Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 43 of 86
Jun 17, 2025myCred: Missing AuthorizationCVE-2025-49872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects myCred: from n/a through <= 2.9.4.2.
- Product
- myCred
- Affected
- up to 2.9.4.2
- What to do
- Affects up to 2.9.4.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025AFS Analytics: Missing AuthorizationCVE-2025-49864 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AFS Analytics AFS Analytics addfreestats allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AFS Analytics: from n/a through <= 4.21.
- Product
- AFS Analytics
- Affected
- up to 4.21
- What to do
- Affects up to 4.21. Update AFS Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025myCred: Missing AuthorizationCVE-2025-49857 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.4.2.
- Product
- myCred
- Affected
- up to 2.9.4.2
- What to do
- Affects up to 2.9.4.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025WP Dummy Content Generator: Missing AuthorizationCVE-2025-49234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through <= 3.4.6.
- Product
- WP Dummy Content Generator
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2025WordPress Single Sign-On (SSO): Unauthorized accessCVE-2025-6003 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.
- Product
- WordPress Single Sign-On (SSO)
- Affected
- up to the
- What to do
- Affects up to the. Update WordPress Single Sign-On (SSO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.miniorange.comwordfence.com
Jun 12, 2025The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file typCVE-2025-5012 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'workreap_temp_upload_to_media' function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jun 10, 2025Audio Editor & Recorder: Missing AuthorizationCVE-2025-49509 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audio Editor & Recorder: from n/a through <= 2.2.1.
- Product
- Audio Editor & Recorder
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Audio Editor & Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025inprosysmedia-likes-dislikes-post: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-4840 · WordPress plugins & themes · reported by WPScanHigh 7.5
The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- inprosysmedia-likes-dislikes-post
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update inprosysmedia-likes-dislikes-post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2025The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_CVE-2025-4387 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcap_add_to_cart_popup_upload_files function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may allow for either remote or local code execution depending on the server configuration.
- Affected
- up to 9.16.0
- What to do
- Affects up to 9.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtychesoftwares.comtychesoftwares.com
Jun 9, 2025Membership For WooCommerce: Missing AuthorizationCVE-2025-49265 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.8.1.
- Product
- Membership For WooCommerce
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025CryptoCloud - Crypto Payment Gateway: Missing AuthorizationCVE-2025-48147 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through <= 2.1.2.
- Product
- CryptoCloud - Crypto Payment Gateway
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update CryptoCloud - Crypto Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025StyleAI: Missing AuthorizationCVE-2025-48139 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in relentlo StyleAI relentlosoftware allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects StyleAI: from n/a through <= 1.0.4.
- Product
- StyleAI
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update StyleAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Icegram Collect: Missing AuthorizationCVE-2025-47527 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect: from n/a through <= 1.3.18.
- Product
- Icegram Collect
- Affected
- up to 1.3.18
- What to do
- Affects up to 1.3.18. Update Icegram Collect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Stock Locations for WooCommerce: Missing AuthorizationCVE-2025-47463 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 2.8.6.
- Product
- Stock Locations for WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Stock Locations for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Team Builder: Missing AuthorizationCVE-2025-32308 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in looks_awesome Team Builder a-team-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Builder: from n/a through <= 1.5.7.
- Product
- Team Builder
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Team Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025PayU India: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31022 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through < 3.8.8.
- Product
- PayU India
- What to do
- Update PayU India to the newest version.
Jun 9, 2025Password Policy Manager: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-31019 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4.
- Product
- Password Policy Manager
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Password Policy Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2025MaxiBlocks: Missing AuthorizationCVE-2025-47601 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Privilege Escalation.This issue affects MaxiBlocks: from n/a through <= 2.1.0.
- Product
- MaxiBlocks
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update MaxiBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Interactive Regional Map of Florida: Missing AuthorizationCVE-2025-49441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Map Plugins Interactive Regional Map of Florida interactive-map-of-florida allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Regional Map of Florida: from n/a through <= 1.0.
- Product
- Interactive Regional Map of Florida
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Interactive Regional Map of Florida to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Job Board Manager: Missing AuthorizationCVE-2025-49324 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.60.
- Product
- Job Board Manager
- Affected
- up to 2.1.60
- What to do
- Affects up to 2.1.60. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025FraudLabs Pro for WooCommerce: Missing AuthorizationCVE-2025-49320 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FraudLabs Pro for WooCommerce: from n/a through <= 2.22.11.
- Product
- FraudLabs Pro for WooCommerce
- Affected
- up to 2.22.11
- What to do
- Affects up to 2.22.11. Update FraudLabs Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Crawlomatic Multisite Scraper Post Generator: Missing AuthorizationCVE-2025-49293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
- Product
- Crawlomatic Multisite Scraper Post Generator
- Affected
- up to 2.6.8.2
- What to do
- Affects up to 2.6.8.2. Update Crawlomatic Multisite Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025PDF for WPForms: Missing AuthorizationCVE-2025-49289 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.5.0.
- Product
- PDF for WPForms
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Ultimate WP Mail: Missing AuthorizationCVE-2025-49288 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through <= 1.3.5.
- Product
- Ultimate WP Mail
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Product Feed for WooCommerce: Missing AuthorizationCVE-2025-49287 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.
- Product
- Product Feed for WooCommerce
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Trinity Audio: Missing AuthorizationCVE-2025-49272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0.
- Product
- Trinity Audio
- Affected
- up to 5.20.0
- What to do
- Affects up to 5.20.0. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP-CRM System: Missing AuthorizationCVE-2025-49270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.
