery block – Create and display photo gallery/photo album. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Advanced Google Maps: Missing AuthorizationCVE-2025-39465 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Maps: from n/a through <= 5.8.4.
- Product
- Advanced Google Maps
- Affected
- up to 5.8.4
- What to do
- Affects up to 5.8.4. Update Advanced Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 5, 2025FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce: Missing AuthorizationCVE-2025-12469 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. This is due to the plugin not properly verifying that a user is authorized to perform administrative actions in the `bwfan_test_email` AJAX handler. The nonce used for verification is publicly exposed to all visitors (including unauthenticated users) via the frontend JavaScript localization, and the `check_nonce()` function accepts low-privilege authenticated users who possess this nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to send arbitrary emails from the site with attacker-controlled subject and body content.
- Product
- FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
- Affected
- up to 3.6.4.1
- What to do
- Affects up to 3.6.4.1. Update FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 5, 2025ElementInvader Addons for Elementor: Allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form actionCVE-2025-10873 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on the elementinvader_addons_for_elementor_forms_send_form action.
- Product
- ElementInvader Addons for Elementor
- Fixed in
- 1.4.1
- What to do
- Update ElementInvader Addons for Elementor to 1.4.1 or newer.
Nov 3, 2025WP Snow Effect: Missing AuthorizationCVE-2025-64294 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in d3wp WP Snow Effect wp-snow-effect allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Snow Effect: from n/a through <= 1.1.19.
- Product
- WP Snow Effect
- Affected
- up to 1.1.19
- What to do
- Affects up to 1.1.19. Update WP Snow Effect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2025Qi Blocks: Missing AuthorizationCVE-2025-12180 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitrary CSS styles submitted via the `qi-blocks/v1/update-styles` REST API endpoint without proper sanitization in the `update_global_styles_callback()` function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary CSS, which can be used to perform actions such as hiding content, overlaying fake UI elements, or exfiltrating sensitive information via CSS injection techniques.
- Product
- Qi Blocks
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Qi Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2025SiteSEO – SEO Simplified: Missing AuthorizationCVE-2025-12367 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level access and above, to enable or disable arbitrary SiteSEO features that they should not have access to.
- Product
- SiteSEO – SEO Simplified
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update SiteSEO – SEO Simplified to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 31, 2025Smart Coupons for WooCommerce: Missing AuthorizationCVE-2025-64358 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce wt-smart-coupons-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Coupons for WooCommerce: from n/a through <= 2.2.3.
- Product
- Smart Coupons for WooCommerce
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Smart Coupons for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Insert PHP Code Snippet: Missing AuthorizationCVE-2025-64356 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Insert PHP Code Snippet: from n/a through <= 1.4.3.
- Product
- Insert PHP Code Snippet
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Insert PHP Code Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Essential Addons for Elementor: Missing AuthorizationCVE-2025-64352 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.2.4.
- Product
- Essential Addons for Elementor
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2025Rank Math SEO: Missing AuthorizationCVE-2025-64350 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1.
- Product
- Rank Math SEO
- Affected
- up to 1.0.252.1
- What to do
- Affects up to 1.0.252.1. Update Rank Math SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Premmerce Wholesale Pricing for WooCommerce: Missing AuthorizationCVE-2025-64285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Wholesale Pricing for WooCommerce: from n/a through <= 1.1.10.
- Product
- Premmerce Wholesale Pricing for WooCommerce
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Premmerce Wholesale Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Evergreen Content Poster: Missing AuthorizationCVE-2025-64234 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Evergreen Content Poster: from n/a through <= 1.4.5.
- Product
- Evergreen Content Poster
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Evergreen Content Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-64229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Business Directory: Missing AuthorizationCVE-2025-64219 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.18.
