Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

6,267 results · page 52 of 126

Nov 13, 2025Booster for WooCommerce: Missing AuthorizationCVE-2025-64379 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through <= 7.4.0.
Product
Booster for WooCommerce
Affected
up to 7.4.0
What to do
Affects up to 7.4.0. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025YOP Poll: Missing AuthorizationCVE-2025-64370 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YOP YOP Poll yop-poll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YOP Poll: from n/a through <= 6.5.38.
Product
YOP Poll
Affected
up to 6.5.38
What to do
Affects up to 6.5.38. Update YOP Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025Contact Form Email: Missing AuthorizationCVE-2025-64369 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.58.
Product
Contact Form Email
Affected
up to 1.3.58
What to do
Affects up to 1.3.58. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025ChatBot: Missing AuthorizationCVE-2025-64277 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.3.9.
Product
ChatBot
Affected
up to 7.3.9
What to do
Affects up to 7.3.9. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025Survey Maker: Missing AuthorizationCVE-2025-64276 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ays Pro Survey Maker survey-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Survey Maker: from n/a through <= 5.1.9.4.
Product
Survey Maker
Affected
up to 5.1.9.4
What to do
Affects up to 5.1.9.4. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025WPKoi Templates for Elementor: Missing AuthorizationCVE-2025-64274 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.4.4.
Product
WPKoi Templates for Elementor
Affected
up to 3.4.4
What to do
Affects up to 3.4.4. Update WPKoi Templates for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025WooCommerce PDF Invoice Builder: Missing AuthorizationCVE-2025-64269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.
Product
WooCommerce PDF Invoice Builder
Affected
up to 1.2.150
What to do
Affects up to 1.2.150. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025WooCommerce Ultimate Points And Rewards: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultimate-points-and-rewards allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Ultimate Points And Rewards: from n/a through <= 2.10.2.
Product
WooCommerce Ultimate Points And Rewards
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update WooCommerce Ultimate Points And Rewards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025Frontend File Manager: Missing AuthorizationCVE-2025-64265 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.2.
Product
Frontend File Manager
Affected
up to 23.2
What to do
Affects up to 23.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025WP Content Pilot: Missing AuthorizationCVE-2025-64263 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in PluginEver WP Content Pilot wp-content-pilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Content Pilot: from n/a through <= 2.1.7.
Product
WP Content Pilot
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update WP Content Pilot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025Appointment Booking Calendar: Missing AuthorizationCVE-2025-64261 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.95.
Product
Appointment Booking Calendar
Affected
up to 1.3.95
What to do
Affects up to 1.3.95. Update Appointment Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025Theater for: Missing AuthorizationCVE-2025-64259 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.18.8.
Product
Theater for
Affected
up to 0.18.8
What to do
Affects up to 0.18.8. Update Theater for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed: Unauthorized modification of dataCVE-2025-12015 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_wpqai_disconnect_quicq_afosto' AJAX endpoint in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect Afosto
Product
Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 13, 2025Survey Maker: Unauthorized access of dataCVE-2025-12891 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endpoint in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to view all survey submissions.
Product
Survey Maker
Affected
up to 5.1.9.4
What to do
Affects up to 5.1.9.4. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Welcart e-Commerce: Unauthorized access of dataCVE-2025-12979 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all versions up to, and including, 2.11.24. This makes it possible for unauthenticated attackers to access configured payment credentials (ex. PayPal api secret) , as well as business contact details, mail templates, and other operational settings tied to the store.
Product
Welcart e-Commerce
Affected
up to 2.11.24
What to do
Affects up to 2.11.24. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Survey Maker: Unauthorized modification of dataCVE-2025-12892 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 5.1.9.4. This makes it possible for unauthenticated attackers to update the ays_survey_maker_upgrade_plugin option.
Product
Survey Maker
Affected
up to 5.1.9.4
What to do
Affects up to 5.1.9.4. Update Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Payment Plugins Braintree For WooCommerce: Authorization bypassCVE-2025-12903 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/vaulted_nonce REST API endpoint in all versions up to, and including, 3.2.78. This is due to the endpoint being registered with permission_callback set to __return_true and processing user-supplied token IDs without verifying ownership or authentication. This makes it possible for unauthenticated attackers to retrieve payment method nonces for any stored payment token in the system, which can be used to create fraudulent transactions, charge customer credit cards, or attach payment methods to other subscriptions.
