Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 52 of 86
Feb 25, 2025PrivateContent: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-26966 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.5.
- Product
- PrivateContent
- Affected
- up to 8.11.5
- What to do
- Affects up to 8.11.5. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Small Package Quotes – Unishippers Edition: Missing AuthorizationCVE-2025-26960 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.
- Product
- Small Package Quotes – Unishippers Edition
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Pie Register Premium: Missing AuthorizationCVE-2025-26948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
- Product
- Pie Register Premium
- Affected
- up to 3.8.3.2
- What to do
- Affects up to 3.8.3.2. Update Pie Register Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Order Limit for WooCommerce: Missing AuthorizationCVE-2025-26928 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Limit for WooCommerce: from n/a through <= 3.0.2.
- Product
- Order Limit for WooCommerce
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Order Limit for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Essential Blocks for Gutenberg: Missing AuthorizationCVE-2025-26871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.
- Product
- Essential Blocks for Gutenberg
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Sticky Header On Scroll: Missing AuthorizationCVE-2025-27356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header On Scroll: from n/a through <= 1.0.
- Product
- Sticky Header On Scroll
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Sticky Header On Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: Missing AuthorizationCVE-2025-27296 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: from n/a through <= 1.5.
- Product
- Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025WP-Asambleas: Missing AuthorizationCVE-2025-27294 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Asambleas: from n/a through <= 2.85.0.
- Product
- WP-Asambleas
- Affected
- up to 2.85.0
- What to do
- Affects up to 2.85.0. Update WP-Asambleas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Animated Text Block: Missing AuthorizationCVE-2025-26883 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Text Block: from n/a through <= 1.0.7.
- Product
- Animated Text Block
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Animated Text Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2025Distance Based Shipping Calculator: Missing AuthorizationCVE-2025-26764 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.22.
- Product
- Distance Based Shipping Calculator
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Distance Based Shipping Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2025Vitepos: Missing AuthorizationCVE-2025-26750 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vitepos: from n/a through <= 3.1.3.
- Product
- Vitepos
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 18, 2025MediCenter - Health Medical Clinic: Missing AuthorizationCVE-2025-27013 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MediCenter - Health Medical Clinic: from n/a through < 14.7.
- Product
- MediCenter - Health Medical Clinic
- What to do
- Update MediCenter - Health Medical Clinic to the newest version.
Feb 18, 2025Atarim: Missing AuthorizationCVE-2025-22657 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.0.9.
- Product
- Atarim
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Analytify: Missing AuthorizationCVE-2025-26773 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.5.0.
- Product
- Analytify
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update Analytify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Coder: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-13726 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Coder
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Coder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Track Logins: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-13608 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Track Logins
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Track Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2025Distance Based Shipping Calculator: Missing AuthorizationCVE-2025-26765 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.22.
- Product
- Distance Based Shipping Calculator
- Affected
- up to 2.0.22
- What to do
- Affects up to 2.0.22. Update Distance Based Shipping Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2025LTL Freight Quotes – Worldwide Express Edition: Missing AuthorizationCVE-2025-22291 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through <= 5.0.20.
- Product
- LTL Freight Quotes – Worldwide Express Edition
- Affected
- up to 5.0.20
- What to do
- Affects up to 5.0.20. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2025LTL Freight Quotes – Unishippers Edition: Missing AuthorizationCVE-2025-22289 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Unishippers Edition ltl-freight-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Unishippers Edition: from n/a through <= 2.5.8.
- Product
- LTL Freight Quotes – Unishippers Edition
- Affected
- up to 2.5.8
- What to do
- Affects up to 2.5.8. Update LTL Freight Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 15, 2025Maps Plugin using Google Maps for WordPress: Does not sanitise and escape some of its settingsCVE-2024-13306 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Maps Plugin using Google Maps for WordPress
- Fixed in
- 1.9.4
- What to do
- Update Maps Plugin using Google Maps for WordPress to 1.9.4 or newer.
Feb 15, 2025Maps Plugin using Google Maps for WordPress: Does not sanitise and escape some of its settingsCVE-2024-13208 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Maps Plugin using Google Maps for WordPress
- Fixed in
- 1.9.4
- What to do
- Update Maps Plugin using Google Maps for WordPress to 1.9.4 or newer.
Feb 14, 2025Bulk Menu Edit: Missing AuthorizationCVE-2025-24692 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in M.Code Bulk Menu Edit bulk-menu-edit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Menu Edit: from n/a through <= 1.3.
- Product
- Bulk Menu Edit
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Bulk Menu Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025IdeaPush: Missing AuthorizationCVE-2025-24607 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in Northern Beaches Websites IdeaPush ideapush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IdeaPush: from n/a through <= 8.71.
- Product
- IdeaPush
- Affected
- up to 8.71
- What to do
- Affects up to 8.71. Update IdeaPush to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Push Notification for Post and BuddyPress: Missing AuthorizationCVE-2025-23771 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through <= 2.11.
- Product
- Push Notification for Post and BuddyPress
- Affected
- up to 2.11
- What to do
- Affects up to 2.11. Update Push Notification for Post and BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025OPSI Israel Domestic Shipments: Missing AuthorizationCVE-2025-23766 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ashamil OPSI Israel Domestic Shipments woo-ups-pickup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OPSI Israel Domestic Shipments: from n/a through <= 2.8.2.
- Product
- OPSI Israel Domestic Shipments
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update OPSI Israel Domestic Shipments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Singsys -Awesome Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23748 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Singsys Singsys -Awesome Gallery awesome-gallery-singsys allows Reflected XSS.This issue affects Singsys -Awesome Gallery: from n/a through <= 1.0.