- Product
- Business Directory
- Affected
- up to 6.4.18
- What to do
- Affects up to 6.4.18. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025MasterStudy LMS Pro: Missing AuthorizationCVE-2025-64212 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
- Product
- MasterStudy LMS Pro
- What to do
- Update MasterStudy LMS Pro to the newest version.
Oct 29, 2025Masterstudy Elementor Widgets: Missing AuthorizationCVE-2025-64211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Masterstudy Elementor Widgets: Missing AuthorizationCVE-2025-64210 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025wpresidence: Missing AuthorizationCVE-2025-64199 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through <= 5.3.2.
- Product
- wpresidence
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update wpresidence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Blog Designer PRO: Missing AuthorizationCVE-2025-58711 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blog Designer PRO: from n/a through <= 3.4.8.
- Product
- Blog Designer PRO
- Affected
- up to 3.4.8
- What to do
- Affects up to 3.4.8. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Doppler Forms: Registers an AJAX action install_extension without verifying user capabilities or using a nonceCVE-2025-9544 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1).
- Product
- Doppler Forms
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Doppler Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Facebook for WooCommerce: Missing AuthorizationCVE-2025-64296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
- Product
- Facebook for WooCommerce
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Facebook for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Persian Admnin Fonts: Missing AuthorizationCVE-2025-62980 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Persian Admnin Fonts: from n/a through <= 4.1.03.
- Product
- Persian Admnin Fonts
- Affected
- up to 4.1.03
- What to do
- Affects up to 4.1.03. Update Persian Admnin Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025KiotViet Sync: Missing AuthorizationCVE-2025-62978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.
- Product
- KiotViet Sync
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025百度站长SEO合集(支持百度/神马/Bing/头条推送): Missing AuthorizationCVE-2025-62977 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 沃之涛 百度站长SEO合集(支持百度/神马/Bing/头条推送) baiduseo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 百度站长SEO合集(支持百度/神马/Bing/头条推送): from n/a through <= 2.1.4.
- Product
- 百度站长SEO合集(支持百度/神马/Bing/头条推送)
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update 百度站长SEO合集(支持百度/神马/Bing/头条推送) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Sendle Shipping: Missing AuthorizationCVE-2025-62976 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sendle Shipping: from n/a through <= 6.02.
- Product
- Sendle Shipping
- Affected
- up to 6.02
- What to do
- Affects up to 6.02. Update Sendle Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025BuddyForms: Missing AuthorizationCVE-2025-62973 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.
- Product
- BuddyForms
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WebinarPress: Missing AuthorizationCVE-2025-62972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.
- Product
- WebinarPress
- Affected
- up to 1.33.28
- What to do
- Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Link Whisper Free: Missing AuthorizationCVE-2025-62970 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
- Product
- Link Whisper Free
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025GoCache: Missing AuthorizationCVE-2025-62966 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apiki GoCache gocache-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoCache: from n/a through <= 1.3.6.
- Product
- GoCache
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update GoCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Admin Management Xtended: Missing AuthorizationCVE-2025-62965 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin Management Xtended : from n/a through <= 2.5.1.
- Product
- Admin Management Xtended
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Admin Management Xtended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025MDTF: Missing AuthorizationCVE-2025-62964 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.6.
- Product
- MDTF
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Revive Old Posts: Missing AuthorizationCVE-2025-62954 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in rsocial Revive Old Posts tweet-old-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive Old Posts: from n/a through <= 9.3.3.
- Product
- Revive Old Posts
- Affected
- up to 9.3.3
- What to do
- Affects up to 9.3.3. Update Revive Old Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Welcart e-Commerce: Missing AuthorizationCVE-2025-62953 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.24
- What to do
- Affects up to 2.11.24. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025ChatBot: Missing AuthorizationCVE-2025-62952 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.7.3.
- Product
- ChatBot
- Affected
- up to 7.7.3
- What to do
- Affects up to 7.7.3. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Everest Backup: Missing AuthorizationCVE-2025-62946 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.
- Product
- Everest Backup
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.