Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 45 of 86
May 19, 2025Majestic Support: Missing AuthorizationCVE-2025-48282 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.0.
- Product
- Majestic Support
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025WP Job Portal: Missing AuthorizationCVE-2025-48272 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.3.2.
- Product
- WP Job Portal
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Bot for Telegram on WooCommerce: Missing AuthorizationCVE-2025-48268 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Guru Team Bot for Telegram on WooCommerce bot-for-telegram-on-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bot for Telegram on WooCommerce: from n/a through <= 1.2.6.
- Product
- Bot for Telegram on WooCommerce
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Bot for Telegram on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Url Rewrite Analyzer: Missing AuthorizationCVE-2025-48262 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in M.Code Url Rewrite Analyzer url-rewrite-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Url Rewrite Analyzer: from n/a through <= 1.3.3.
- Product
- Url Rewrite Analyzer
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Url Rewrite Analyzer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-48260 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.3.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.3
- What to do
- Affects up to 2.7.3. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Projectopia: Missing AuthorizationCVE-2025-48257 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.
- Product
- Projectopia
- Affected
- up to 5.1.17
- What to do
- Affects up to 5.1.17. Update Projectopia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Shortlinks by Pretty Links: Missing AuthorizationCVE-2025-48247 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links pretty-link allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortlinks by Pretty Links: from n/a through <= 3.6.15.
- Product
- Shortlinks by Pretty Links
- Affected
- up to 3.6.15
- What to do
- Affects up to 3.6.15. Update Shortlinks by Pretty Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025The Events Calendar: Missing AuthorizationCVE-2025-48246 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.11.2.1.
- Product
- The Events Calendar
- Affected
- up to 6.11.2.1
- What to do
- Affects up to 6.11.2.1. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 19, 2025Legal Pages: Missing AuthorizationCVE-2025-48242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.5.
- Product
- Legal Pages
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Legal Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025BERTHA AI: Missing AuthorizationCVE-2025-48138 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.
- Product
- BERTHA AI
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update BERTHA AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Sharespine Woocommerce Connector: Missing AuthorizationCVE-2025-48128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector sharespine-woocommerce-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharespine Woocommerce Connector: from n/a through <= 4.7.55.
- Product
- Sharespine Woocommerce Connector
- Affected
- up to 4.7.55
- What to do
- Affects up to 4.7.55. Update Sharespine Woocommerce Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Push notification for Mobile and Web app: Missing AuthorizationCVE-2025-48127 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through <= 2.0.3.
- Product
- Push notification for Mobile and Web app
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Push notification for Mobile and Web app to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025WooCommerce POS: Missing AuthorizationCVE-2025-48117 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.
- Product
- WooCommerce POS
- Affected
- up to 1.7.8
- What to do
- Affects up to 1.7.8. Update WooCommerce POS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025EventON: Missing AuthorizationCVE-2025-48116 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ashan Perera EventON eventon-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 2.4.4.
- Product
- EventON
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025ProfileGrid: Missing AuthorizationCVE-2025-48079 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid : from n/a through <= 5.9.5.1.
- Product
- ProfileGrid
- Affected
- up to 5.9.5.1
- What to do
- Affects up to 5.9.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025EventON: Missing AuthorizationCVE-2025-47564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 4.9.8.
- Product
- EventON
- Affected
- up to 4.9.8
- What to do
- Affects up to 4.9.8. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025CURCY: Missing AuthorizationCVE-2025-47563 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CURCY: from n/a through <= 2.3.7.
- Product
- CURCY
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update CURCY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025MapSVG: Missing AuthorizationCVE-2025-47560 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through < 8.6.13.
- Product
- MapSVG
- What to do
- Update MapSVG to the newest version.
May 16, 2025CSS3 Compare Pricing Tables for: Missing AuthorizationCVE-2025-47556 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through <= 11.6.
- Product
- CSS3 Compare Pricing Tables for
- Affected
- up to 11.6
- What to do
- Affects up to 11.6. Update CSS3 Compare Pricing Tables for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Wordpress Auto Spinner: Missing AuthorizationCVE-2025-47534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through <= 3.25.0.
- Product
- Wordpress Auto Spinner
- Affected
- up to 3.25.0
- What to do
- Affects up to 3.25.0. Update Wordpress Auto Spinner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Pinterest Automatic Pin: Missing AuthorizationCVE-2025-39511 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinterest Automatic Pin: from n/a through <= 4.19.0.
- Product
- Pinterest Automatic Pin
- Affected
- up to 4.19.0
- What to do
- Affects up to 4.19.0. Update Pinterest Automatic Pin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Rankie: Missing AuthorizationCVE-2025-39493 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rankie: from n/a through < 1.8.2.
- Product
- Rankie
- Fixed in
- 1.8.2
- What to do
- Update Rankie to 1.8.2 or newer.
