Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 39 of 86
Sep 22, 2025Ongkoskirim.id: Missing AuthorizationCVE-2025-57949 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in oggix Ongkoskirim.id ongkoskirim-id allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ongkoskirim.id: from n/a through <= 1.0.6.
- Product
- Ongkoskirim.id
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Ongkoskirim.id to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Skimlinks Affiliate Marketing Tool: Missing AuthorizationCVE-2025-57944 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Skimlinks Affiliate Marketing Tool: from n/a through <= 1.3.
- Product
- Skimlinks Affiliate Marketing Tool
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Skimlinks Affiliate Marketing Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Image Hover Effects – Elementor Addon: Missing AuthorizationCVE-2025-57939 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Blocksera Image Hover Effects – Elementor Addon image-hover-effects-addon-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Hover Effects – Elementor Addon: from n/a through <= 1.4.4.
- Product
- Image Hover Effects – Elementor Addon
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Image Hover Effects – Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Subresource Integrity (SRI) Manager: Missing AuthorizationCVE-2025-57936 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Meitar Subresource Integrity (SRI) Manager wp-sri allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subresource Integrity (SRI) Manager: from n/a through <= 0.4.0.
- Product
- Subresource Integrity (SRI) Manager
- Affected
- up to 0.4.0
- What to do
- Affects up to 0.4.0. Update Subresource Integrity (SRI) Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Frontend File Manager: Missing AuthorizationCVE-2025-57921 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.3.
- Product
- Frontend File Manager
- Affected
- up to 23.3
- What to do
- Affects up to 23.3. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Printcart Web to Print Product Designer for WooCommerce: Missing AuthorizationCVE-2025-57917 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.8.
- Product
- Printcart Web to Print Product Designer for WooCommerce
- Affected
- up to 2.4.8
- What to do
- Affects up to 2.4.8. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Editor Custom Color Palette: Missing AuthorizationCVE-2025-57909 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Rouergue Création Editor Custom Color Palette editor-custom-color-palette allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Custom Color Palette: from n/a through <= 3.5.6.
- Product
- Editor Custom Color Palette
- Affected
- up to 3.5.6
- What to do
- Affects up to 3.5.6. Update Editor Custom Color Palette to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Heureka: Missing AuthorizationCVE-2025-57907 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Heureka Group Heureka heureka allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Heureka: from n/a through <= 1.1.0.
- Product
- Heureka
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Heureka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP Compress: Missing AuthorizationCVE-2025-57899 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Compress: from n/a through <= 6.50.54.
- Product
- WP Compress
- Affected
- up to 6.50.54
- What to do
- Affects up to 6.50.54. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Event Rocket: Missing AuthorizationCVE-2025-53452 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Barry Event Rocket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Rocket: from n/a through 3.3.
- Product
- Event Rocket
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Event Rocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2025Maspik: Missing Authorization in version 2CVE-2025-9979 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spamlog_download_csv function. This makes it possible for authenticated attackers, with subscriber-level access and above, to export and download the spam log database containing blocked submission attempts, which may include misclassified but legitimate submissions with sensitive data.
- Product
- Maspik
- What to do
- Update Maspik to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2025Categorify: Missing AuthorizationCVE-2025-59005 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Categorify: from n/a through <= 1.0.7.5.
- Product
- Categorify
- Affected
- up to 1.0.7.5
- What to do
- Affects up to 1.0.7.5. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
- Product
- Accessibility Checker by Equalize Digital
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Export WP Page to Static HTML/CSS: Missing AuthorizationCVE-2025-58980 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HTML/CSS: from n/a through <= 4.1.0.
- Product
- Export WP Page to Static HTML/CSS
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025BerqWP: Missing AuthorizationCVE-2025-58979 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqWP: from n/a through <= 2.2.53.
- Product
- BerqWP
- Affected
- up to 2.2.53
- What to do
- Affects up to 2.2.53. Update BerqWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025PDF Generator for: Missing AuthorizationCVE-2025-58978 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Generator for WordPress: from n/a through <= 1.5.4.
- Product
- PDF Generator for
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update PDF Generator for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
- Product
- Accessibility Checker by Equalize Digital
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Kalium: Missing AuthorizationCVE-2025-53348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.
- Product
- Kalium
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update Kalium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Awesome Support: Missing AuthorizationCVE-2025-53340 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Support: from n/a through <= 6.3.6.
- Product
- Awesome Support
- Affected
- up to 6.3.6
- What to do
- Affects up to 6.3.6. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Spreadconnect: Missing AuthorizationCVE-2025-53291 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5.
- Product
- Spreadconnect
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Spreadconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Majestic Support: Missing AuthorizationCVE-2025-49860 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.
- Product
- Majestic Support
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Church Admin: Missing AuthorizationCVE-2025-39553 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.
- Product
- Church Admin
- Affected
- up to 5.0.9
- What to do
- Affects up to 5.0.9. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025WP Simple Booking Calendar: Missing AuthorizationCVE-2025-39541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/a through <= 2.0.13.
- Product
- WP Simple Booking Calendar
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update WP Simple Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Target Video Easy Publish: Missing AuthorizationCVE-2025-32688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through <= 3.8.9.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.9
- What to do
- Affects up to 3.8.9. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-54744 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.15.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.15
- What to do
- Affects up to 3.6.15. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025HAPPY: Missing AuthorizationCVE-2025-53571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.6.
