Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 43 of 126
Dec 31, 2025Knowband Mobile App Builder: Does not have authorisationCVE-2025-13029 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.
- Product
- Knowband Mobile App Builder
- Fixed in
- 3.0.0
- What to do
- Update Knowband Mobile App Builder to 3.0.0 or newer.
Dec 30, 2025SiteLock Security – WP Hardening, Login Security & Malware Scans: Missing AuthorizationCVE-2025-62128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through <= 5.0.1.
- Product
- SiteLock Security – WP Hardening, Login Security & Malware Scans
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update SiteLock Security – WP Hardening, Login Security & Malware Scans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Strong Testimonials: Unauthorized modification of dataCVE-2025-14426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.
- Product
- Strong Testimonials
- Affected
- up to 3.2.18
- What to do
- Affects up to 3.2.18. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 30, 2025ShopMagic: Missing AuthorizationCVE-2025-69093 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.
- Product
- ShopMagic
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update ShopMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Demo Importer Plus: Missing AuthorizationCVE-2025-69091 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.
- Product
- Demo Importer Plus
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Demo Importer Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025FiveStar: Authorization Bypass Through User-Controlled KeyCVE-2025-69032 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiveStar: from n/a through <= 1.7.
- Product
- FiveStar
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update FiveStar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Arcane: Missing AuthorizationCVE-2025-69031 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.
- Product
- Arcane
- Affected
- up to 3.6.6
- What to do
- Affects up to 3.6.6. Update Arcane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Backpack Traveler: Authorization Bypass Through User-Controlled KeyCVE-2025-69030 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3.
- Product
- Backpack Traveler
- Affected
- up to 2.10.3
- What to do
- Affects up to 2.10.3. Update Backpack Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Struktur: Authorization Bypass Through User-Controlled KeyCVE-2025-69029 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Struktur: from n/a through <= 2.5.1.
- Product
- Struktur
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Struktur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025weForms: Missing AuthorizationCVE-2025-69028 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.
- Product
- weForms
- Affected
- up to 1.6.25
- What to do
- Affects up to 1.6.25. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Product Delivery Date for WooCommerce – Lite: Missing AuthorizationCVE-2025-69027 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.
- Product
- Product Delivery Date for WooCommerce – Lite
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Product Delivery Date for WooCommerce – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025PopupKit: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-69026 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue affects PopupKit: from n/a through <= 2.1.5.
- Product
- PopupKit
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update PopupKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Poptics: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-69025 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.
- Product
- Poptics
- Affected
- up to 1.0.20
- What to do
- Affects up to 1.0.20. Update Poptics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025BizPrint: Missing AuthorizationCVE-2025-69024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.
- Product
- BizPrint
- Affected
- up to 4.6.7
- What to do
- Affects up to 4.6.7. Update BizPrint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Discussion Board: Missing AuthorizationCVE-2025-69023 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.
- Product
- Discussion Board
- Affected
- up to 2.5.7
- What to do
- Affects up to 2.5.7. Update Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025HR Management Lite: Missing AuthorizationCVE-2025-69022 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.
- Product
- HR Management Lite
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update HR Management Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Shortcodes and extra features for Phlox: Missing AuthorizationCVE-2025-69016 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.
- Product
- Shortcodes and extra features for Phlox
- Affected
- up to 2.17.22
- What to do
- Affects up to 2.17.22. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Crowdsignal Forms: Missing AuthorizationCVE-2025-69015 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.
- Product
- Crowdsignal Forms
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Crowdsignal Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Stratum: Missing AuthorizationCVE-2025-69013 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.
- Product
- Stratum
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Stratum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Event Organiser: Missing AuthorizationCVE-2025-69012 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.
- Product
- Event Organiser
- Affected
- up to 3.12.8
- What to do
- Affects up to 3.12.8. Update Event Organiser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Themebeez Toolkit: Missing AuthorizationCVE-2025-69010 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.
- Product
- Themebeez Toolkit
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Themebeez Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Medicalequipment: Missing AuthorizationCVE-2025-69009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.
- Product
- Medicalequipment
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Medicalequipment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025wpDiscuz: Authorization Bypass Through User-Controlled KeyCVE-2025-68997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.
- Product
- wpDiscuz
- Affected
- up to 7.6.43
- What to do
- Affects up to 7.6.43. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025My Sticky Elements: Missing AuthorizationCVE-2025-68995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.
- Product
- My Sticky Elements
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update My Sticky Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Product Loops for WooCommerce: Missing AuthorizationCVE-2025-68994 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce: from n/a through <= 2.1.2.
- Product
- Product Loops for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Product Loops for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Share, Print and PDF Products for WooCommerce: Missing AuthorizationCVE-2025-68993 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share, Print and PDF Products for WooCommerce: from n/a through <= 3.1.2.
