Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 49 of 86
Apr 1, 2025Sliced Invoices: Missing AuthorizationCVE-2025-31628 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SlicedInvoices Sliced Invoices sliced-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sliced Invoices: from n/a through <= 3.10.0.
- Product
- Sliced Invoices
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update Sliced Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ni WooCommerce Product Enquiry: Missing AuthorizationCVE-2025-31580 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry ni-woocommerce-product-enquiry allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ni WooCommerce Product Enquiry: from n/a through <= 4.1.8.
- Product
- Ni WooCommerce Product Enquiry
- Affected
- up to 4.1.8
- What to do
- Affects up to 4.1.8. Update Ni WooCommerce Product Enquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Mobile Bottom Menu: Missing AuthorizationCVE-2025-31525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah WP Mobile Bottom Menu mobile-bottom-menu-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mobile Bottom Menu: from n/a through <= 1.4.0.
- Product
- WP Mobile Bottom Menu
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WP Mobile Bottom Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025ShortPixel Adaptive Images: Missing AuthorizationCVE-2025-30853 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.10.0.
- Product
- ShortPixel Adaptive Images
- Affected
- up to 3.10.0
- What to do
- Affects up to 3.10.0. Update ShortPixel Adaptive Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: Missing AuthorizationCVE-2025-30825 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through <= 1.3.5.
- Product
- WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025MyBookProgress by Stormhill Media: Missing AuthorizationCVE-2025-31887 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in zookatron MyBookProgress by Stormhill Media mybookprogress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyBookProgress by Stormhill Media: from n/a through <= 1.0.8.
- Product
- MyBookProgress by Stormhill Media
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update MyBookProgress by Stormhill Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-31886 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.21.
- Product
- Social proof testimonials and reviews by Repuso
- Affected
- up to 5.21
- What to do
- Affects up to 5.21. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WebinarPress: Missing AuthorizationCVE-2025-31882 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.
- Product
- WebinarPress
- Affected
- up to 1.33.28
- What to do
- Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Pearl: Missing AuthorizationCVE-2025-31881 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Stylemix Pearl pearl-header-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pearl: from n/a through <= 1.3.9.
- Product
- Pearl
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Pearl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Barcode Generator for WooCommerce: Missing AuthorizationCVE-2025-31879 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Barcode Generator for WooCommerce: from n/a through <= 2.0.4.
- Product
- Barcode Generator for WooCommerce
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Barcode Generator for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025UPC/EAN/GTIN Code Generator: Missing AuthorizationCVE-2025-31878 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.
- Product
- UPC/EAN/GTIN Code Generator
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update UPC/EAN/GTIN Code Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025RestroPress: Missing AuthorizationCVE-2025-31877 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.8.
- Product
- RestroPress
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update RestroPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Clone any post type: Missing AuthorizationCVE-2025-31872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Clone any post type: from n/a through <= 3.6.
- Product
- WP Clone any post type
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update WP Clone any post type to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP AutoKeyword: Missing AuthorizationCVE-2025-31870 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP AutoKeyword: from n/a through <= 1.0.
- Product
- WP AutoKeyword
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP AutoKeyword to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Job Manager: Missing AuthorizationCVE-2025-31868 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through <= 2.0.2.
- Product
- JS Job Manager
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update JS Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025ShipDepot for WooCommerce: Missing AuthorizationCVE-2025-31866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ship Depot ShipDepot for WooCommerce ship-depot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipDepot for WooCommerce: from n/a through <= 1.2.19.
- Product
- ShipDepot for WooCommerce
- Affected
- up to 1.2.19
- What to do
- Affects up to 1.2.19. Update ShipDepot for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025CartBoss: Missing AuthorizationCVE-2025-31865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CartBoss CartBoss cartboss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartBoss: from n/a through <= 4.1.2.
- Product
- CartBoss
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update CartBoss to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Agency Toolkit: Missing AuthorizationCVE-2025-31863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Agency Toolkit: from n/a through <= 1.0.24.
- Product
- Agency Toolkit
- Affected
- up to 1.0.24
- What to do
- Affects up to 1.0.24. Update Agency Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Job Board Manager: Missing AuthorizationCVE-2025-31862 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.61.
- Product
- Job Board Manager
- Affected
- up to 2.1.61
- What to do
- Affects up to 2.1.61. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Export All Post Meta: Missing AuthorizationCVE-2025-31856 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in brainvireinfo Export All Post Meta export-all-post-meta allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export All Post Meta: from n/a through <= 1.2.1.
- Product
- Export All Post Meta
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Export All Post Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Simple Sticky Add To Cart For WooCommerce: Missing AuthorizationCVE-2025-31854 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sharaz Shahid Simple Sticky Add To Cart For WooCommerce sticky-add-to-cart-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Sticky Add To Cart For WooCommerce: from n/a through <= 1.4.9.
- Product
- Simple Sticky Add To Cart For WooCommerce
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Simple Sticky Add To Cart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Adverts: Missing AuthorizationCVE-2025-31848 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFactory Adverts adverts-click-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Adverts: from n/a through <= 1.4.
- Product
- Adverts
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Adverts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Theater for: Missing AuthorizationCVE-2025-31846 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.18.7.
- Product
- Theater for
- Affected
- up to 0.18.7
- What to do
- Affects up to 0.18.7. Update Theater for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025OpenAI Tools for WordPress & WooCommerce: Missing AuthorizationCVE-2025-31843 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wilson OpenAI Tools for WordPress & WooCommerce openai-tools-for-wp-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OpenAI Tools for WordPress & WooCommerce: from n/a through <= 2.2.1.
- Product
- OpenAI Tools for WordPress & WooCommerce
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update OpenAI Tools for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Review Manager: Missing AuthorizationCVE-2025-31836 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in matthewrubin Review Manager review-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Review Manager: from n/a through <= 2.5.0.