May 16, 2025Eventer: Missing AuthorizationCVE-2025-39482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.
- Product
- Eventer
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Simple Link Directory: Missing AuthorizationCVE-2025-32296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through < 14.8.1.
- Product
- Simple Link Directory
- What to do
- Update Simple Link Directory to the newest version.
May 16, 2025Salon Booking Pro: Missing AuthorizationCVE-2025-32295 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through <= 10.10.2.
- Product
- Salon Booking Pro
- Affected
- up to 10.10.2
- What to do
- Affects up to 10.10.2. Update Salon Booking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025CSS3 Accordions for: Missing AuthorizationCVE-2025-31923 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.
- Product
- CSS3 Accordions for
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update CSS3 Accordions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025The Business: Missing AuthorizationCVE-2025-31630 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Business: from n/a through 1.6.1.
- Product
- The Business
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update The Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025HotStar – Multi-Purpose Business: Missing AuthorizationCVE-2025-31071 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
- Product
- HotStar – Multi-Purpose Business
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HotStar – Multi-Purpose Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Acerola: Missing AuthorizationCVE-2025-31066 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acerola: from n/a through <= 1.6.5.
- Product
- Acerola
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Acerola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Rozario: Missing AuthorizationCVE-2025-31065 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4.
- Product
- Rozario
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Rozario to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Wishlist: Missing AuthorizationCVE-2025-31063 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in redqteam Wishlist wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist: from n/a through <= 2.1.0.
- Product
- Wishlist
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025WP-PManager: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2248 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-PManager WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP-PManager
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025FunnelKit: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-2203 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- FunnelKit
- Fixed in
- 3.10.2
- What to do
- Update FunnelKit to 3.10.2 or newer.
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9879 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Melapress File Monitor
- Fixed in
- 2.1.1
- What to do
- Update Melapress File Monitor to 2.1.1 or newer.
May 15, 2025Auto Affiliate Links: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Auto Affiliate Links
- Fixed in
- 6.4.7
- What to do
- Update Auto Affiliate Links to 6.4.7 or newer.
May 15, 2025Taskbuilder: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9831 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Taskbuilder
- Fixed in
- 3.0.9
- What to do
- Update Taskbuilder to 3.0.9 or newer.
May 15, 2025Simple Video Directory: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6809 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Simple Video Directory
- Fixed in
- 1.4.3
- What to do
- Update Simple Video Directory to 1.4.3 or newer.
May 15, 2025Push Notification for Post and BuddyPress: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6159 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Push Notification for Post and BuddyPress
- Fixed in
- 1.9.4
- What to do
- Update Push Notification for Post and BuddyPress to 1.9.4 or newer.
May 15, 2025Advance Post Prefix: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12735 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above to perform SQL injection attacks
- Product
- Advance Post Prefix
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Advance Post Prefix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Connexion Logs: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Connexion Logs
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Connexion Logs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025AHAthat: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11269 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks.
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025JSP Store Locator: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-11267 · WordPress plugins & themes · reported by WPScanHigh 8.8
The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor to perform SQL injection attacks.
- Product
- JSP Store Locator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update JSP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Sailthru Triggermail: Does not sanitise and escape some of its settings and is missing CSRF protectionCVE-2024-11141 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Melapress File Monitor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10009 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Melapress File Monitor
- Fixed in
- 2.1.0
- What to do
- Update Melapress File Monitor to 2.1.0 or newer.
May 15, 2025Jetpack Debug Tools: Missing AuthorizationCVE-2024-56006 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1.
- Product
- Jetpack Debug Tools
- Fixed in
- 2.0.1
- What to do
- Update Jetpack Debug Tools to 2.0.1 or newer.
May 15, 2025Tours: Missing AuthorizationCVE-2024-51666 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tosin Oguntuyi Tours tours.This issue affects Tours: from n/a through <= 1.0.0.
- Product
- Tours
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Tours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025Front End Users: Missing AuthorizationCVE-2025-47580 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through <= 3.2.35.
- Product
- Front End Users
- Affected
- up to 3.2.35
- What to do
- Affects up to 3.2.35. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Contentstudio: Missing AuthorizationCVE-2025-47692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contentstudio: from n/a through <= 1.3.5.
- Product
- Contentstudio
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Advanced File Manager: Missing AuthorizationCVE-2025-47688 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through <= 5.3.1.
- Product
- Advanced File Manager
- Affected
- up to 5.3.1
- What to do
- Affects up to 5.3.1. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025QS Dark Mode: Missing AuthorizationCVE-2025-47628 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in quomodosoft QS Dark Mode qs-dark-mode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QS Dark Mode: from n/a through <= 3.0.
- Product
- QS Dark Mode
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update QS Dark Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.