- Product
- Singsys -Awesome Gallery
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Singsys -Awesome Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025WPLingo: Missing AuthorizationCVE-2025-23534 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mark Winiarski WPLingo wplingo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLingo: from n/a through <= 1.1.2.
- Product
- WPLingo
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WPLingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Photography: Missing AuthorizationCVE-2025-22702 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in ThemeGoods Photography photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photography: from n/a through <= 7.7.2.
- Product
- Photography
- Affected
- up to 7.7.2
- What to do
- Affects up to 7.7.2. Update Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Accessibility Suite: Missing AuthorizationCVE-2025-22698 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.18.
- Product
- Accessibility Suite
- Affected
- up to 4.18
- What to do
- Affects up to 4.18. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2025Monetag Official: Missing AuthorizationCVE-2024-52500 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
- Product
- Monetag Official
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Monetag Official to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025BookPress – For Book Authors: Missing AuthorizationCVE-2025-25167 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Black and White BookPress – For Book Authors book-press allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookPress – For Book Authors: from n/a through <= 1.2.7.
- Product
- BookPress – For Book Authors
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update BookPress – For Book Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Slide Banners: Missing AuthorizationCVE-2025-25120 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Melodic Media Slide Banners slide-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slide Banners: from n/a through <= 1.3.
- Product
- Slide Banners
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Slide Banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Event Kikfyre: Missing AuthorizationCVE-2025-25110 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Kikfyre: from n/a through <= 2.1.8.
- Product
- Event Kikfyre
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Event Kikfyre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Embed RSS: Missing AuthorizationCVE-2025-25081 · WordPress plugins & themes · reported by PatchstackMedium 4.2
Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Embed RSS: from n/a through <= 3.1.
- Product
- Embed RSS
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Embed RSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Ksher: Missing AuthorizationCVE-2025-22730 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ksher: from n/a through <= 1.1.2.
- Product
- Ksher
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ksher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Document Block – Upload & Embed Docs: Missing AuthorizationCVE-2025-22696 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through <= 1.1.0.
- Product
- Document Block – Upload & Embed Docs
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Document Block – Upload & Embed Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025OnePress: Missing AuthorizationCVE-2025-22643 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in famethemes OnePress onepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnePress: from n/a through <= 2.3.11.
- Product
- OnePress
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update OnePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Image Gallery – Responsive Photo Gallery: Missing AuthorizationCVE-2025-24697 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Realwebcare Image Gallery – Responsive Photo Gallery awesome-responsive-photo-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Gallery – Responsive Photo Gallery: from n/a through <= 1.0.5.
- Product
- Image Gallery – Responsive Photo Gallery
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Image Gallery – Responsive Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025WPGuppy: Missing AuthorizationCVE-2025-24643 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPGuppy: from n/a through <= 1.1.0.
- Product
- WPGuppy
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Setup Default Featured Image: Missing AuthorizationCVE-2025-24642 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in theme funda Setup Default Featured Image setup-default-feature-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Setup Default Featured Image: from n/a through <= 1.2.
- Product
- Setup Default Featured Image
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Setup Default Featured Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025WC Wallet: Missing AuthorizationCVE-2025-23527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in hemnathmouli WC Wallet wc-wallet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WC Wallet: from n/a through <= 2.2.0.
- Product
- WC Wallet
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update WC Wallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Hide Shipping Method For WooCommerce: Missing AuthorizationCVE-2025-22694 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dotstore Hide Shipping Method For WooCommerce hide-shipping-method-for-woocommerce.This issue affects Hide Shipping Method For WooCommerce: from n/a through <= 1.5.1.
- Product
- Hide Shipping Method For WooCommerce
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Hide Shipping Method For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025CF7 Google Sheets Connector: Missing AuthorizationCVE-2025-22686 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WesternDeal CF7 Google Sheets Connector cf7-google-sheets-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Google Sheets Connector: from n/a through <= 5.0.17.
- Product
- CF7 Google Sheets Connector
- Affected
- up to 5.0.17
- What to do
- Affects up to 5.0.17. Update CF7 Google Sheets Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Content Cloner: Missing AuthorizationCVE-2025-22681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xfinitysoft Content Cloner super-seo-content-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Cloner: from n/a through <= 1.0.1.
- Product
- Content Cloner
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Content Cloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Uix Shortcodes: Missing AuthorizationCVE-2025-22677 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Missing Authorization vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uix Shortcodes: from n/a through <= 2.0.3.
- Product
- Uix Shortcodes
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Uix Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Meta Tag Manager: Missing AuthorizationCVE-2025-22260 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marcus (aka @msykes) Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through <= 3.1.
- Product
- Meta Tag Manager
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Meta Tag Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Shortcodes and extra features for Phlox: Missing AuthorizationCVE-2024-50500 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.4.
- Product
- Shortcodes and extra features for Phlox
- Affected
- up to 2.17.4
- What to do
- Affects up to 2.17.4. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025EZPZ SAML SP Single Sign On (SSO): Cross-Site Request Forgery (CSRF)CVE-2025-24749 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO) allows Cross Site Request Forgery. This issue affects EZPZ SAML SP Single Sign On (SSO): from n/a through 1.2.5.
- Product
- EZPZ SAML SP Single Sign On (SSO)
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update EZPZ SAML SP Single Sign On (SSO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Booking and Rental Manager: Missing AuthorizationCVE-2025-22720 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.2.1.
- Product
- Booking and Rental Manager
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025EMI Calculator: Missing AuthorizationCVE-2025-22265 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in mgplugin EMI Calculator emi-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EMI Calculator: from n/a through <= 1.1.
- Product
- EMI Calculator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update EMI Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.