Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 38 of 86
Sep 25, 2025OAuth Single Sign On – SSO (OAuth Client): Cross-Site Request ForgeryCVE-2025-10752 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- OAuth Single Sign On – SSO (OAuth Client)
- Affected
- up to 6.26.12
- What to do
- Affects up to 6.26.12. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2025wpDiscuz: Missing AuthorizationCVE-2025-59591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.33.
- Product
- wpDiscuz
- Affected
- up to 7.6.33
- What to do
- Affects up to 7.6.33. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Ibtana: Missing AuthorizationCVE-2025-59581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through <= 1.2.5.3.
- Product
- Ibtana
- Affected
- up to 1.2.5.3
- What to do
- Affects up to 1.2.5.3. Update Ibtana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025MasterStudy LMS: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2025-59577 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-59576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Coupon Affiliates: Missing AuthorizationCVE-2025-59567 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.8.0.
- Product
- Coupon Affiliates
- Affected
- up to 6.8.0
- What to do
- Affects up to 6.8.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Smart Blocks: Missing AuthorizationCVE-2025-59561 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.
- Product
- Smart Blocks
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Smart Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Payrexx Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-59559 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in payrexx Payrexx Payment Gateway for WooCommerce woo-payrexx-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payrexx Payment Gateway for WooCommerce: from n/a through <= 3.1.5.
- Product
- Payrexx Payment Gateway for WooCommerce
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Payrexx Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Revive.so: Missing AuthorizationCVE-2025-59551 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.6.
- Product
- Revive.so
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Revive.so to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Custom Login URL: Missing AuthorizationCVE-2025-58969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through <= 1.0.2.
- Product
- Custom Login URL
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Custom Login URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025MaxiBlocks: Missing AuthorizationCVE-2025-58968 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MaxiBlocks: from n/a through <= 2.1.3.
- Product
- MaxiBlocks
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update MaxiBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025VPSUForm: Missing AuthorizationCVE-2025-58957 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.2.20.
- Product
- VPSUForm
- Affected
- up to 3.2.20
- What to do
- Affects up to 3.2.20. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Cecabank WooCommerce: Missing AuthorizationCVE-2025-58685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cecabank WooCommerce Plugin: from n/a through <= 0.3.4.
- Product
- Cecabank WooCommerce
- Affected
- up to 0.3.4
- What to do
- Affects up to 0.3.4. Update Cecabank WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Easy Quotes: Missing AuthorizationCVE-2025-58681 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Quotes: from n/a through <= 1.2.4.
- Product
- Easy Quotes
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Easy Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Gutentor: Missing AuthorizationCVE-2025-58680 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.2.
- Product
- Gutentor
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Gutentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025AppMySite: Missing AuthorizationCVE-2025-58679 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AppMySite: from n/a through <= 3.15.0.
- Product
- AppMySite
- Affected
- up to 3.15.0
- What to do
- Affects up to 3.15.0. Update AppMySite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Accordion: Missing AuthorizationCVE-2025-58678 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.15.
- Product
- Accordion
- Affected
- up to 2.3.15
- What to do
- Affects up to 2.3.15. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP User Frontend: Missing AuthorizationCVE-2025-58672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.1.12.
- Product
- WP User Frontend
- Affected
- up to 4.1.12
- What to do
- Affects up to 4.1.12. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WPLMS: Missing AuthorizationCVE-2025-58668 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.
- Product
- WPLMS
- Affected
- up to 4.970
- What to do
- Affects up to 4.970. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025ListingPro Reviews: Missing AuthorizationCVE-2025-58667 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro Reviews: from n/a through < 2.9.11.
- Product
- ListingPro Reviews
- What to do
- Update ListingPro Reviews to the newest version.
Sep 22, 2025Website Chat Button: Kommo integration: Missing AuthorizationCVE-2025-58666 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kommo Website Chat Button: Kommo integration website-chat-button-kommo-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Website Chat Button: Kommo integration: from n/a through <= 1.3.1.
- Product
- Website Chat Button: Kommo integration
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Website Chat Button: Kommo integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Text To Speech TTS Accessibility: Missing AuthorizationCVE-2025-58664 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Azizul Hasan Text To Speech TTS Accessibility text-to-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Text To Speech TTS Accessibility: from n/a through <= 1.9.30.
- Product
- Text To Speech TTS Accessibility
- Affected
- up to 1.9.30
- What to do
- Affects up to 1.9.30. Update Text To Speech TTS Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Qubely: Missing AuthorizationCVE-2025-58663 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely: from n/a through <= 1.8.14.
- Product
- Qubely
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Oshine Core: Missing AuthorizationCVE-2025-58660 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in brandexponents Oshine Core oshine-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oshine Core: from n/a through <= 1.5.5.
- Product
- Oshine Core
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Oshine Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025All In One SEO Pack: Missing AuthorizationCVE-2025-58650 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.
- Product
- All In One SEO Pack
- Affected
- up to 4.8.7.1
- What to do
- Affects up to 4.8.7.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Lazy Blocks: Missing AuthorizationCVE-2025-58258 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nK Lazy Blocks lazy-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lazy Blocks: from n/a through <= 4.1.0.