- Product
- Share, Print and PDF Products for WooCommerce
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Share, Print and PDF Products for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025E-Invoice App Malaysia: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.
- Product
- E-Invoice App Malaysia
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update E-Invoice App Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025DesignThemes LMS Addon: Missing AuthorizationCVE-2025-68982 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.
- Product
- DesignThemes LMS Addon
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update DesignThemes LMS Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025HomeFix Elementor Portfolio: Missing AuthorizationCVE-2025-68981 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.
- Product
- HomeFix Elementor Portfolio
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update HomeFix Elementor Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025WeDesignTech Portfolio: Missing AuthorizationCVE-2025-68980 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.
- Product
- WeDesignTech Portfolio
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WeDesignTech Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Google Calendar Events: Authorization Bypass Through User-Controlled KeyCVE-2025-68979 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Calendar Events: from n/a through <= 3.5.9.
- Product
- Google Calendar Events
- Affected
- up to 3.5.9
- What to do
- Affects up to 3.5.9. Update Google Calendar Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Eagle Booking: Missing AuthorizationCVE-2025-68976 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.
- Product
- Eagle Booking
- Affected
- up to 1.3.4.3
- What to do
- Affects up to 1.3.4.3. Update Eagle Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 30, 2025Eagle Booking: Authorization Bypass Through User-Controlled KeyCVE-2025-68975 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.
- Product
- Eagle Booking
- Affected
- up to 1.3.4.3
- What to do
- Affects up to 1.3.4.3. Update Eagle Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025JetTabs: Missing AuthorizationCVE-2025-68498 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12.
- Product
- JetTabs
- Affected
- up to 2.2.12
- What to do
- Affects up to 2.2.12. Update JetTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025CubeWP: Missing AuthorizationCVE-2025-68036 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CubeWP: from n/a through <= 1.1.27.
- Product
- CubeWP
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update CubeWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025Better Elementor Addons: Missing AuthorizationCVE-2023-41656 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wpdive Better Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Elementor Addons: from n/a through 1.3.7.
- Product
- Better Elementor Addons
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Better Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025JetBlog: Missing AuthorizationCVE-2025-68503 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetBlog: from n/a through <= 2.4.7.
- Product
- JetBlog
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025JetPopup: Authorization Bypass Through User-Controlled KeyCVE-2025-68502 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through <= 2.0.20.1.
- Product
- JetPopup
- Affected
- up to 2.0.20.1
- What to do
- Affects up to 2.0.20.1. Update JetPopup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025Plugin Optimizer: Missing AuthorizationCVE-2025-68861 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in pluginoptimizer Plugin Optimizer plugin-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin Optimizer: from n/a through <= 1.3.7.
- Product
- Plugin Optimizer
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Plugin Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 25, 2025Frontend Post Submission Manager Lite – Frontend Posting: Unauthorized loss of dataCVE-2025-14913 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
- Product
- Frontend Post Submission Manager Lite – Frontend Posting
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Frontend Post Submission Manager Lite – Frontend Posting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 24, 2025Userpro: Missing AuthorizationCVE-2025-68608 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in DeluxeThemes Userpro userpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Userpro: from n/a through <= 5.1.9.
- Product
- Userpro
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Userpro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025PostX: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.This issue affects PostX: from n/a through <= 5.0.3.
- Product
- PostX
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Editorial Calendar: Missing AuthorizationCVE-2025-68603 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editorial Calendar: from n/a through <= 3.8.8.
- Product
- Editorial Calendar
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Bit Assist: Missing AuthorizationCVE-2025-68596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bit Assist: from n/a through <= 1.5.11.
- Product
- Bit Assist
- Affected
- up to 1.5.11
- What to do
- Affects up to 1.5.11. Update Bit Assist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Widgets for Social Photo Feed: Missing AuthorizationCVE-2025-68595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.
- Product
- Widgets for Social Photo Feed
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Widgets for Social Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Missing AuthorizationCVE-2025-68594 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.12.0.
- Product
- Poll, Survey & Quiz Maker Plugin by Opinion Stage
- Affected
- up to 19.12.0
- What to do
- Affects up to 19.12.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Adminify: Missing AuthorizationCVE-2025-68593 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
- Product
- WP Adminify
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025WP Adminify: Missing AuthorizationCVE-2025-68592 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
- Product
- WP Adminify
- Affected
- up to 4.0.6.1
- What to do
- Affects up to 4.0.6.1. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 24, 2025Simple File List: Missing AuthorizationCVE-2025-68591 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.18.
- Product
- Simple File List
- Affected
- up to 6.1.18
- What to do
- Affects up to 6.1.18. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.