Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 51 of 86
Mar 27, 2025WpEvently: Missing AuthorizationCVE-2025-30887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through <= 4.2.9.
- Product
- WpEvently
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Trust.Reviews: Missing AuthorizationCVE-2025-30883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through <= 2.3.
- Product
- Trust.Reviews
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Trust.Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Big Store: Missing AuthorizationCVE-2025-30881 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themehunk Big Store big-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Big Store: from n/a through <= 2.0.8.
- Product
- Big Store
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Big Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Quiz Cat: Missing AuthorizationCVE-2025-30877 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in fatcatapps Quiz Cat quiz-cat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz Cat: from n/a through <= 3.0.8.
- Product
- Quiz Cat
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Quiz Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Specific Content For Mobile: Missing AuthorizationCVE-2025-30874 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jose Mortellaro Specific Content For Mobile specific-content-for-mobile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Specific Content For Mobile: from n/a through <= 0.5.3.
- Product
- Specific Content For Mobile
- Affected
- up to 0.5.3
- What to do
- Affects up to 0.5.3. Update Specific Content For Mobile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Terms & Conditions Per Product: Missing AuthorizationCVE-2025-30866 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through <= 1.2.15.
- Product
- Terms & Conditions Per Product
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update Terms & Conditions Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Exchange Rates: Missing AuthorizationCVE-2025-30864 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in falselight Exchange Rates exchange-rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exchange Rates: from n/a through <= 1.2.2.
- Product
- Exchange Rates
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Exchange Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Five Star Restaurant Reservations: Missing AuthorizationCVE-2025-30861 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.6.29.
- Product
- Five Star Restaurant Reservations
- Affected
- up to 2.6.29
- What to do
- Affects up to 2.6.29. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Tickera: Missing AuthorizationCVE-2025-30851 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.5.2.
- Product
- Tickera
- Affected
- up to 3.5.5.2
- What to do
- Affects up to 3.5.5.2. Update Tickera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2025-30839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.2.1.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Cool Author Box: Missing AuthorizationCVE-2025-30830 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cool Author Box: from n/a through <= 2.9.9.
- Product
- Cool Author Box
- Affected
- up to 2.9.9
- What to do
- Affects up to 2.9.9. Update Cool Author Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Timetics: Missing AuthorizationCVE-2025-30828 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.29.
- Product
- Timetics
- Affected
- up to 1.0.29
- What to do
- Affects up to 1.0.29. Update Timetics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Textmetrics: Missing AuthorizationCVE-2025-30824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Textmetrics: from n/a through <= 3.6.1.
- Product
- Textmetrics
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Textmetrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025SNORDIAN's H5PxAPIkatchu: Missing AuthorizationCVE-2025-30821 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in otacke SNORDIAN's H5PxAPIkatchu h5pxapikatchu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SNORDIAN's H5PxAPIkatchu: from n/a through <= 0.4.14.
- Product
- SNORDIAN's H5PxAPIkatchu
- Affected
- up to 0.4.14
- What to do
- Affects up to 0.4.14. Update SNORDIAN's H5PxAPIkatchu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Z Companion: Missing AuthorizationCVE-2025-30817 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wpzita Z Companion z-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Z Companion: from n/a through <= 1.0.13.
- Product
- Z Companion
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Z Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Live Forms: Missing AuthorizationCVE-2025-30809 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4.
- Product
- Live Forms
- Affected
- up to 4.8.4
- What to do
- Affects up to 4.8.4. Update Live Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Just Writing Statistics: Missing AuthorizationCVE-2025-30803 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Writing Statistics: from n/a through <= 5.3.
- Product
- Just Writing Statistics
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update Just Writing Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Chatbox Manager: Missing AuthorizationCVE-2025-30790 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chatbox Manager: from n/a through <= 1.2.2.
- Product
- Chatbox Manager
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Chatbox Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025WPC Smart Upsell Funnel for WooCommerce: Missing AuthorizationCVE-2025-30772 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.
- Product
- WPC Smart Upsell Funnel for WooCommerce
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update WPC Smart Upsell Funnel for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025PDF for WPForms: Missing AuthorizationCVE-2025-30767 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.3.0.
- Product
- PDF for WPForms
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2025WP-Recall: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9770 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP-Recall
- Fixed in
- 16.26.12
- What to do
- Update WP-Recall to 16.26.12 or newer.
Mar 25, 2025Product Labels For Woocommerce (Sale Badges): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12109 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Product Labels For Woocommerce (Sale Badges)
- Fixed in
- 1.5.9
- What to do
- Update Product Labels For Woocommerce (Sale Badges) to 1.5.9 or newer.
Mar 25, 2025Product Labels For Woocommerce (Sale Badges): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10638 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Product Labels For Woocommerce (Sale Badges)
- Fixed in
- 1.5.11
- What to do
- Update Product Labels For Woocommerce (Sale Badges) to 1.5.11 or newer.
Mar 24, 2025sourceplay-navermap: Missing AuthorizationCVE-2025-30605 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ldwin79 sourceplay-navermap sourceplay-navermap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects sourceplay-navermap: from n/a through <= 0.0.2.
- Product
- sourceplay-navermap
- Affected
- up to 0.0.2
- What to do
- Affects up to 0.0.2. Update sourceplay-navermap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Advanced Dewplayer: Missing AuthorizationCVE-2025-30592 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Dewplayer: from n/a through <= 1.6.
