Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 37 of 86
Oct 22, 2025Web Accessibility By accessiBe: Missing AuthorizationCVE-2025-49920 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10.
- Product
- Web Accessibility By accessiBe
- Affected
- up to 2.10
- What to do
- Affects up to 2.10. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MultiVendorX: Missing AuthorizationCVE-2025-49916 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.
- Product
- MultiVendorX
- Affected
- up to 4.2.23
- What to do
- Affects up to 4.2.23. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025CoSchedule: Missing AuthorizationCVE-2025-49913 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.
- Product
- CoSchedule
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update CoSchedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPGuppy: Missing AuthorizationCVE-2025-49910 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4.
- Product
- WPGuppy
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025MDTF: Missing AuthorizationCVE-2025-49907 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.3.9.
- Product
- MDTF
- Affected
- up to 1.3.3.9
- What to do
- Affects up to 1.3.3.9. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025WPComplete: Missing AuthorizationCVE-2025-49906 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3.
- Product
- WPComplete
- Affected
- up to 2.9.5.3
- What to do
- Affects up to 2.9.5.3. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025ZoloBlocks: Missing AuthorizationCVE-2025-49903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in bdthemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through <= 2.3.11.
- Product
- ZoloBlocks
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update ZoloBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Simple Link Directory: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-49901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
- Product
- Simple Link Directory
- What to do
- Update Simple Link Directory to the newest version.
Oct 22, 2025Whydonate: Missing AuthorizationCVE-2025-49899 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.
- Product
- Whydonate
- Affected
- up to 4.0.15
- What to do
- Affects up to 4.0.15. Update Whydonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Hydra Booking: Missing AuthorizationCVE-2025-49377 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.
- Product
- Hydra Booking
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025DELUCKS SEO: Missing AuthorizationCVE-2025-49376 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects DELUCKS SEO: from n/a through <= 2.5.9.
- Product
- DELUCKS SEO
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Custom CSS: Missing AuthorizationCVE-2025-48096 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0.
- Product
- Custom CSS
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Custom CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Tablesome Table Premium: Missing AuthorizationCVE-2025-30944 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Essekia Tablesome Table Premium tablesome-premium allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tablesome Table Premium: from n/a through <= 1.1.23.
- Product
- Tablesome Table Premium
- Affected
- up to 1.1.23
- What to do
- Affects up to 1.1.23. Update Tablesome Table Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Flexible Refund and Return Order for WooCommerce: Missing AuthorizationCVE-2025-10570 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.
- Product
- Flexible Refund and Return Order for WooCommerce
- Affected
- up to 1.0.38
- What to do
- Affects up to 1.0.38. Update Flexible Refund and Return Order for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 15, 2025YourMembership Single Sign On – YM SSO Login: Unauthorized access of dataCVE-2025-10648 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login.
- Product
- YourMembership Single Sign On – YM SSO Login
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update YourMembership Single Sign On – YM SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2025WhyDonate – FREE Donate button – Crowdfunding – Fundraising: Unauthorized loss of dataCVE-2025-10186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
- Product
- WhyDonate – FREE Donate button – Crowdfunding – Fundraising
- Affected
- up to 4.0.15
- What to do
- Affects up to 4.0.15. Update WhyDonate – FREE Donate button – Crowdfunding – Fundraising to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 15, 2025BlindMatrix e-Commerce: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-10406 · WordPress plugins & themes · reported by WPScanMedium 5.5
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
- Product
- BlindMatrix e-Commerce
- Fixed in
- 3.1
- What to do
- Update BlindMatrix e-Commerce to 3.1 or newer.
Oct 8, 2025Chartify – WordPress Chart: Missing Authentication for Critical FunctionCVE-2025-11171 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative functions via the wp-admin/admin-ajax.php endpoint granted they can identify callable method names.
- Product
- Chartify – WordPress Chart
- Affected
- up to 3.5.9
- What to do
- Affects up to 3.5.9. Update Chartify – WordPress Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 8, 2025Find Me On: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-10635 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks
- Product
- Find Me On
- Affected
- up to 2.0.9.1
- What to do
- Affects up to 2.0.9.1. Update Find Me On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2025OAuth Single Sign On – SSO (OAuth Client): Improper Verification of Cryptographic SignatureCVE-2025-9485 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.
- Product
- OAuth Single Sign On – SSO (OAuth Client)
- Affected
- up to 6.26.12
- What to do
- Affects up to 6.26.12. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder: Missing authorizationCVE-2025-9029 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorization via the wdkit_handle_review_submission function in versions less than, or equal to, 1.2.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to submit feedback data to external services.
- Product
- WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
- What to do
- Update WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-11228 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.10.0
- What to do
- Affects up to 4.10.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-11227 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.10.0
- What to do
- Affects up to 4.10.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Ajax WooSearch
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2025CTL Behance Importer Lite: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9587 · WordPress plugins & themes · reported by WPScanHigh 8.6
The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- CTL Behance Importer Lite
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CTL Behance Importer Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WP Subscription Forms PRO: Missing AuthorizationCVE-2025-60166 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO wp-subscription-forms-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscription Forms PRO: from n/a through <= 2.0.5.
