Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
706 results · page 4 of 15
Mar 25, 2026PitchPrint: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-22448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in flexcubed PitchPrint pitchprint allows Path Traversal.This issue affects PitchPrint: from n/a through <= 11.1.2.
- Product
- PitchPrint
- Affected
- up to 11.1.2
- What to do
- Affects up to 11.1.2. Update PitchPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2026Keep Backup Daily: Limited Path TraversalCVE-2026-3339 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.
- Product
- Keep Backup Daily
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2026ilGhera Carta Docente for WooCommerce: Path TraversalCVE-2026-2421 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ilGhera Carta Docente for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the 'cert' parameter of the 'wccd-delete-certificate' AJAX action. This is due to insufficient file path validation before performing a file deletion. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, such as wp-config.php, which can make site takeover and remote code execution possible.
- Product
- ilGhera Carta Docente for WooCommerce
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update ilGhera Carta Docente for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 19, 2026Admin Safety Guard: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25471 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safety-guard allows Password Recovery Exploitation.This issue affects Admin Safety Guard: from n/a through <= 1.2.6.
- Product
- Admin Safety Guard
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Admin Safety Guard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Squeeze: Path Traversal: '.../...//'CVE-2026-32415 · WordPress plugins & themes · reported by PatchstackMedium 5
Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.This issue affects Squeeze: from n/a through <= 1.7.7.
- Product
- Squeeze
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 10, 2026The Events Calendar: Path TraversalCVE-2026-3585 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- The Events Calendar
- Affected
- up to 6.15.17
- What to do
- Affects up to 6.15.17. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Mar 5, 2026uListing: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-28078 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue affects uListing: from n/a through <= 2.2.0.
- Product
- uListing
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026WeDesignTech Ultimate Booking Addon: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27390 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
- Product
- WeDesignTech Ultimate Booking Addon
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WeDesignTech Ultimate Booking Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026WeDesignTech Ultimate Booking Addon: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27389 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
- Product
- WeDesignTech Ultimate Booking Addon
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WeDesignTech Ultimate Booking Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026FormGent: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-22460 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpWax FormGent formgent allows Path Traversal.This issue affects FormGent: from n/a through <= 1.7.0.
- Product
- FormGent
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update FormGent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026ionCube tester plus: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69411 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through <= 1.3.
- Product
- ionCube tester plus
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ionCube tester plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2026Worry Proof Backup: Path TraversalCVE-2026-1311 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload a malicious ZIP archive with path traversal sequences to write arbitrary files anywhere on the server, including executable PHP files. This can lead to remote code execution.
- Product
- Worry Proof Backup
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update Worry Proof Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 25, 2026WP Responsive Images: Path TraversalCVE-2026-1557 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- WP Responsive Images
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Responsive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2026Simple File List: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-24953 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.15.
- Product
- Simple File List
- Affected
- up to 6.1.15
- What to do
- Affects up to 6.1.15. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Booked: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-22341 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through <= 3.0.0.
- Product
- Booked
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Booked to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Upload Files Anywhere: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69380 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
- Product
- Upload Files Anywhere
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Upload Files Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Upload Files Anywhere: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69379 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through <= 2.8.
- Product
- Upload Files Anywhere
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Upload Files Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026User Extra Fields: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69377 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- Product
- User Extra Fields
- Affected
- up to 17.0
- What to do
- Affects up to 17.0. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026User Extra Fields: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69376 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- Product
- User Extra Fields
- Affected
- up to 17.0
- What to do
- Affects up to 17.0. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Primer MyData for Woocommerce: Path Traversal: '.../...//'CVE-2025-69325 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Path Traversal: '.../...//' vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Path Traversal.This issue affects Primer MyData for Woocommerce: from n/a through <= 4.2.8.
- Product
- Primer MyData for Woocommerce
- Affected
- up to 4.2.8
- What to do
- Affects up to 4.2.8. Update Primer MyData for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026AhaChat Messenger Marketing: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-68895 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in ahachat AhaChat Messenger Marketing ahachat-messenger-marketing allows Password Recovery Exploitation.This issue affects AhaChat Messenger Marketing: from n/a through <= 1.1.
- Product
- AhaChat Messenger Marketing
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update AhaChat Messenger Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Woo File Dropzone: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68862 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Murtaza Bhurgri Woo File Dropzone woo-file-dropzone allows Path Traversal.This issue affects Woo File Dropzone: from n/a through <= 1.1.7.
- Product
- Woo File Dropzone
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Woo File Dropzone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Open User Map: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.This issue affects Open User Map: from n/a through <= 1.4.16.
- Product
- Open User Map
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Miraculous Elementor: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-67998 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7.
- Product
- Miraculous Elementor
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Miraculous Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2026WP-DownloadManager: Path TraversalCVE-2026-2426 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'file' parameter in the file deletion functionality. This is due to insufficient validation of user-supplied file paths, allowing directory traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can lead to remote code execution when critical files like wp-config.php are deleted.
