Vulnerability database

6,267 results · page 35 of 126

• Feb 11, 2026Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium): Unauthorized loss of dataCVE-2025-13391 · WordPress plugins & themes · reported by WordfenceMedium 5.8

  The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'uni_cpo_remove_file' function in all versions up to, and including, 4.9.60. This makes it possible for unauthenticated attackers to delete arbitrary attachments or files stored in Dropbox if the file path is known. The vulnerability was partially patched in version 4.9.60.

  Product

  Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium)

  Affected

  up to 4.9.60

  What to do

  Affects up to 4.9.60. Update Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordmoomoo.agencywordfence.com

• Feb 11, 2026WPZOOM Addons for Elementor – Starter Templates & Widgets: Unauthorized access of dataCVE-2026-2295 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_post_grid_load_more' function in all versions up to, and including, 1.3.2. This makes it possible for unauthenticated attackers to retrieve protected (draft, future, pending) post titles and excerpts that should not be accessible to unauthenticated users.

  Product

  WPZOOM Addons for Elementor – Starter Templates & Widgets

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update WPZOOM Addons for Elementor – Starter Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 11, 2026WaMate Confirm – Order Confirmation: Unauthorized accessCVE-2026-1833 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to block and unblock phone numbers, which should be restricted to administrators.

  Product

  WaMate Confirm – Order Confirmation

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update WaMate Confirm – Order Confirmation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 11, 2026Twitter posts to Blog: Unauthorized modification of dataCVE-2026-1786 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25. This makes it possible for unauthenticated attackers to update plugin settings including Twitter API credentials, post author, post status, and the capability required to access the plugin's admin menu.

  Product

  Twitter posts to Blog

  Affected

  up to 1.11.25

  What to do

  Affects up to 1.11.25. Update Twitter posts to Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 11, 2026Invoct – PDF Invoices & Billing for WooCommerce: Unauthorized access of dataCVE-2026-1748 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve invoice clients, invoice items, and list of WordPress users along with their emails.

  Product

  Invoct – PDF Invoices & Billing for WooCommerce

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Invoct – PDF Invoices & Billing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 10, 2026Gallery by FooGallery: Unauthorized access of dataCVE-2025-15524 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() function in all versions up to, and including, 3.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve metadata (name, image count, thumbnail URL) of private, draft, and password-protected galleries by enumerating gallery IDs.

  Product

  Gallery by FooGallery

  Affected

  up to 3.1.9

  What to do

  Affects up to 3.1.9. Update Gallery by FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 10, 2026PopupKit: Authorization bypassCVE-2025-14895 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics.

  Product

  PopupKit

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update PopupKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 9, 2026WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible: Unauthorized modification of data that can lead to privilege escalationCVE-2026-0845 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

  Product

  WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible

  Affected

  up to 6.7.24

  What to do

  Affects up to 6.7.24. Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 7, 2026Advanced Country Blocker: Authorization BypassCVE-2026-1675 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all versions up to, and including, 2.3.1 due to the use of a predictable default value for the secret bypass key created during installation without requiring users to change it. This makes it possible for unauthenticated attackers to bypass the geolocation blocking mechanism by appending the key to any URL on sites where the administrator has not changed the default value.

  Product

  Advanced Country Blocker

  Affected

  up to 2.3.1

  What to do

  Affects up to 2.3.1. Update Advanced Country Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 7, 2026The Bucketlister: Unauthorized modification of dataCVE-2025-15476 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The The Bucketlister plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bucketlister_do_admin_ajax() function in all versions up to, and including, 0.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add delete or modify arbitrary bucket list items.

  Product

  The Bucketlister

  Affected

  up to 0.1.5

  What to do

  Affects up to 0.1.5. Update The Bucketlister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 6, 2026WP Duplicate: Missing Authorization leading to Arbitrary File UploadCVE-2026-1499 · WordPress plugins & themes · reported by WordfenceHigh 8.8

  The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to set the internal `prod_key_random_id` option, which can then be used by an unauthenticated attacker to bypass authentication checks and write arbitrary files to the server via the `handle_upload_single_big_file()` function, ultimately leading to remote code execution.

  Product

  WP Duplicate

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update WP Duplicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 6, 2026OAuth Single Sign On – SSO (OAuth Client): Unauthorized accessCVE-2025-10753 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' option parameter. This makes it possible for unauthenticated attackers to set the global redirect URL option via the redirect_url parameter granted they can access the site directly.

  Product

  OAuth Single Sign On – SSO (OAuth Client)

  Affected

  up to 6.26.14

  What to do

  Affects up to 6.26.14. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 5, 2026Greenshift – animation and page builder blocks: Unauthorized access of dataCVE-2026-1927 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the greenshift_app_pass_validation() function in all versions up to, and including, 12.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve global plugin settings including stored AI API keys and modify plugin settings, including the injection of arbitrary web scripts via the 'custom_css' value (stored XSS). NOTE: This vulnerability was partially patched in version 12.6.