- Product
- Lazy Blocks
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Lazy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Sticky Header Effects for Elementor: Missing AuthorizationCVE-2025-58251 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in POSIMYTH Sticky Header Effects for Elementor sticky-header-effects-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header Effects for Elementor: from n/a through <= 2.1.2.
- Product
- Sticky Header Effects for Elementor
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Sticky Header Effects for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-58247 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
- Product
- TI WooCommerce Wishlist
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Team Manager: Missing AuthorizationCVE-2025-58222 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Dynamic Web Lab Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Manager: from n/a through 2.6.8.
- Product
- Team Manager
- Affected
- up to 2.6.8
- What to do
- Affects up to 2.6.8. Update Team Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025PilotPress: Missing AuthorizationCVE-2025-58221 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through <= 2.0.36.
- Product
- PilotPress
- Affected
- up to 2.0.36
- What to do
- Affects up to 2.0.36. Update PilotPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Classic Widgets with Block-based Widgets: Missing AuthorizationCVE-2025-58029 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classic Widgets with Block-based Widgets: from n/a through <= 1.0.1.
- Product
- Classic Widgets with Block-based Widgets
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Classic Widgets with Block-based Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CF7 Submissions: Missing AuthorizationCVE-2025-58016 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.26.
- Product
- CF7 Submissions
- Affected
- up to 0.26
- What to do
- Affects up to 0.26. Update CF7 Submissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CP Multi View Event Calendar: Missing AuthorizationCVE-2025-58009 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.35.
- Product
- CP Multi View Event Calendar
- Affected
- up to 1.4.35
- What to do
- Affects up to 1.4.35. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025DriCub: Missing AuthorizationCVE-2025-58004 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DriCub: from n/a through <= 2.9.
- Product
- DriCub
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update DriCub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Javo Core: Missing AuthorizationCVE-2025-58003 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.266.
- Product
- Javo Core
- Affected
- up to 3.0.0.266
- What to do
- Affects up to 3.0.0.266. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Memberful - Membership: Missing AuthorizationCVE-2025-58000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a through <= 1.75.0.
- Product
- Memberful - Membership
- Affected
- up to 1.75.0
- What to do
- Affects up to 1.75.0. Update Memberful - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Trustpilot Reviews: Missing AuthorizationCVE-2025-57997 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Trustpilot Trustpilot Reviews trustpilot-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trustpilot Reviews: from n/a through <= 2.5.925.
- Product
- Trustpilot Reviews
- Affected
- up to 2.5.925
- What to do
- Affects up to 2.5.925. Update Trustpilot Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025DethemeKit For Elementor: Missing AuthorizationCVE-2025-57995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.10.
- Product
- DethemeKit For Elementor
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update DethemeKit For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Clariti: Missing AuthorizationCVE-2025-57991 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Clariti Clariti clariti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clariti: from n/a through <= 1.2.1.
- Product
- Clariti
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Clariti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Blog Designer: Missing AuthorizationCVE-2025-57990 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in solwininfotech Blog Designer blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blog Designer: from n/a through <= 3.1.8.
- Product
- Blog Designer
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP Events Manager: Missing AuthorizationCVE-2025-57987 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Events Manager: from n/a through <= 2.2.1.
- Product
- WP Events Manager
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Ultimate Watermark: Missing AuthorizationCVE-2025-57985 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through <= 1.1.
- Product
- Ultimate Watermark
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Ultimate Watermark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CardCom Payment Gateway: Missing AuthorizationCVE-2025-57976 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CardCom CardCom Payment Gateway woo-cardcom-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CardCom Payment Gateway: from n/a through <= 3.5.0.7.
- Product
- CardCom Payment Gateway
- Affected
- up to 3.5.0.7
- What to do
- Affects up to 3.5.0.7. Update CardCom Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Team: Missing AuthorizationCVE-2025-57975 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.6.
- Product
- Team
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Helpdesk Support Ticket System for WooCommerce: Missing AuthorizationCVE-2025-57972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.1.
- Product
- Helpdesk Support Ticket System for WooCommerce
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Helpdesk Support Ticket System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025SALESmanago & Leadoo: Missing AuthorizationCVE-2025-57971 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.
- Product
- SALESmanago & Leadoo
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update SALESmanago & Leadoo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Hide WP Toolbar: Missing AuthorizationCVE-2025-57969 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide WP Toolbar: from n/a through <= 2.7.
- Product
- Hide WP Toolbar
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update Hide WP Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CoDesigner: Missing AuthorizationCVE-2025-57961 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Codexpert, Inc CoDesigner woolementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoDesigner: from n/a through <= 4.29.
- Product
- CoDesigner
- Affected
- up to 4.29
- What to do
- Affects up to 4.29. Update CoDesigner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WooMS: Missing AuthorizationCVE-2025-57957 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpcraft WooMS wooms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooMS: from n/a through <= 9.12.
- Product
- WooMS
- Affected
- up to 9.12
- What to do
- Affects up to 9.12. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Post Carousel Slider for Elementor: Missing AuthorizationCVE-2025-57955 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Carousel Slider for Elementor: from n/a through <= 1.7.0.
- Product
- Post Carousel Slider for Elementor
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Post Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.