Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 46 of 126
Dec 16, 2025Ultimate Auction: Missing AuthorizationCVE-2025-68084 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Nitesh Ultimate Auction ultimate-auction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Auction : from n/a through <= 4.3.3.
- Product
- Ultimate Auction
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update Ultimate Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Essential Real Estate: Authorization Bypass Through User-Controlled KeyCVE-2025-68071 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.
- Product
- Essential Real Estate
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Document Library Lite: Authorization Bypass Through User-Controlled KeyCVE-2025-67985 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Document Library Lite: from n/a through <= 1.1.7.
- Product
- Document Library Lite
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Document Library Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Watu Quiz: Missing AuthorizationCVE-2025-67976 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.
- Product
- Watu Quiz
- Affected
- up to 3.4.5
- What to do
- Affects up to 3.4.5. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Homey Core: Missing AuthorizationCVE-2025-67965 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.
- Product
- Homey Core
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Homey Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025SendPulse Email Marketing Newsletter: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.2.1.
- Product
- SendPulse Email Marketing Newsletter
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update SendPulse Email Marketing Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-67929 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
- Product
- TI WooCommerce Wishlist
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Lottier: Missing AuthorizationCVE-2025-66167 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Lottier lottier-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier: from n/a through <= 1.1.1.
- Product
- Lottier
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Lottier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Lottier for Elementor: Missing AuthorizationCVE-2025-66166 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Lottier for Elementor lottier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for Elementor: from n/a through <= 1.0.9.
- Product
- Lottier for Elementor
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Lottier for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Lottier for WPBakery: Missing AuthorizationCVE-2025-66165 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Lottier for WPBakery lottier-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for WPBakery: from n/a through <= 1.1.7.
- Product
- Lottier for WPBakery
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Lottier for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Laser: Missing AuthorizationCVE-2025-66164 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser: from n/a through <= 1.1.1.
- Product
- Laser
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Laser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Masker for Elementor: Missing AuthorizationCVE-2025-66163 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masker for Elementor: from n/a through <= 1.1.4.
- Product
- Masker for Elementor
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Masker for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Spoter for Elementor: Missing AuthorizationCVE-2025-66162 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spoter for Elementor: from n/a through <= 1.04.
- Product
- Spoter for Elementor
- Affected
- up to 1.04
- What to do
- Affects up to 1.04. Update Spoter for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Grider for Elementor: Missing AuthorizationCVE-2025-66161 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grider for Elementor: from n/a through <= 1.0.8.
- Product
- Grider for Elementor
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Grider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Coder for Elementor: Missing AuthorizationCVE-2025-66147 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Coder for Elementor coder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coder for Elementor: from n/a through <= 1.0.13.
- Product
- Coder for Elementor
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Coder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025FileBird Pro: Missing AuthorizationCVE-2025-66134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FileBird Pro: from n/a through <= 6.5.1.
- Product
- FileBird Pro
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update FileBird Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Missing AuthorizationCVE-2025-66133 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.7.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025FAPI Member: Authorization Bypass Through User-Controlled KeyCVE-2025-66132 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in FAPI Business s.r.o. FAPI Member fapi-member allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAPI Member: from n/a through <= 2.2.30.
- Product
- FAPI Member
- Affected
- up to 2.2.30
- What to do
- Affects up to 2.2.30. Update FAPI Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Yaad Sarig Payment Gateway For WC: Missing AuthorizationCVE-2025-66131 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yaad Sarig Payment Gateway For WC: from n/a through <= 2.2.11.
- Product
- Yaad Sarig Payment Gateway For WC
- Affected
- up to 2.2.11
- What to do
- Affects up to 2.2.11. Update Yaad Sarig Payment Gateway For WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Views Counter: Missing AuthorizationCVE-2025-66130 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Views Counter: from n/a through <= 2.1.2.
- Product
- WP Views Counter
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update WP Views Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Pochipp: Missing AuthorizationCVE-2025-66129 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through <= 1.18.0.
- Product
- Pochipp
- Affected
- up to 1.18.0
- What to do
- Affects up to 1.18.0. Update Pochipp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Sendinblue for WooCommerce: Missing AuthorizationCVE-2025-66128 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendinblue for WooCommerce: from n/a through <= 4.0.49.
- Product
- Sendinblue for WooCommerce
- Affected
- up to 4.0.49
- What to do
- Affects up to 4.0.49. Update Sendinblue for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Essential Real Estate: Missing AuthorizationCVE-2025-66127 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.
- Product
- Essential Real Estate
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Leaky Paywall: Missing AuthorizationCVE-2025-66124 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leaky Paywall: from n/a through <= 4.22.6.
- Product
- Leaky Paywall
- Affected
- up to 4.22.6
- What to do
- Affects up to 4.22.6. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Stylish Price List: Missing AuthorizationCVE-2025-66122 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Design Stylish Price List stylish-price-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stylish Price List: from n/a through <= 7.2.2.
- Product
- Stylish Price List
- Affected
- up to 7.2.2
- What to do
- Affects up to 7.2.2. Update Stylish Price List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025SiteGround Security: Missing AuthorizationCVE-2025-66121 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through <= 1.5.8.
