Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 41 of 86
Aug 14, 2025Netease Music: Missing AuthorizationCVE-2025-49052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dariolee Netease Music netease-music allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netease Music: from n/a through <= 3.2.1.
- Product
- Netease Music
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Netease Music to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025WP Lead Capturing Pages: Missing AuthorizationCVE-2025-31425 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
- Product
- WP Lead Capturing Pages
- What to do
- Update WP Lead Capturing Pages to the newest version.
Aug 14, 2025Thank You Page Customizer for WooCommerce: Missing AuthorizationCVE-2025-30993 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.7.
- Product
- Thank You Page Customizer for WooCommerce
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Thank You Page Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025IDonatePro: Missing AuthorizationCVE-2025-30639 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonatePro: from n/a through <= 2.1.9.
- Product
- IDonatePro
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update IDonatePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025Advanced Google Universal Analytics: Missing AuthorizationCVE-2025-28962 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in stefanoai Advanced Google Universal Analytics advanced-google-universal-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Universal Analytics: from n/a through <= 1.0.3.
- Product
- Advanced Google Universal Analytics
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Advanced Google Universal Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2025Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions.CVE-2025-0818 · WordPress plugins & themes · reported by WordfenceMedium 6.5
Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.
- What to do
- Update the plugin to the newest version.
Aug 12, 2025FiboSearch: Missing AuthorizationCVE-2025-47444 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiboSearch: from n/a through <= 1.32.1.
- Product
- FiboSearch
- Affected
- up to 1.32.1
- What to do
- Affects up to 1.32.1. Update FiboSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2025Post SMTP: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-24000 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
- Product
- Post SMTP
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-8620 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jul 31, 2025GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2025-7205 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with GiveWP worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additionally, they need to trick an administrator into visiting the legacy version of the site.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2025Nuss: Missing AuthorizationCVE-2025-52804 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in uxper Nuss nuss allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Nuss: from n/a through <= 1.3.7.1.
- Product
- Nuss
- Affected
- up to 1.3.7.1
- What to do
- Affects up to 1.3.7.1. Update Nuss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Sala: Missing AuthorizationCVE-2025-52803 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in uxper Sala allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sala: from n/a through 1.1.3.
- Product
- Sala
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Sala to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Ultimate Push Notifications: Missing AuthorizationCVE-2025-50028 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.
- Product
- Ultimate Push Notifications
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Ultimate Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025PW WooCommerce On Sale!: Missing AuthorizationCVE-2025-49888 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! pw-woocommerce-on-sale allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PW WooCommerce On Sale!: from n/a through <= 1.39.
- Product
- PW WooCommerce On Sale!
- Affected
- up to 1.39
- What to do
- Affects up to 1.39. Update PW WooCommerce On Sale! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Internal Linking of Related Contents: Missing AuthorizationCVE-2025-49884 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in alexvtn Internal Linking of Related Contents internal-linking-of-related-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Linking of Related Contents: from n/a through <= 1.1.8.
- Product
- Internal Linking of Related Contents
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Internal Linking of Related Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Wishlist for WooCommerce: Missing AuthorizationCVE-2025-49319 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.3.
- Product
- Wishlist for WooCommerce
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Profiler - What Slowing Down Your WP: Missing AuthorizationCVE-2025-48339 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in activity-log.com Profiler - What Slowing Down Your WP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Profiler - What Slowing Down Your WP: from n/a through 1.0.0.
- Product
- Profiler - What Slowing Down Your WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Profiler - What Slowing Down Your WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Product XML Feed Manager for WooCommerce: Missing AuthorizationCVE-2025-30959 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.2.
- Product
- Product XML Feed Manager for WooCommerce
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update Product XML Feed Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Multi-language Responsive Contact Form: Missing AuthorizationCVE-2025-29000 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in August Infotech Multi-language Responsive Contact Form responsive-contact-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Multi-language Responsive Contact Form: from n/a through <= 2.8.
- Product
- Multi-language Responsive Contact Form
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Multi-language Responsive Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025URL Shortener: Missing AuthorizationCVE-2025-28965 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects URL Shortener: from n/a through <= 3.0.7.
- Product
- URL Shortener
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update URL Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Cost Calculator: Missing AuthorizationCVE-2025-54047 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator: from n/a through <= 7.4.
- Product
- Cost Calculator
- Affected
- up to 7.4
- What to do
- Affects up to 7.4. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025News Kit Elementor Addons: Missing AuthorizationCVE-2025-54037 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.3.4.
- Product
- News Kit Elementor Addons
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update News Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025CM Pop-Up banners: Missing AuthorizationCVE-2025-54018 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through <= 1.8.4.
- Product
- CM Pop-Up banners
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update CM Pop-Up banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025SMTP2GO: Missing AuthorizationCVE-2025-54011 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2GO: from n/a through <= 1.12.1.
- Product
- SMTP2GO
- Affected
- up to 1.12.1
- What to do
- Affects up to 1.12.1. Update SMTP2GO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Houzez: Missing AuthorizationCVE-2025-53997 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4.
- Product
- Houzez
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Hestia: Missing AuthorizationCVE-2025-53986 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeisle Hestia hestia allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hestia: from n/a through <= 3.2.10.