- Product
- WP-DownloadManager
- Affected
- up to 1.69
- What to do
- Affects up to 1.69. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 18, 2026WP-DownloadManager: Path TraversalCVE-2026-2419 · WordPress plugins & themes · reported by WordfenceLow 2.7
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.69 via the 'download_path' configuration parameter. This is due to insufficient validation of the download path setting, which allows directory traversal sequences to bypass the WP_CONTENT_DIR prefix check. This makes it possible for authenticated attackers, with Administrator-level access and above, to configure the plugin to list and access arbitrary files on the server by exploiting the file browser functionality.
- Product
- WP-DownloadManager
- Affected
- up to 1.69
- What to do
- Affects up to 1.69. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 13, 2026BFG Tools – Extension Zipper: Path TraversalCVE-2025-13681 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.7. This is due to insufficient input validation on the user-supplied `first_file` parameter in the `zip()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files and directories outside the intended `/wp-content/plugins/` directory, which can contain sensitive information such as wp-config.php.
- Product
- BFG Tools – Extension Zipper
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update BFG Tools – Extension Zipper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2026Post Slides: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-15491 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks
- Product
- Post Slides
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Post Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2026Code Explorer: Path TraversalCVE-2025-15487 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Code Explorer
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Code Explorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 22, 2026Workreap Core: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-69101 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from n/a through <= 3.4.1.
- Product
- Workreap Core
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update Workreap Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WPLMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69097 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.
- Product
- WPLMS
- Affected
- up to 1.9.9.5.4
- What to do
- Affects up to 1.9.9.5.4. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026BM Content Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69055 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
- Product
- BM Content Builder
- What to do
- Update BM Content Builder to the newest version.
Jan 22, 2026HDForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68912 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through <= 1.6.1.
- Product
- HDForms
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update HDForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Hostme v2: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68907 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through <= 7.0.
- Product
- Hostme v2
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update Hostme v2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Anona: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68902 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0.
- Product
- Anona
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Anona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Anona: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68901 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0.
- Product
- Anona
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Anona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Movie Booking: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-67963 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5.
- Product
- Movie Booking
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Movie Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2026Fancy Product Designer: Full Path DisclosureCVE-2025-15526 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Fancy Product Designer
- Affected
- up to 6.4.8
- What to do
- Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com
Jan 14, 2026Integration Opvius AI for WooCommerce: Path TraversalCVE-2025-14301 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the `process_table_bulk_actions()` function processing user-supplied file paths without authentication checks, nonce verification, or path validation. This makes it possible for unauthenticated attackers to delete or download arbitrary files on the server via the `wsaw-log[]` POST parameter, which can be leveraged to delete critical files like `wp-config.php` or read sensitive configuration files.
- Product
- Integration Opvius AI for WooCommerce
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Integration Opvius AI for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 13, 2026E-xact | Hosted Payment |: Is vulnerable to arbitrary file deletion due to insufficient file path validationCVE-2025-14829 · WordPress plugins & themes · reported by WPScanCritical 9.1
The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
- Product
- E-xact | Hosted Payment |
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update E-xact | Hosted Payment | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Timetics: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-67915 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.
- Product
- Timetics
- Affected
- up to 1.0.46
- What to do
- Affects up to 1.0.46. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026VidMov: Path Traversal: '.../...//'CVE-2025-67914 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8.
- Product
- VidMov
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update VidMov to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2026Felan Framework: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-23504 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.
- Product
- Felan Framework
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026Advanced Database Cleaner PRO: Path Traversal: '.../...//'CVE-2025-46256 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2.10.
- Product
- Advanced Database Cleaner PRO
- Affected
- up to 3.2.10
- What to do
- Affects up to 3.2.10. Update Advanced Database Cleaner PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2026Flashcard: Path TraversalCVE-2025-14867 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Flashcard
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Flashcard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2026Frontend File Manager: Did not validate a path parameter and ownership of the fileCVE-2025-14804 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server
- Product
- Frontend File Manager
- Fixed in
- 23.5
- What to do
- Update Frontend File Manager to 23.5 or newer.
Jan 7, 2026Yoco Payments: Path TraversalCVE-2025-13801 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Yoco Payments
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Yoco Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2026FastDup – Fastest WordPress Migration & Duplicator: Path TraversalCVE-2026-0604 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7 via the 'dir_path' parameter in the 'njt-fastdup/v1/template/directory-tree' REST API endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary directories on the server, which can contain sensitive information.
- Product
- FastDup – Fastest WordPress Migration & Duplicator
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update FastDup – Fastest WordPress Migration & Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 31, 2025Pro Bulk Watermark Plugin for: Path Traversal: '.../...//'CVE-2025-28973 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress pro-watermark allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through <= 2.0.
- Product
- Pro Bulk Watermark Plugin for
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Pro Bulk Watermark Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Noindex by Path: Cross-Site Request Forgery (CSRF)CVE-2025-49353 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path noindex-by-path allows Stored XSS.This issue affects Noindex by Path: from n/a through <= 1.0.
- Product
- Noindex by Path
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Noindex by Path to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.