- Product
- SiteGround Security
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025CatFolders: Missing AuthorizationCVE-2025-66120 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CatFolders: from n/a through <= 2.5.3.
- Product
- CatFolders
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update CatFolders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Compress for MainWP: Missing AuthorizationCVE-2025-64639 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.50.17.
- Product
- WP Compress for MainWP
- Affected
- up to 6.50.17
- What to do
- Affects up to 6.50.17. Update WP Compress for MainWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025OnPay.io for WooCommerce: Missing AuthorizationCVE-2025-64638 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47.
- Product
- OnPay.io for WooCommerce
- Affected
- up to 1.0.47
- What to do
- Affects up to 1.0.47. Update OnPay.io for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Feeds for YouTube: Missing AuthorizationCVE-2025-64635 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Feeds for YouTube: from n/a through <= 2.4.0.
- Product
- Feeds for YouTube
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Feeds for YouTube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Avada: Missing AuthorizationCVE-2025-64634 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through <= 7.13.2.
- Product
- Avada
- Affected
- up to 7.13.2
- What to do
- Affects up to 7.13.2. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Google XML Sitemaps: Missing AuthorizationCVE-2025-64632 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google XML Sitemaps: from n/a through <= 4.1.22.
- Product
- Google XML Sitemaps
- Affected
- up to 4.1.22
- What to do
- Affects up to 4.1.22. Update Google XML Sitemaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WCFM Marketplace: Missing AuthorizationCVE-2025-64631 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.
- Product
- WCFM Marketplace
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Business Directory: Missing AuthorizationCVE-2025-64630 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.19.
- Product
- Business Directory
- Affected
- up to 6.4.19
- What to do
- Affects up to 6.4.19. Update Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Ultimate Learning Pro: Missing AuthorizationCVE-2025-64251 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Learning Pro: from n/a through <= 3.9.3.
- Product
- Ultimate Learning Pro
- Affected
- up to 3.9.3
- What to do
- Affects up to 3.9.3. Update Ultimate Learning Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Protect WP Admin: Missing AuthorizationCVE-2025-64249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protect WP Admin: from n/a through <= 4.1.
- Product
- Protect WP Admin
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Protect WP Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Request a Quote: Missing AuthorizationCVE-2025-64248 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.
- Product
- Request a Quote
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Read More & Accordion: Missing AuthorizationCVE-2025-64247 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through <= 3.5.5.1.
- Product
- Read More & Accordion
- Affected
- up to 3.5.5.1
- What to do
- Affects up to 3.5.5.1. Update Read More & Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Accessibility by AudioEye: Missing AuthorizationCVE-2025-64246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through <= 1.0.49.
- Product
- Accessibility by AudioEye
- Affected
- up to 1.0.49
- What to do
- Affects up to 1.0.49. Update Accessibility by AudioEye to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Import external attachments: Missing AuthorizationCVE-2025-64245 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through <= 1.5.12.
- Product
- Import external attachments
- Affected
- up to 1.5.12
- What to do
- Affects up to 1.5.12. Update Import external attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Restrict Elementor Widgets, Columns and Sections: Missing AuthorizationCVE-2025-64244 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Elementor Widgets, Columns and Sections: from n/a through <= 1.12.
- Product
- Restrict Elementor Widgets, Columns and Sections
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Restrict Elementor Widgets, Columns and Sections to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Directory Pro: Missing AuthorizationCVE-2025-64243 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.
- Product
- Directory Pro
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Easy Property Listings: Missing AuthorizationCVE-2025-64242 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.22.
- Product
- Easy Property Listings
- Affected
- up to 3.5.22
- What to do
- Affects up to 3.5.22. Update Easy Property Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WP Coupons and Deals: Missing AuthorizationCVE-2025-64241 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Coupons and Deals: from n/a through <= 3.2.4.
- Product
- WP Coupons and Deals
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update WP Coupons and Deals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WPS Bidouille: Missing AuthorizationCVE-2025-64238 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through <= 1.33.1.
- Product
- WPS Bidouille
- Affected
- up to 1.33.1
- What to do
- Affects up to 1.33.1. Update WPS Bidouille to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025Salient Core: Missing AuthorizationCVE-2025-59001 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salient Core: from n/a through <= 3.0.8.
- Product
- Salient Core
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Salient Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025CM On Demand Search And Replace: Missing AuthorizationCVE-2025-54045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.5.
- Product
- CM On Demand Search And Replace
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update CM On Demand Search And Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025SKT Page Builder: Missing AuthorizationCVE-2025-54005 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SKT Page Builder: from n/a through <= 4.9.
- Product
- SKT Page Builder
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update SKT Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025WCFM – Frontend Manager for WooCommerce: Missing AuthorizationCVE-2025-54004 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through <= 6.7.24.
- Product
- WCFM – Frontend Manager for WooCommerce
- Affected
- up to 6.7.24
- What to do
- Affects up to 6.7.24. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2025JetFormBuilder — Dynamic Blocks Form Builder: Unauthorized modification of dataCVE-2025-11991 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.
- Product
- JetFormBuilder — Dynamic Blocks Form Builder
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update JetFormBuilder — Dynamic Blocks Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.