Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

4,614 results · page 52 of 93

Aug 28, 2025WPMU Ldap Authentication: Cross-Site Request Forgery (CSRF)CVE-2025-48343 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authentication: from n/a through <= 5.0.1.
Product
WPMU Ldap Authentication
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update WPMU Ldap Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025RingCentral Communications: Authentication BypassCVE-2025-7955 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_verify() function in versions 1.5 to 1.6.8. This makes it possible for unauthenticated attackers to log in as any user simply by supplying identical bogus codes.
Product
RingCentral Communications
Affected
1.5 to 1.6.8
What to do
Affects 1.5 to 1.6.8. Update RingCentral Communications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2025Tourfic: Unauthorized modification of dataCVE-2024-8860 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions in all versions up to, and including, 2.14.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively.
Product
Tourfic
Affected
up to 2.14.5
What to do
Affects up to 2.14.5. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2025Case Theme User: Authentication BypassCVE-2025-5821 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly logging in a user with the data that was previously verified through the facebook_ajax_login_callback() function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
Product
Case Theme User
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Case Theme User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 23, 2025Bravis User: Authentication BypassCVE-2025-5060 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callback(). This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site, and access to the administrative user's email.
Product
Bravis User
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Bravis User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 23, 2025Sertifier Certificate & Badge Maker for WordPress – Tutor LMS: Cross-Site Request ForgeryCVE-2025-7841 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19. This is due to missing or incorrect nonce validation on the 'sertifier_settings' page. This makes it possible for unauthenticated attackers to update the plugin's api key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Sertifier Certificate & Badge Maker for WordPress – Tutor LMS
Affected
up to 1.19
What to do
Affects up to 1.19. Update Sertifier Certificate & Badge Maker for WordPress – Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 23, 2025WP Filter & Combine RSS Feeds: Unauthorized modification of dataCVE-2025-7828 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Filter & Combine RSS Feeds plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the post_listing_page() function in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete feeds.
Product
WP Filter & Combine RSS Feeds
Affected
up to 0.4
What to do
Affects up to 0.4. Update WP Filter & Combine RSS Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 23, 2025Ni WooCommerce Customer Product Report: Unauthorized modification of dataCVE-2025-7827 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_woocpr_action() function in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings.
Product
Ni WooCommerce Customer Product Report
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Ni WooCommerce Customer Product Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 23, 2025WC Plus: Unauthorized modification of dataCVE-2025-7821 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJAX action in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update the site's favicon logo base.
Product
WC Plus
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WC Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 23, 2025Simpler Checkout: Authentication BypassCVE-2025-7642 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a user's identity prior to logging them in as an admin through the simplerwc_woocommerce_order_created() function. This makes it possible for unauthenticated attackers to log in as other users based on their order ID, which can be an administrator if a site admin has placed a test order.
Product
Simpler Checkout
Affected
0.7.0 to 1.1.9
What to do
Affects 0.7.0 to 1.1.9. Update Simpler Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 22, 2025Spacious: Unauthorized modification of dataCVE-2025-9331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo data into the site.
Product
Spacious
Affected
up to 1.9.11
What to do
Affects up to 1.9.11. Update Spacious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org themes.trac.wordpress.org
Aug 21, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-7221 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 20, 2025Taxi Booking Manager for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-54713 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.3.0.
Product
Taxi Booking Manager for WooCommerce
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025CM Map Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48151 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.1.6.
Product
CM Map Locations
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update CM Map Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2025ColorMag: Unauthorized modification of dataCVE-2025-9202 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the ThemeGrill Demo Importer plugin.
Product
ColorMag
Affected
up to 4.0.19
What to do
Affects up to 4.0.19. Update ColorMag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org themes.trac.wordpress.org
Aug 14, 2025WooCommerce OTP Login With Phone Number, OTP Verification: Authentication bypassCVE-2025-8342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
Product
WooCommerce OTP Login With Phone Number, OTP Verification
Affected
up to 1.8.47
What to do
Affects up to 1.8.47. Update WooCommerce OTP Login With Phone Number, OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2025Order Tip for WooCommerce: Unauthenticated Improper Input ValidationCVE-2025-6025 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.
Product
Order Tip for WooCommerce
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Order Tip for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2025Authentication and xmlrpc log writer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49037 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Federico Rota Authentication and xmlrpc log writer authentication-and-xmlrpc-log-writer allows Reflected XSS.This issue affects Authentication and xmlrpc log writer: from n/a through <= 1.2.2.