- Product
- Review Manager
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update Review Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JobBoard Job listing: Missing AuthorizationCVE-2025-31834 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeglow JobBoard Job listing job-board-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoard Job listing: from n/a through <= 1.2.8.
- Product
- JobBoard Job listing
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update JobBoard Job listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025AtomChat: Missing AuthorizationCVE-2025-31831 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Team AtomChat AtomChat atomchat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AtomChat: from n/a through <= 1.1.7.
- Product
- AtomChat
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update AtomChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Printus: Missing AuthorizationCVE-2025-31830 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Uriahs Victor Printus printus-cloud-printing-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printus: from n/a through <= 1.2.6.
- Product
- Printus
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Printus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ni WooCommerce Cost Of Goods: Missing AuthorizationCVE-2025-31826 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.
- Product
- Ni WooCommerce Cost Of Goods
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update Ni WooCommerce Cost Of Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WP Simple HTML Sitemap: Missing AuthorizationCVE-2025-31822 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.5.
- Product
- WP Simple HTML Sitemap
- Affected
- up to 3.5
- What to do
- Affects up to 3.5. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Automatic Featured Images from Videos: Missing AuthorizationCVE-2025-31820 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.4.
- Product
- Automatic Featured Images from Videos
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Mobile App Canvas: Missing AuthorizationCVE-2025-31816 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in pietro Mobile App Canvas mobile-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile App Canvas: from n/a through <= 3.8.2.
- Product
- Mobile App Canvas
- Affected
- up to 3.8.2
- What to do
- Affects up to 3.8.2. Update Mobile App Canvas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Question Answer: Missing AuthorizationCVE-2025-31810 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Question Answer question-answer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Question Answer: from n/a through <= 1.2.73.
- Product
- Question Answer
- Affected
- up to 1.2.73
- What to do
- Affects up to 1.2.73. Update Question Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Shiptimize for WooCommerce: Missing AuthorizationCVE-2025-31802 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiptimize for WooCommerce: from n/a through <= 3.1.86.
- Product
- Shiptimize for WooCommerce
- Affected
- up to 3.1.86
- What to do
- Affects up to 3.1.86. Update Shiptimize for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Publitio: Missing AuthorizationCVE-2025-31799 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Publitio: from n/a through <= 2.1.8.
- Product
- Publitio
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Publitio: Missing AuthorizationCVE-2025-31798 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Publitio: from n/a through <= 2.1.8.
- Product
- Publitio
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Pin Generator: Missing AuthorizationCVE-2025-31791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Oliver Boyers Pin Generator pin-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pin Generator: from n/a through <= 2.0.0.
- Product
- Pin Generator
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Pin Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Cue: Missing AuthorizationCVE-2025-31787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AudioTheme Cue cue allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cue: from n/a through <= 2.4.4.
- Product
- Cue
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Cue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Simple Icons: Missing AuthorizationCVE-2025-31786 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Travis Simple Icons simple-icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Icons: from n/a through <= 2.8.4.
- Product
- Simple Icons
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Simple Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025mb.YTPlayer: Missing AuthorizationCVE-2025-31782 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in pupunzi mb.YTPlayer wpmbytplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects mb.YTPlayer: from n/a through <= 3.3.8.
- Product
- mb.YTPlayer
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update mb.YTPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Gift Cards for WooCommerce: Missing AuthorizationCVE-2025-31781 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ahmadshyk Gift Cards for WooCommerce woo-giftcards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Cards for WooCommerce: from n/a through <= 1.5.8.
- Product
- Gift Cards for WooCommerce
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Gift Cards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Append Content: Missing AuthorizationCVE-2025-31780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Andy Stratton Append Content append-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Append Content: from n/a through <= 2.1.1.
- Product
- Append Content
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Append Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Clockinator Lite: Missing AuthorizationCVE-2025-31777 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BeastThemes Clockinator Lite clockify-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clockinator Lite: from n/a through <= 1.0.9.
- Product
- Clockinator Lite
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Clockinator Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Astra Security Suite: Missing AuthorizationCVE-2025-31774 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebProtect.ai Astra Security Suite getastra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Astra Security Suite: from n/a through <= 0.2.
- Product
- Astra Security Suite
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Astra Security Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ship Per Product: Missing AuthorizationCVE-2025-31773 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cedcommerce Ship Per Product ship-per-product allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ship Per Product: from n/a through <= 2.1.0.
- Product
- Ship Per Product
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Ship Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025GDPR Cookie Notice: Missing AuthorizationCVE-2025-31765 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeqx GDPR Cookie Notice gdpr-cookie-notice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR Cookie Notice: from n/a through <= 1.2.0.
- Product
- GDPR Cookie Notice
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update GDPR Cookie Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Free Woocommerce Product Table View: Missing AuthorizationCVE-2025-31757 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Free Woocommerce Product Table View: from n/a through <= 1.78.
- Product
- Free Woocommerce Product Table View
- Affected
- up to 1.78
- What to do
- Affects up to 1.78. Update Free Woocommerce Product Table View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025pCloud Backup: Missing AuthorizationCVE-2025-31755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in josselynj pCloud Backup pcloud-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pCloud Backup: from n/a through <= 1.0.1.
- Product
- pCloud Backup
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update pCloud Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Bulk Fields Editor: Missing AuthorizationCVE-2025-31752 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in termel Bulk Fields Editor bulk-user-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Fields Editor: from n/a through <= 1.8.0.
- Product
- Bulk Fields Editor
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Bulk Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025GB Gallery Slideshow: Missing AuthorizationCVE-2025-31732 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GB Gallery Slideshow: from n/a through <= 1.3.
- Product
- GB Gallery Slideshow
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.