- Product
- WP Subscription Forms PRO
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update WP Subscription Forms PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Frames: Missing AuthorizationCVE-2025-60165 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HaruTheme Frames frames allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frames: from n/a through <= 1.5.7.
- Product
- Frames
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Frames to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Nota Fiscal Eletrônica WooCommerce: Missing AuthorizationCVE-2025-60159 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal-eletronica-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nota Fiscal Eletrônica WooCommerce: from n/a through <= 3.4.0.9.
- Product
- Nota Fiscal Eletrônica WooCommerce
- Affected
- up to 3.4.0.9
- What to do
- Affects up to 3.4.0.9. Update Nota Fiscal Eletrônica WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WP Virtual Assistant: Missing AuthorizationCVE-2025-60155 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Virtual Assistant: from n/a through <= 3.0.
- Product
- WP Virtual Assistant
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WP Virtual Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Subscribe To Unlock: Missing AuthorizationCVE-2025-60152 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe To Unlock: from n/a through <= 1.1.5.
- Product
- Subscribe To Unlock
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Subscribe To Unlock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Subscribe to Download: Missing AuthorizationCVE-2025-60148 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe to Download: from n/a through <= 2.0.9.
- Product
- Subscribe to Download
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Subscribe to Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Netgsm: Missing AuthorizationCVE-2025-60143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through <= 2.9.69.
- Product
- Netgsm
- Affected
- up to 2.9.69
- What to do
- Affects up to 2.9.69. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WEDOS Global: Missing AuthorizationCVE-2025-60130 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS Global: from n/a through <= 1.2.2.
- Product
- WEDOS Global
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update WEDOS Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Yext: Missing AuthorizationCVE-2025-60129 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Yext Yext yext allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yext: from n/a through <= 1.1.3.
- Product
- Yext
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Yext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Delisho: Missing AuthorizationCVE-2025-60128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through <= 1.1.3.
- Product
- Delisho
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Delisho to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025CopySafe Web Protection: Missing AuthorizationCVE-2025-60127 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CopySafe Web Protection: from n/a through <= 5.1.
- Product
- CopySafe Web Protection
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update CopySafe Web Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025HivePress Claim Listings: Missing AuthorizationCVE-2025-60123 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.
- Product
- HivePress Claim Listings
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025HivePress Claim Listings: Missing AuthorizationCVE-2025-60122 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.
- Product
- HivePress Claim Listings
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WooEvents: Missing AuthorizationCVE-2025-60121 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooEvents: from n/a through <= 4.1.7.
- Product
- WooEvents
- Affected
- up to 4.1.7
- What to do
- Affects up to 4.1.7. Update WooEvents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025WP Directory Kit: Missing AuthorizationCVE-2025-60120 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.
- Product
- WP Directory Kit
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Grand Conference Theme Custom Post Type: Missing AuthorizationCVE-2025-60116 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.
- Product
- Grand Conference Theme Custom Post Type
- Fixed in
- 2.6.4
- What to do
- Update Grand Conference Theme Custom Post Type to 2.6.4 or newer.
Sep 26, 2025EmailKit: Missing AuthorizationCVE-2025-60106 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Roxnor EmailKit emailkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmailKit: from n/a through <= 1.6.0.
- Product
- EmailKit
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update EmailKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025ListingPro: Missing AuthorizationCVE-2025-60103 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.8.
- Product
- ListingPro
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Theme My Login: Missing AuthorizationCVE-2025-60098 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Jeff Farthing Theme My Login theme-my-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theme My Login: from n/a through <= 7.1.12.
- Product
- Theme My Login
- Affected
- up to 7.1.12
- What to do
- Affects up to 7.1.12. Update Theme My Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025TheGem: Missing AuthorizationCVE-2025-60097 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5.
- Product
- TheGem
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update TheGem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025TheGem (Elementor): Missing AuthorizationCVE-2025-60096 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.
- Product
- TheGem (Elementor)
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update TheGem (Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Stackable: Missing AuthorizationCVE-2025-60094 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through <= 3.18.1.
- Product
- Stackable
- Affected
- up to 3.18.1
- What to do
- Affects up to 3.18.1. Update Stackable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Traveler: Missing AuthorizationCVE-2025-59011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Sep 26, 2025Wide Banner: Missing AuthorizationCVE-2025-58919 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in guihom Wide Banner wide-banner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wide Banner: from n/a through <= 1.0.4.
- Product
- Wide Banner
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Wide Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Acclectic Media Organizer: Missing AuthorizationCVE-2025-48326 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Acclectic Media Acclectic Media Organizer acclectic-media-organizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acclectic Media Organizer: from n/a through <= 1.4.
- Product
- Acclectic Media Organizer
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Acclectic Media Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.