- Product
- WP-CRM System
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Verge3D: Missing AuthorizationCVE-2025-49268 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.
- Product
- Verge3D
- Affected
- up to 4.9.4
- What to do
- Affects up to 4.9.4. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Team Showcase: Missing AuthorizationCVE-2025-49248 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cmoreira Team Showcase team-showcase-cm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Showcase: from n/a through < 25.05.13.
- Product
- Team Showcase
- What to do
- Update Team Showcase to the newest version.
Jun 6, 2025Testimonials Showcase: Missing AuthorizationCVE-2025-49246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.
- Product
- Testimonials Showcase
- Affected
- up to 1.9.16
- What to do
- Affects up to 1.9.16. Update Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025oik: Missing AuthorizationCVE-2025-49241 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in bobbingwide oik oik allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects oik: from n/a through <= 4.15.1.
- Product
- oik
- Affected
- up to 4.15.1
- What to do
- Affects up to 4.15.1. Update oik to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025DocsPress: Missing AuthorizationCVE-2025-49240 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPress: from n/a through <= 2.5.2.
- Product
- DocsPress
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update DocsPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Raychat: Missing AuthorizationCVE-2025-49236 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raychat Raychat raychat allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Raychat: from n/a through <= 2.1.0.
- Product
- Raychat
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Raychat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Payment QR WooCommerce: Missing AuthorizationCVE-2025-31000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Miguel Fuentes Payment QR WooCommerce payment-qr-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment QR WooCommerce: from n/a through <= 1.1.6.
- Product
- Payment QR WooCommerce
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Payment QR WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025ThemeHunk: Missing AuthorizationCVE-2025-30990 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeHunk: from n/a through <= 1.2.0.
- Product
- ThemeHunk
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update ThemeHunk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Slack Notifications by dorzki: Missing AuthorizationCVE-2025-30978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dor Zuberi Slack Notifications by dorzki dorzki-notifications-to-slack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slack Notifications by dorzki: from n/a through <= 2.0.7.
- Product
- Slack Notifications by dorzki
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Slack Notifications by dorzki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Post Grid Master: Missing AuthorizationCVE-2025-30974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid Master: from n/a through <= 3.4.17.
- Product
- Post Grid Master
- Affected
- up to 3.4.17
- What to do
- Affects up to 3.4.17. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025onOffice for WP-Websites: Missing AuthorizationCVE-2025-30958 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onOffice for WP-Websites: from n/a through <= 6.5.1.
- Product
- onOffice for WP-Websites
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update onOffice for WP-Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Activity Plus Reloaded for BuddyPress: Missing AuthorizationCVE-2025-30957 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
- Product
- Activity Plus Reloaded for BuddyPress
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Activity Plus Reloaded for BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Taskbuilder: Missing AuthorizationCVE-2025-30945 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in taskbuilder Taskbuilder taskbuilder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Taskbuilder: from n/a through <= 4.0.7.
- Product
- Taskbuilder
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Taskbuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025診断ジェネレータ作成プラグイン: Missing AuthorizationCVE-2025-30934 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OLIVESYSTEM 診断ジェネレータ作成プラグイン os-diagnosis-generator allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 診断ジェネレータ作成プラグイン: from n/a through <= 1.4.16.
- Product
- 診断ジェネレータ作成プラグイン
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update 診断ジェネレータ作成プラグイン to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP Compress for MainWP: Missing AuthorizationCVE-2025-30932 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.30.32.
- Product
- WP Compress for MainWP
- Affected
- up to 6.30.32
- What to do
- Affects up to 6.30.32. Update WP Compress for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Wordapp: Missing AuthorizationCVE-2025-30927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wordapp Team Wordapp wordapp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordapp: from n/a through <= 1.7.0.
- Product
- Wordapp
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Wordapp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Accessibility Suite: Missing AuthorizationCVE-2025-30636 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.19.
- Product
- Accessibility Suite
- Affected
- up to 4.19
- What to do
- Affects up to 4.19. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WordLift: Missing AuthorizationCVE-2025-30624 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WordLift WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through <= 3.54.4.
- Product
- WordLift
- Affected
- up to 3.54.4
- What to do
- Affects up to 3.54.4. Update WordLift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Custom Category/Post Type Post order: Missing AuthorizationCVE-2025-29013 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in faaiq Custom Category/Post Type Post order custom-post-order-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Category/Post Type Post order: from n/a through <= 1.6.0.
- Product
- Custom Category/Post Type Post order
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Custom Category/Post Type Post order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Behance Portfolio Manager: Missing AuthorizationCVE-2025-29010 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
- Product
- Behance Portfolio Manager
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Behance Portfolio Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Direct Checkout for WooCommerce Lite: Missing AuthorizationCVE-2025-29006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in centangle Direct Checkout for WooCommerce Lite woo-direct-checkout-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Direct Checkout for WooCommerce Lite: from n/a through <= 1.0.3.
- Product
- Direct Checkout for WooCommerce Lite
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Direct Checkout for WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP AutoKeyword: Missing AuthorizationCVE-2025-28997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP AutoKeyword: from n/a through <= 1.0.
- Product
- WP AutoKeyword
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP AutoKeyword to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025GPP Slideshow: Missing AuthorizationCVE-2025-28996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Thad Allender GPP Slideshow gpp-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GPP Slideshow: from n/a through <= 1.3.5.
- Product
- GPP Slideshow
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update GPP Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.