- Product
- Hestia
- Affected
- up to 3.2.10
- What to do
- Affects up to 3.2.10. Update Hestia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Chatbox Manager: Missing AuthorizationCVE-2025-48167 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chatbox Manager: from n/a through <= 1.2.5.
- Product
- Chatbox Manager
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Chatbox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Stop and Block bots plugin Anti bots: Missing AuthorizationCVE-2025-48166 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sminozzi Stop and Block bots plugin Anti bots antibots allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Stop and Block bots plugin Anti bots: from n/a through <= 1.48.
- Product
- Stop and Block bots plugin Anti bots
- Affected
- up to 1.48
- What to do
- Affects up to 1.48. Update Stop and Block bots plugin Anti bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Residential Address Detection: Missing AuthorizationCVE-2025-48155 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Residential Address Detection: from n/a through <= 2.5.9.
- Product
- Residential Address Detection
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update Residential Address Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 16, 2025Real Estate Property 2024 Create Your Own Fields and Search Bar WP: Missing AuthorizationCVE-2025-48150 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin real-estate-right-now allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin: from n/a through <= 4.48.
- Product
- Real Estate Property 2024 Create Your Own Fields and Search Bar WP
- Affected
- up to 4.48
- What to do
- Affects up to 4.48. Update Real Estate Property 2024 Create Your Own Fields and Search Bar WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025MobiLoud: Missing AuthorizationCVE-2025-52813 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Missing Authorization vulnerability in pietro MobiLoud allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MobiLoud: from n/a through 4.6.5.
- Product
- MobiLoud
- Affected
- up to 4.6.5
- What to do
- Affects up to 4.6.5. Update MobiLoud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025VG WORT METIS: Missing AuthorizationCVE-2025-50039 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VG WORT METIS: from n/a through <= 2.0.1.
- Product
- VG WORT METIS
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update VG WORT METIS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025Paytiko for WooCommerce: Missing AuthorizationCVE-2025-50032 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce paytiko allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paytiko for WooCommerce: from n/a through <= 1.3.21.
- Product
- Paytiko for WooCommerce
- Affected
- up to 1.3.21
- What to do
- Affects up to 1.3.21. Update Paytiko for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025MF Plus WPML: Missing AuthorizationCVE-2025-49431 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MF Plus WPML: from n/a through <= 1.1.
- Product
- MF Plus WPML
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MF Plus WPML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025WC Pickup Store: Missing AuthorizationCVE-2025-47634 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Pickup Store: from n/a through <= 1.8.9.
- Product
- WC Pickup Store
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update WC Pickup Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025EventON: Missing AuthorizationCVE-2025-47565 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventON: from n/a through <= 4.9.9.
- Product
- EventON
- Affected
- up to 4.9.9
- What to do
- Affects up to 4.9.9. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025fluXtore: Missing AuthorizationCVE-2025-30929 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fluXtore: from n/a through <= 1.6.0.
- Product
- fluXtore
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update fluXtore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025CF7 7 Mailchimp Add-on: Missing AuthorizationCVE-2025-29012 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 7 Mailchimp Add-on: from n/a through < 2.4.
- Product
- CF7 7 Mailchimp Add-on
- What to do
- Update CF7 7 Mailchimp Add-on to the newest version.
Jul 4, 2025LMSACE Connect: Missing AuthorizationCVE-2025-29007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LMSACE Connect: from n/a through <= 3.4.
- Product
- LMSACE Connect
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update LMSACE Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025WooCommerce Shop Page Builder: Missing AuthorizationCVE-2025-29001 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
- Product
- WooCommerce Shop Page Builder
- Affected
- up to 2.27.7
- What to do
- Affects up to 2.27.7. Update WooCommerce Shop Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025uDesign: Missing AuthorizationCVE-2025-24757 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AndonDesign uDesign udesign.This issue affects uDesign: from n/a through <= 4.11.2.
- Product
- uDesign
- Affected
- up to 4.11.2
- What to do
- Affects up to 4.11.2. Update uDesign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2025Avada: Missing AuthorizationCVE-2025-24748 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.
- Product
- Avada
- Affected
- up to 7.11.10
- What to do
- Affects up to 7.11.10. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 3, 2025ProcessingJS for: Stored Cross-Site ScriptingCVE-2025-6039 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ProcessingJS for
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update ProcessingJS for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 3, 2025Melapress File Monitor: Missing AuthorizationCVE-2025-3702 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress File Monitor: from n/a through < 2.2.0.
- Product
- Melapress File Monitor
- Fixed in
- 2.2.0
- What to do
- Update Melapress File Monitor to 2.2.0 or newer.
Jul 2, 2025Mollie Payments for WooCommerce: Missing AuthorizationCVE-2025-39362 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce.This issue affects Mollie Payments for WooCommerce: from n/a through <= 8.0.2.
- Product
- Mollie Payments for WooCommerce
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update Mollie Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Cross-Site Request ForgeryCVE-2025-6459 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2025-6437 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Time-based SQL InjectionCVE-2025-5339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlocalhostwordfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Local File Inclusion which leads to Remote Code ExecutionCVE-2025-4689 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: SQL InjectionCVE-2025-4381 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.