Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 42 of 86
Jul 2, 2025Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager: Local File InclusionCVE-2025-4380 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.
- Product
- Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager
- Affected
- up to 4.89
- What to do
- Affects up to 4.89. Update Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 1, 2025The Plus Addons for Elementor Pro: Missing AuthorizationCVE-2025-46259 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a before 6.3.7.
- Product
- The Plus Addons for Elementor Pro
- Fixed in
- 6.3.7
- What to do
- Update The Plus Addons for Elementor Pro to 6.3.7 or newer.
Jun 30, 2025WP Lightbox 2: Does not correctly sanitize the value of the title attribute of links before using themCVE-2025-3745 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
- Product
- WP Lightbox 2
- Fixed in
- 3.0.6.8
- What to do
- Update WP Lightbox 2 to 3.0.6.8 or newer.
Jun 27, 2025Pre-Publish Post Checklist: Missing AuthorizationCVE-2025-53323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pre-Publish Post Checklist: from n/a through <= 3.1.
- Product
- Pre-Publish Post Checklist
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Pre-Publish Post Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Accept Authorize.NET Payments Using Contact Form 7: Insertion of Sensitive Information Into Sent DataCVE-2025-53322 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 accept-authorize-net-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Authorize.NET Payments Using Contact Form 7: from n/a through <= 2.5.
- Product
- Accept Authorize.NET Payments Using Contact Form 7
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Accept Authorize.NET Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025WP DB Booster: Missing AuthorizationCVE-2025-53318 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPManiax WP DB Booster wp-db-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP DB Booster: from n/a through <= 1.0.1.
- Product
- WP DB Booster
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP DB Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Accept Stripe Payments Using Contact Form 7: Insertion of Sensitive Information Into Sent DataCVE-2025-53309 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Stripe Payments Using Contact Form 7 accept-stripe-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Stripe Payments Using Contact Form 7: from n/a through <= 3.0.
- Product
- Accept Stripe Payments Using Contact Form 7
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Accept Stripe Payments Using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Contact Form – 7 : Hide Success Message: Missing AuthorizationCVE-2025-53304 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form – 7 : Hide Success Message: from n/a through <= 1.1.4.
- Product
- Contact Form – 7 : Hide Success Message
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Contact Form – 7 : Hide Success Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025iCount Payment Gateway: Missing AuthorizationCVE-2025-53295 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through <= 2.0.7.
- Product
- iCount Payment Gateway
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update iCount Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Dashboard Widget Sidebar: Missing AuthorizationCVE-2025-53293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through <= 1.2.3.
- Product
- Dashboard Widget Sidebar
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Dashboard Widget Sidebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025PlatiOnline Payments: Missing AuthorizationCVE-2025-53288 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlatiOnline Payments: from n/a through <= 7.0.0.
- Product
- PlatiOnline Payments
- Affected
- up to 7.0.0
- What to do
- Affects up to 7.0.0. Update PlatiOnline Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025CMS Blocks: Missing AuthorizationCVE-2025-53284 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMS Blocks: from n/a through <= 1.1.
- Product
- CMS Blocks
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CMS Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Cron Logger: Missing AuthorizationCVE-2025-53266 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cron Logger: from n/a through <= 1.3.0.
- Product
- Cron Logger
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Cron Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025HurryTimer: Missing AuthorizationCVE-2025-53255 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HurryTimer: from n/a through <= 2.13.1.
- Product
- HurryTimer
- Affected
- up to 2.13.1
- What to do
- Affects up to 2.13.1. Update HurryTimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025ChatBot: Missing AuthorizationCVE-2025-53200 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 6.7.3.
- Product
- ChatBot
- Affected
- up to 6.7.3
- What to do
- Affects up to 6.7.3. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Mobile DJ Manager: Missing AuthorizationCVE-2025-52824 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.
- Product
- Mobile DJ Manager
- Affected
- up to 1.7.8.3
- What to do
- Affects up to 1.7.8.3. Update Mobile DJ Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Trusty Whistleblowing: Missing AuthorizationCVE-2025-52818 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing trusty-whistleblowing-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusty Whistleblowing: from n/a through <= 2.0.1.
- Product
- Trusty Whistleblowing
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Trusty Whistleblowing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Abandoned Contact Form 7: Missing AuthorizationCVE-2025-52817 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Contact Form 7: from n/a through <= 2.2.
- Product
- Abandoned Contact Form 7
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Abandoned Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025WP SmartPay: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-25171 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP SmartPay: from n/a through <= 2.7.13.
- Product
- WP SmartPay
- Affected
- up to 2.7.13
- What to do
- Affects up to 2.7.13. Update WP SmartPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2025Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: Stored Cross-Site ScriptingCVE-2025-5275 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
- Product
- Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
- Affected
- up to 1.8.6.1
- Fixed in
- 1.8.6.1
- What to do
- Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to 1.8.6.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 20, 2025Import YouTube videos as WP Posts: Missing AuthorizationCVE-2025-52802 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through <= 2.1.
- Product
- Import YouTube videos as WP Posts
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Import YouTube videos as WP Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Enhanced Blocks – Page Builder Blocks for Gutenberg: Missing AuthorizationCVE-2025-50034 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks – Page Builder Blocks for Gutenberg enhanced-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Blocks – Page Builder Blocks for Gutenberg: from n/a through <= 1.4.1.