- Product
- HAPPY
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Shk Corporate: Missing AuthorizationCVE-2025-58824 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shk Corporate: from n/a through <= 2.4.1.1.
- Product
- Shk Corporate
- Affected
- up to 2.4.1.1
- What to do
- Affects up to 2.4.1.1. Update Shk Corporate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025SoftMe: Missing AuthorizationCVE-2025-58817 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoftMe: from n/a through <= 1.1.27.
- Product
- SoftMe
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update SoftMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Product Carousel Slider for Elementor: Missing AuthorizationCVE-2025-58816 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Carousel Slider for Elementor: from n/a through <= 2.1.3.
- Product
- Product Carousel Slider for Elementor
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Product Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Consultstreet: Missing AuthorizationCVE-2025-58813 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Consultstreet: from n/a through <= 3.0.0.
- Product
- Consultstreet
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Consultstreet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025WooCommerce Single Page Checkout: Cross-Site Request Forgery (CSRF)CVE-2025-58804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in brijrajs WooCommerce Single Page Checkout woo-single-page-checkout allows Cross Site Request Forgery.This issue affects WooCommerce Single Page Checkout: from n/a through <= 1.2.7.
- Product
- WooCommerce Single Page Checkout
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WooCommerce Single Page Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Payoneer Checkout: Missing AuthorizationCVE-2025-58795 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through <= 3.4.0.
- Product
- Payoneer Checkout
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Payoneer Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ray Enterprise Translation: Missing AuthorizationCVE-2025-58785 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.2.
- Product
- Ray Enterprise Translation
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Gutentor: Missing AuthorizationCVE-2025-58783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.5.
- Product
- Gutentor
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update Gutentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025OceanWP: Is vulnerable to an option update due to a missing capability check on one of its AJAX request handlerCVE-2025-8944 · WordPress plugins & themes · reported by WPScanMedium 4.3
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
- Product
- OceanWP
- Fixed in
- 4.1.2
- What to do
- Update OceanWP to 4.1.2 or newer.
Sep 3, 2025Contact Form By Mega Forms: Missing AuthorizationCVE-2025-58639 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms mega-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form By Mega Forms: from n/a through <= 1.6.1.
- Product
- Contact Form By Mega Forms
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Contact Form By Mega Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Support Genix: Missing AuthorizationCVE-2025-58635 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.23.
- Product
- Support Genix
- Affected
- up to 1.4.23
- What to do
- Affects up to 1.4.23. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025PeachPay Payments: Missing AuthorizationCVE-2025-58634 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in peachpay PeachPay Payments peachpay-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PeachPay Payments: from n/a through <= 1.117.4.
- Product
- PeachPay Payments
- Affected
- up to 1.117.4
- What to do
- Affects up to 1.117.4. Update PeachPay Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Mobile Contact Line: Missing AuthorizationCVE-2025-58622 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile Contact Line: from n/a through <= 2.4.0.
- Product
- Mobile Contact Line
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Mobile Contact Line to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025F4 Media Taxonomies: Missing AuthorizationCVE-2025-58617 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F4 Media Taxonomies: from n/a through <= 1.1.4.
- Product
- F4 Media Taxonomies
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update F4 Media Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Frisbii Pay: Missing AuthorizationCVE-2025-58616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frisbii Pay: from n/a through <= 1.8.2.1.
- Product
- Frisbii Pay
- Affected
- up to 1.8.2.1
- What to do
- Affects up to 1.8.2.1. Update Frisbii Pay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Posts Table with Search & Sort: Missing AuthorizationCVE-2025-58613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through <= 1.4.10.
- Product
- Posts Table with Search & Sort
- Affected
- up to 1.4.10
- What to do
- Affects up to 1.4.10. Update Posts Table with Search & Sort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025SaasLauncher: Missing AuthorizationCVE-2025-58606 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.
- Product
- SaasLauncher
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update SaasLauncher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Surfer: Missing AuthorizationCVE-2025-58603 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.
- Product
- Surfer
- Affected
- up to 1.6.4.574
- What to do
- Affects up to 1.6.4.574. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Classified Listing: Missing AuthorizationCVE-2025-58601 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.
- Product
- Classified Listing
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Paid Member Subscriptions: Missing AuthorizationCVE-2025-58600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.
- Product
- Paid Member Subscriptions
- Affected
- up to 2.15.9
- What to do
- Affects up to 2.15.9. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-58599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.
- Product
- Order Delivery Date for WooCommerce
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Brizy: Missing AuthorizationCVE-2025-58594 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.12.
- Product
- Brizy
- Affected
- up to 2.7.12
- What to do
- Affects up to 2.7.12. Update Brizy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Malcure Malware Scanner: Missing AuthorizationCVE-2025-3701 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Malcure Malware Scanner: from n/a through <= 16.8.
- Product
- Malcure Malware Scanner
- Affected
- up to 16.8
- What to do
- Affects up to 16.8. Update Malcure Malware Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Makeaholic: Missing AuthorizationCVE-2025-58210 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through <= 1.8.5.
- Product
- Makeaholic
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update Makeaholic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.