Product
Authentication and xmlrpc log writer
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Authentication and xmlrpc log writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2025Simple Local Avatars: Unauthorized modification of data in version 2CVE-2025-8482 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on the migrate_from_wp_user_avatar() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to migrate avatar metadata for all users.
Product
Simple Local Avatars
What to do
Update Simple Local Avatars to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 7, 2025Post SMTP: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-24000 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post SMTP: from n/a through <= 3.2.0.
Product
Post SMTP
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 5, 2025Zakra: Unauthorized data modificationCVE-2025-8595 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo settings.
Product
Zakra
Affected
up to 4.1.5
What to do
Affects up to 4.1.5. Update Zakra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org themes.trac.wordpress.org
Aug 5, 2025the third-party `uploadify.php` script: WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file uploadCVE-2012-10027 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
Product
the third-party `uploadify.php` script
Affected
up to 1.35.0
What to do
Affects up to 1.35.0. Update the third-party `uploadify.php` script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record web.archive.org raw.githubusercontent.com
Aug 5, 2025upload.php: The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file uploadCVE-2012-10026 · WordPress plugins & themes · reported by VulnCheckCritical 10
The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded, the attacker can execute the file via a direct HTTP GET request, resulting in remote code execution under the web server’s context.
Product
upload.php
What to do
Update upload.php to the newest version.
Full record and what to do →NVD record web.archive.org raw.githubusercontent.com
Aug 2, 2025Brave Conversion Engine (PRO): Authentication BypassCVE-2025-7710 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the plugin not properly restricting a claimed identity while authenticating with Facebook. This makes it possible for unauthenticated attackers to log in as other users, including administrators.
Product
Brave Conversion Engine (PRO)
Affected
up to 0.7.7
What to do
Affects up to 0.7.7. Update Brave Conversion Engine (PRO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record getbrave.io wordfence.com
Aug 2, 2025Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder): Unauthorized modification of dataCVE-2025-8488 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_hfe_compatibility_option_callback ()function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the compatibility option setting.
Product
Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2025WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons: Unauthorized modification of dataCVE-2025-8152 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and 'change_sticky_sidebar_name' functions in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to update the status of a sticky and update the name displayed in the back-end WP CTA Dashboard.
Product
WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2025HT Mega – Absolute Addons For Elementor: Unauthorized modification and loss of dataCVE-2025-8068 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability check on the 'ajax_trash_templates' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary attachment files, and move arbitrary posts, pages, and templates to the Trash.
Product
HT Mega – Absolute Addons For Elementor
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update HT Mega – Absolute Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 29, 2025Bonanza – WooCommerce Free Gifts Lite: Unauthorized modification of dataCVE-2025-6730 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success.
Product
Bonanza – WooCommerce Free Gifts Lite
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Bonanza – WooCommerce Free Gifts Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 26, 2025Melapress Login Security: Authentication BypassCVE-2025-6895 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token() function in versions 2.1.0 to 2.1.1. This makes it possible for unauthenticated attackers who know an arbitrary user meta value to bypass authentication checks and log in as that user.
Product
Melapress Login Security
Affected
2.1.0 to 2.1.1
What to do
Affects 2.1.0 to 2.1.1. Update Melapress Login Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 25, 2025Droip: Unauthorized modification and access of dataCVE-2025-5835 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform many actions as the AJAX hooks to several functions. Some potential impacts include arbitrary post deletion, arbitrary post creation, post duplication, settings update, user manipulation, and much more.
Product
Droip
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record droip.com wordfence.com
Jul 24, 2025Platform: Unauthorized modification of data that can lead to privilege escalationCVE-2015-10143 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_options() function in all versions up to 1.4.4 (exclusive). This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Platform
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.sucuri.net raw.githubusercontent.com
Jul 24, 2025WP Wallcreeper: Unauthorized modification of dataCVE-2025-7822 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Wallcreeper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_notices hook in all versions up to, and including, 1.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable and disable caching.
Product
WP Wallcreeper
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update WP Wallcreeper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2025Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition: Unauthenticated login token generationCVE-2025-6441 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthenticated login token generation due to a missing capability check on the `webinarignition_sign_in_support_staff` and `webinarignition_register_support` functions in all versions up to, and including, 4.03.32. This makes it possible for unauthenticated attackers to generate login tokens for arbitrary WordPress users under certain circumstances, issuing authorization cookies which can lead to authentication bypass.