- Product
- Advanced Dewplayer
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Advanced Dewplayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Music Press Pro: Missing AuthorizationCVE-2025-30591 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through <= 1.4.6.
- Product
- Music Press Pro
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Music Press Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Top Bar: Missing AuthorizationCVE-2025-30581 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PluginOps Top Bar ultimate-bar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top Bar: from n/a through <= 3.3.
- Product
- Top Bar
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Top Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Menu Duplicator: Missing AuthorizationCVE-2025-30543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in swayam.tejwani Menu Duplicator copy-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Menu Duplicator: from n/a through <= 1.0.
- Product
- Menu Duplicator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Menu Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 23, 2025Pods: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1446 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Pods
- Fixed in
- 3.2.8.2
- What to do
- Update Pods to 3.2.8.2 or newer.
Mar 22, 2025GiveWP – Donation Plugin and Fundraising Platform: Sensitive Information ExposureCVE-2025-2331 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 3.22.1
- What to do
- Affects up to 3.22.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 15, 2025PrivateContent: Missing AuthorizationCVE-2025-26969 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.
- Product
- PrivateContent
- Affected
- up to 8.11.5
- What to do
- Affects up to 8.11.5. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 15, 2025Fresh Framework: Missing AuthorizationCVE-2025-26961 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Fresh Framework: from n/a through <= 1.70.0.
- Product
- Fresh Framework
- Affected
- up to 1.70.0
- What to do
- Affects up to 1.70.0. Update Fresh Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 15, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access of dataCVE-2025-2025 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 3.22.0
- What to do
- Affects up to 3.22.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2025DP ALTerminator - Missing ALT manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-28943 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager dp-alterminator-missing-alt-manager allows Stored XSS.This issue affects DP ALTerminator - Missing ALT manager: from n/a through <= 1.0.2.
- Product
- DP ALTerminator - Missing ALT manager
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update DP ALTerminator - Missing ALT manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025WP Performance Pack: Missing AuthorizationCVE-2025-28938 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Performance Pack: from n/a through <= 2.5.3.
- Product
- WP Performance Pack
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Performance Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Responsive Google Map: Missing AuthorizationCVE-2025-28920 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jogesh Responsive Google Map responsive-google-map allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Google Map: from n/a through <= 3.1.5.
- Product
- Responsive Google Map
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Responsive Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Block Spam By Math Reloaded: Missing AuthorizationCVE-2025-28872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.
- Product
- Block Spam By Math Reloaded
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Block Spam By Math Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Residential Address Detection: Missing AuthorizationCVE-2025-27270 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Privilege Escalation.This issue affects Residential Address Detection: from n/a through <= 2.5.4.
- Product
- Residential Address Detection
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Residential Address Detection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025WAH Forms: Missing AuthorizationCVE-2025-23763 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Alex Volkov WAH Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WAH Forms: from n/a through 1.0.
- Product
- WAH Forms
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WAH Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Interactive Page Hierarchy: Missing AuthorizationCVE-2025-23615 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in gtekelis Interactive Page Hierarchy interactive-page-hierarchy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Page Hierarchy: from n/a through <= 1.0.1.
- Product
- Interactive Page Hierarchy
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Interactive Page Hierarchy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025WP Journal: Missing AuthorizationCVE-2025-23613 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in mediabeta WP Journal wpjournal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Journal: from n/a through <= 1.1.
- Product
- WP Journal
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Journal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025ts-tree: Missing AuthorizationCVE-2025-23515 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tsecher ts-tree ts-tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ts-tree: from n/a through <= 0.1.1.
- Product
- ts-tree
- Affected
- up to 0.1.1
- What to do
- Affects up to 0.1.1. Update ts-tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025radSLIDE: Missing AuthorizationCVE-2025-23440 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in radicaldesigns radSLIDE radslide allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects radSLIDE: from n/a through <= 2.1.
- Product
- radSLIDE
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update radSLIDE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025SEO Plugin by Squirrly SEO: Missing AuthorizationCVE-2025-24654 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo.This issue affects SEO Plugin by Squirrly SEO: from n/a through <= 12.4.07.
- Product
- SEO Plugin by Squirrly SEO
- Affected
- up to 12.4.07
- What to do
- Affects up to 12.4.07. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2025DefendWP Firewall: Missing AuthorizationCVE-2025-22280 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.
- Product
- DefendWP Firewall
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update DefendWP Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2025Events Manager: Missing AuthorizationCVE-2025-1249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through <= 6.6.4.1.
- Product
- Events Manager
- Affected
- up to 6.6.4.1
- What to do
- Affects up to 6.6.4.1. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Simple Photo Feed: Missing AuthorizationCVE-2025-27000 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Photo Feed: from n/a through <= 1.4.0.
- Product
- Simple Photo Feed
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Simple Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Market Exporter: Missing AuthorizationCVE-2025-26995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Anton Vanyukov Market Exporter market-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Market Exporter: from n/a through <= 2.0.21.
- Product
- Market Exporter
- Affected
- up to 2.0.21
- What to do
- Affects up to 2.0.21. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2025-26983 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.3.
- Product
- Recipe Card Blocks for Gutenberg & Elementor
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Recipe Card Blocks for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Strong Testimonials: Missing AuthorizationCVE-2025-26975 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through <= 3.2.3.
- Product
- Strong Testimonials
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.