  Product

  Greenshift – animation and page builder blocks

  Affected

  up to 12.6

  What to do

  Affects up to 12.6. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 5, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Missing AuthorizationCVE-2025-14079 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global WSDesk settings via the `eh_crm_ticket_general` AJAX action.

  Product

  ELEX WordPress HelpDesk & Customer Ticketing System

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 5, 2026ProfileGrid – User Profiles, Groups and Communities: Unauthorized user suspensionCVE-2025-13416 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing capability check on the pm_deactivate_user_from_group() function in all versions up to, and including, 5.9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to suspend arbitrary users from groups, including administrators, via the pm_deactivate_user_from_group AJAX action.

  Product

  ProfileGrid – User Profiles, Groups and Communities

  Affected

  up to 5.9.7.2

  What to do

  Affects up to 5.9.7.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2026Fortis for WooCommerce: Authorization bypassCVE-2026-0679 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'check_fortis_notify_response' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order statuses to paid/processing/completed, effectively allowing them to mark orders as paid without payment.

  Product

  Fortis for WooCommerce

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Fortis for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2026WebPurify Profanity Filter: Unauthorized modification of dataCVE-2026-0572 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The WebPurify Profanity Filter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'webpurify_save_options' function in all versions up to, and including, 4.0.2. This makes it possible for unauthenticated attackers to change plugin settings.

  Product

  WebPurify Profanity Filter

  Affected

  up to 4.0.2

  What to do

  Affects up to 4.0.2. Update WebPurify Profanity Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 4, 2026Magic Import Document Extractor: Unauthorized modification of dataCVE-2025-15507 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to modify the plugin's license status and credit balance.

  Product

  Magic Import Document Extractor

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Magic Import Document Extractor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2026SEO Flow by LupsOnline: Unauthorized modification of dataCVE-2025-15285 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories.

  Product

  SEO Flow by LupsOnline

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update SEO Flow by LupsOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2026MyRewards – Loyalty Points and Rewards for WooCommerce: Missing authorizationCVE-2025-15260 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.

  Product

  MyRewards – Loyalty Points and Rewards for WooCommerce

  Affected

  up to 5.6.1

  What to do

  Affects up to 5.6.1. Update MyRewards – Loyalty Points and Rewards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 4, 2026Xendit Payment: Unauthorized order status manipulationCVE-2025-14461 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint (`wc_xendit_callback`) that processes payment callbacks without any authentication or cryptographic verification that the requests originate from Xendit's payment gateway. This makes it possible for unauthenticated attackers to mark any WooCommerce order as paid by sending a crafted POST request to the callback URL with a JSON body containing an `external_id` matching the order ID pattern and a `status` of 'PAID' or 'SETTLED', granted they can enumerate order IDs (which are sequential integers). This leads to orders being fraudulently marked as completed without any actual payment, resulting in financial loss and inventory depletion.

  Product

  Xendit Payment

  Affected

  up to 6.0.2

  What to do

  Affects up to 6.0.2. Update Xendit Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 3, 2026Passster: Missing AuthorizationCVE-2026-25036 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through <= 4.2.25.

  Product

  Passster

  Affected

  up to 4.2.25

  What to do

  Affects up to 4.2.25. Update Passster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026ElementInvader Addons for Elementor: Missing AuthorizationCVE-2026-25028 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.1.

  Product

  ElementInvader Addons for Elementor

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Run Contests, Raffles, and Giveaways with ContestsWP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25023 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Retrieve Embedded Sensitive Data.This issue affects Run Contests, Raffles, and Giveaways with ContestsWP: from n/a through <= 2.0.7.

  Product

  Run Contests, Raffles, and Giveaways with ContestsWP

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Run Contests, Raffles, and Giveaways with ContestsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Mizan Demo Importer: Missing AuthorizationCVE-2026-25021 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mizan Demo Importer: from n/a through <= 0.1.3.

  Product

  Mizan Demo Importer

  Affected

  up to 0.1.3

  What to do

  Affects up to 0.1.3. Update Mizan Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Sync for Notion: Missing AuthorizationCVE-2026-25020 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WP connect WP Sync for Notion wp-sync-for-notion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sync for Notion: from n/a through <= 1.7.0.

  Product

  WP Sync for Notion

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update WP Sync for Notion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Atarim: Missing AuthorizationCVE-2026-25019 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.1.

  Product

  Atarim

  Affected

  up to 4.3.1

  What to do

  Affects up to 4.3.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Nelio Popups: Missing AuthorizationCVE-2026-25016 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Popups: from n/a through <= 1.3.5.

  Product

  Nelio Popups

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Nelio Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Bannerize Pro: Missing AuthorizationCVE-2026-25012 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bannerize Pro: from n/a through <= 1.11.0.

  Product

  WP Bannerize Pro

  Affected

  up to 1.11.0

  What to do

  Affects up to 1.11.0. Update WP Bannerize Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Custom Admin Interface: Missing AuthorizationCVE-2026-25011 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.41.