- Product
- Enhanced Blocks – Page Builder Blocks for Gutenberg
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Enhanced Blocks – Page Builder Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Zapier for: Missing AuthorizationCVE-2025-50010 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through <= 1.5.2.
- Product
- Zapier for
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Zapier for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Kata Plus: Missing AuthorizationCVE-2025-50009 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kata Plus: from n/a through <= 1.5.3.
- Product
- Kata Plus
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Kata Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: Missing AuthorizationCVE-2025-50008 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily: from n/a through <= 1.2.4.5.
- Product
- WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily
- Affected
- up to 1.2.4.5
- What to do
- Affects up to 1.2.4.5. Update WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WooCommerce Fortnox Integration: Missing AuthorizationCVE-2025-49998 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Fortnox Integration: from n/a through <= 4.5.5.
- Product
- WooCommerce Fortnox Integration
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update WooCommerce Fortnox Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Giveaways and Contests by RafflePress: Missing AuthorizationCVE-2025-49997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.18.
- Product
- Giveaways and Contests by RafflePress
- Affected
- up to 1.12.18
- What to do
- Affects up to 1.12.18. Update Giveaways and Contests by RafflePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-49996 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 8.4.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 8.4
- What to do
- Affects up to 8.4. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Cookie-Script.com: Missing AuthorizationCVE-2025-49993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in csarturas Cookie-Script.com cookie-script-com allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cookie-Script.com: from n/a through <= 1.2.1.
- Product
- Cookie-Script.com
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Cookie-Script.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP-Recall: Missing AuthorizationCVE-2025-49991 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/a through 16.26.14.
- Product
- WP-Recall
- Affected
- up to 16.26.14
- What to do
- Affects up to 16.26.14. Update WP-Recall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Contentstudio: Missing AuthorizationCVE-2025-49990 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contentstudio: from n/a through <= 1.3.7.
- Product
- Contentstudio
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025App Builder: Missing AuthorizationCVE-2025-49989 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in App Cheap App Builder app-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Builder: from n/a through <= 5.5.6.
- Product
- App Builder
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Contact Form 7 AWeber Extension: Missing AuthorizationCVE-2025-49988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through <= 0.1.40.
- Product
- Contact Form 7 AWeber Extension
- Affected
- up to 0.1.40
- What to do
- Affects up to 0.1.40. Update Contact Form 7 AWeber Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025CRM ERP Business Solution: Missing AuthorizationCVE-2025-49987 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CRM ERP Business Solution: from n/a through <= 1.13.
- Product
- CRM ERP Business Solution
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update CRM ERP Business Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Video List Manager: Missing AuthorizationCVE-2025-49986 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in thanhtungtnt Video List Manager video-list-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Video List Manager: from n/a through <= 1.7.
- Product
- Video List Manager
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP Customer Area: Missing AuthorizationCVE-2025-49982 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through <= 8.3.4.
- Product
- WP Customer Area
- Affected
- up to 8.3.4
- What to do
- Affects up to 8.3.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025User Roles and Capabilities: Missing AuthorizationCVE-2025-49981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through <= 1.2.6.
- Product
- User Roles and Capabilities
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update User Roles and Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP User Profile Avatar: Missing AuthorizationCVE-2025-49980 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.
- Product
- WP User Profile Avatar
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Media Hygiene: Missing AuthorizationCVE-2025-49979 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through <= 4.0.1.
- Product
- Media Hygiene
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Media Hygiene to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Notifier: Missing AuthorizationCVE-2025-49976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.12.
- Product
- Notifier
- Affected
- up to 2.7.12
- What to do
- Affects up to 2.7.12. Update Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025UpStream: a Project Management Plugin for: Missing AuthorizationCVE-2025-49974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through <= 2.1.1.
- Product
- UpStream: a Project Management Plugin for
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update UpStream: a Project Management Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: Missing AuthorizationCVE-2025-49973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: from n/a through <= 1.0.10.
- Product
- Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025eDS Responsive Menu: Missing AuthorizationCVE-2025-49971 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
- Product
- eDS Responsive Menu
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Hello FSE Blog: Missing AuthorizationCVE-2025-49970 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through <= 1.0.6.
- Product
- Hello FSE Blog
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Hello FSE Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Zara 4 Image Compression: Missing AuthorizationCVE-2025-49969 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through <= 1.2.17.2.
- Product
- Zara 4 Image Compression
- Affected
- up to 1.2.17.2
- What to do
- Affects up to 1.2.17.2. Update Zara 4 Image Compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Custom Post Carousels with Owl: Uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using itCVE-2025-5125 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.
- Product
- Custom Post Carousels with Owl
- Fixed in
- 1.4.12
- What to do
- Update Custom Post Carousels with Owl to 1.4.12 or newer.
Jun 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized view and modification of dataCVE-2025-4571 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 18, 2025Breeze: Missing AuthorizationCVE-2025-23999 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.13.
- Product
- Breeze
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025CubeWP Forms: Missing AuthorizationCVE-2025-49880 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.5.
- Product
- CubeWP Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Arconix FAQ: Missing AuthorizationCVE-2025-49874 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix FAQ: from n/a through <= 1.9.6.
- Product
- Arconix FAQ
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Arconix FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.