Product
Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Affected
up to 4.03.32
What to do
Affects up to 4.03.32. Update Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 22, 2025Omnishop: Unauthenticated Registration BypassCVE-2025-6215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public (permission_callback always returns true) and invokes wp_create_user() unconditionally, ignoring the site’s users_can_register option and any nonce or CAPTCHA checks. This makes it possible for unauthenticated attackers to create arbitrary user accounts (customer) on sites where registrations should be closed.
Product
Omnishop
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Omnishop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 22, 2025The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to uploaCVE-2015-10140 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.
Product
Ajax Load More
Fixed in
2.8.1.2
What to do
Update Ajax Load More to 2.8.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 22, 2025Orion Login with SMS: Authentication BypassCVE-2025-7692 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olws_handle_verify_phone() function not utilizing a strong enough OTP value, exposing the hash needed to generate the OTP value, and no restrictions on the number of attempts to submit the code. This makes it possible for unauthenticated attackers to log in as other users, including administrators, if they have access to their phone number.
Product
Orion Login with SMS
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Orion Login with SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jul 18, 2025LoginPress Pro: Authentication bypassCVE-2025-7444 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
Product
LoginPress Pro
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update LoginPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record loginpress.pro wordfence.com
Jul 18, 2025Block Editor Gallery Slider: Unauthorized modification of dataCVE-2025-6726 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classic_gallery_slider_options() function in all versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited post meta for arbitrary posts.
Product
Block Editor Gallery Slider
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Block Editor Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 18, 2025Listly: Listicles For: Unauthorized modification of dataCVE-2025-5811 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Listly: Listicles For WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Init() function in all versions up to, and including, 2.7. This makes it possible for unauthenticated attackers to delete arbitrary transient values on the WordPress site.
Product
Listly: Listicles For
Affected
up to 2.7
What to do
Affects up to 2.7. Update Listly: Listicles For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jul 18, 2025Map My Locations: Stored Cross-Site ScriptingCVE-2025-7660 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Map My Locations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'map_my_locations' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Map My Locations
Affected
up to 1.1
What to do
Affects up to 1.1. Update Map My Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Jul 16, 2025Ultimate Push Notifications: Missing AuthorizationCVE-2025-50028 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.
Product
Ultimate Push Notifications
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Ultimate Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2025Premium Age Verification / Restriction for: Arbitrary file read and writeCVE-2025-7401 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remote_tunnel.php in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to read from or write to arbitrary files on the affected site's server which may make the exposure of sensitive information or remote code execution possible.
Product
Premium Age Verification / Restriction for
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Premium Age Verification / Restriction for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 8, 2025An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary userCVE-2025-34077 · WordPress plugins & themes · reported by VulnCheckCritical 10
An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting social_site=true and manipulating the user_id_social_site parameter, an attacker can generate a valid WordPress session cookie for any user ID, including administrators. Once authenticated, the attacker may exploit plugin upload functionality to install a malicious plugin containing arbitrary PHP code, resulting in remote code execution on the underlying server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jul 8, 2025Support Board: Unauthorized access/modification/deletion of dataCVE-2025-4855 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
Product
Support Board
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Support Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 8, 2025WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible: Unauthorized modification of dataCVE-2025-3780 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and modify the plugin settings, including payment details and API keys
Product
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Affected
up to 6.7.16
What to do
Affects up to 6.7.16. Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2025WP Compress: Weak AuthenticationCVE-2025-47479 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through <= 6.30.30.
Product
WP Compress
Affected
up to 6.30.30
What to do
Affects up to 6.30.30. Update WP Compress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 3, 2025WP Firebase Push Notification: Cross-Site Request ForgeryCVE-2025-5924 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpn_brodcast_notification_message() function. This makes it possible for unauthenticated attackers to send broadcast notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Firebase Push Notification
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update WP Firebase Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2025education: PHP Object InjectionCVE-2024-13786 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
education
Affected
up to 3.6.10
What to do
Affects up to 3.6.10. Update education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Jul 2, 2025Soumettre.fr: Unauthorized access and modification of dataCVE-2025-4654 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Soumettre.fr plugin for WordPress is vulnerable to unauthorized access and modification of data due to a improper authorization checks on the make_signature function in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to create/edit/delete Soumettre posts. This vulnerability affects only installations where the soumettre account is not connected (i.e. API key is not installed)
Product
Soumettre.fr
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Soumettre.fr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 27, 2025Relocate Upload: Cross-Site Request Forgery (CSRF)CVE-2025-53315 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alanft Relocate Upload relocate-upload allows Stored XSS.This issue affects Relocate Upload: from n/a through <= 0.24.1.
Product
Relocate Upload
Affected
up to 0.24.1
What to do
Affects up to 0.24.1. Update Relocate Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.