  Product

  WP Custom Admin Interface

  Affected

  up to 7.41

  What to do

  Affects up to 7.41. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Share This Image: Missing AuthorizationCVE-2026-25010 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through <= 2.09.

  Product

  Share This Image

  Affected

  up to 2.09

  What to do

  Affects up to 2.09. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Hustle: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24998 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popup allows Retrieve Embedded Sensitive Data.This issue affects Hustle: from n/a through <= 7.8.9.2.

  Product

  Hustle

  Affected

  up to 7.8.9.2

  What to do

  Affects up to 7.8.9.2. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Wired Impact Volunteer Management: Missing AuthorizationCVE-2026-24997 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.8.

  Product

  Wired Impact Volunteer Management

  Affected

  up to 2.8

  What to do

  Affects up to 2.8. Update Wired Impact Volunteer Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WPElemento Importer: Missing AuthorizationCVE-2026-24996 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in wpelemento WPElemento Importer wpelemento-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPElemento Importer: from n/a through <= 0.6.4.

  Product

  WPElemento Importer

  Affected

  up to 0.6.4

  What to do

  Affects up to 0.6.4. Update WPElemento Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Latest Post Shortcode: Missing AuthorizationCVE-2026-24995 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through <= 14.2.0.

  Product

  Latest Post Shortcode

  Affected

  up to 14.2.0

  What to do

  Affects up to 14.2.0. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-24994 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.

  Product

  Sunshine Photo Cart

  Affected

  up to 3.5.7.2

  What to do

  Affects up to 3.5.7.2. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Extensions For CF7: Authorization Bypass Through User-Controlled KeyCVE-2026-24991 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.

  Product

  Extensions For CF7

  Affected

  up to 3.4.0

  What to do

  Affects up to 3.4.0. Update Extensions For CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Docs: Missing AuthorizationCVE-2026-24990 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through <= 2.2.8.

  Product

  WP Docs

  Affected

  up to 2.2.8

  What to do

  Affects up to 2.2.8. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026WP Forms Signature Contract Add-On: Missing AuthorizationCVE-2026-24985 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Forms Signature Contract Add-On: from n/a through <= 1.8.2.

  Product

  WP Forms Signature Contract Add-On

  Affected

  up to 1.8.2

  What to do

  Affects up to 1.8.2. Update WP Forms Signature Contract Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Visual Link Preview: Missing AuthorizationCVE-2026-24984 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in Brecht Visual Link Preview visual-link-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Link Preview: from n/a through <= 2.2.9.

  Product

  Visual Link Preview

  Affected

  up to 2.2.9

  What to do

  Affects up to 2.2.9. Update Visual Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Spectra: Missing AuthorizationCVE-2026-24982 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.17.

  Product

  Spectra

  Affected

  up to 2.19.17

  What to do

  Affects up to 2.19.17. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Amelia: Missing AuthorizationCVE-2026-24967 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.38.

  Product

  Amelia

  Affected

  up to 1.2.38

  What to do

  Affects up to 1.2.38. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Contest Gallery: Missing AuthorizationCVE-2026-24965 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contest Gallery: from n/a through <= 28.1.1.

  Product

  Contest Gallery

  Affected

  up to 28.1.1

  What to do

  Affects up to 28.1.1. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Strong Testimonials: Missing AuthorizationCVE-2026-24957 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through <= 3.2.20.

  Product

  Strong Testimonials

  Affected

  up to 3.2.20

  What to do

  Affects up to 3.2.20. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026myCred: Missing AuthorizationCVE-2026-24951 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.7.3.

  Product

  myCred

  Affected

  up to 2.9.7.3

  What to do

  Affects up to 2.9.7.3. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2026-24947 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through < 1.5.6.3.

  Product

  LA-Studio Element Kit for Elementor

  What to do

  Update LA-Studio Element Kit for Elementor to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Ultimate Addons for Contact Form 7: Missing AuthorizationCVE-2026-24945 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.5.34.

  Product

  Ultimate Addons for Contact Form 7

  Affected

  up to 3.5.34

  What to do

  Affects up to 3.5.34. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Travelfic Toolkit: Missing AuthorizationCVE-2026-24940 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelfic Toolkit: from n/a through <= 1.3.3.

  Product

  Travelfic Toolkit

  Affected

  up to 1.3.3

  What to do

  Affects up to 1.3.3. Update Travelfic Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Modula Image Gallery: Missing AuthorizationCVE-2026-24939 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modula Image Gallery: from n/a through <= 2.13.6.

  Product

  Modula Image Gallery

  Affected

  up to 2.13.6

  What to do

  Affects up to 2.13.6. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 31, 2026Booking Calendar: Unauthorized access of dataCVE-2026-1431 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.

  Product

  Booking Calendar

  Affected

  up to 10.14.13

  What to do

  Affects up to 10.14.13. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.