Product
Payment Plugins Braintree For WooCommerce
Affected
up to 3.2.78
What to do
Affects up to 3.2.78. Update Payment Plugins Braintree For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of sensitive informationCVE-2025-12732 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting() function in all versions up to, and including, 7.33. This makes it possible for authenticated attackers, with Author-level access or higher, to extract sensitive information including OpenAI API keys configured through the plugin's admin interface.
Product
WP Import – Ultimate CSV XML Importer for
Affected
up to 7.33
What to do
Affects up to 7.33. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2025Booking Calendar | Appointment Booking | Bookit: Unauthorized modification of dataCVE-2025-12633 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to connect their Stripe account and receive payments.
Product
Booking Calendar | Appointment Booking | Bookit
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Booking Calendar | Appointment Booking | Bookit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 12, 2025Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images: Unauthorized loss of dataCVE-2025-12113 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the atgai_delete_api_key() function in all versions up to, and including, 1.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the API key connected to the site.
Product
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Classified Listing – AI-Powered Classified ads & Business Directory: Unauthorized modification of dataCVE-2025-12953 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the "rtcl_ajax_add_listing_type", "rtcl_ajax_update_listing_type", and "rtcl_ajax_delete_listing_type" function in all versions up to, and including, 5.2.0. This makes it possible for authenticated attackers, with subscriber level access and above, to add, update, or delete listing types.
Product
Classified Listing – AI-Powered Classified ads & Business Directory
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update Classified Listing – AI-Powered Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025Hydra Booking — Appointment Scheduling & Booking Calendar: Unauthorized booking cancellationCVE-2025-12787 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhb_meeting_form_submit_callback" function using insufficiently random values to generate booking cancellation tokens, combined with a globally shared nonce. This makes it possible for unauthenticated attackers to cancel arbitrary bookings via brute force attacks against the tfhb_meeting_form_cencel AJAX endpoint.
Product
Hydra Booking — Appointment Scheduling & Booking Calendar
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update Hydra Booking — Appointment Scheduling & Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 11, 2025age-restriction: Does not have authorisation in the age_restrictionRemoteSupportRequest functionCVE-2025-11855 · WordPress plugins & themes · reported by WPScanHigh 7.5
The age-restriction WordPress plugin through 3.0.2 does not have authorisation in the age_restrictionRemoteSupportRequest function, allowing any authenticated users, such as subscriber to create an admin user with a hardcoded username and arbitrary password.
Product
age-restriction
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update age-restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 11, 2025Make Email Customizer for WooCommerce: Lacks proper authorization checks and option validation in its AJAX actionsCVE-2025-11237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.
Product
Make Email Customizer for WooCommerce
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Make Email Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Nov 10, 2025Ninja Countdown | Fastest Countdown Builder: Unauthorized loss of dataCVE-2025-12665 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary countdowns.
Product
Ninja Countdown | Fastest Countdown Builder
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Ninja Countdown | Fastest Countdown Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 10, 2025Private Google Calendars: Unauthorized modification of dataCVE-2025-12526 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgc_remove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
Product
Private Google Calendars
Affected
up to 20250811
What to do
Affects up to 20250811. Update Private Google Calendars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Authors List: Sensitive Information ExposureCVE-2025-12010 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Authors List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.6.1 via the via arbitrary method call from Authors_List_Shortcode class. This makes it possible for authenticated attackers, with Contributor-level access and above, to call methods such as get_meta to extract sensitive user data including password hashes, email addresses, usernames, and activation keys via specially crafted shortcode attributes
Product
Authors List
Affected
up to 2.0.6.1
What to do
Affects up to 2.0.6.1. Update Authors List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Add Multiple Marker: Unauthorized modification of data toCVE-2025-11999 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarker_reset_map() and amm_save_map_api() functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to update the map API and reset maps.
Product
Add Multiple Marker
Affected
up to 1.2
What to do
Affects up to 1.2. Update Add Multiple Marker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Find Unused Images: Unauthorized loss of dataCVE-2025-11996 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fui_delete_image() and fui_delete_all_images() functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site's attachments.
Product
Find Unused Images
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Find Unused Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Crypto: Unauthorized manipulation of dataCVE-2025-11988 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Crypto plugin for WordPress is vulnerable to unauthorized manipulation of data in all versions up to, and including, 2.22. This is due to the plugin registering an unauthenticated AJAX action (wp_ajax_nopriv_crypto_connect_ajax_process) that allows calling the crypto_delete_json method with only a publicly-available nonce check. This makes it possible for unauthenticated attackers to delete specific JSON files matching the pattern *_pending.json within the wp-content/uploads/yak/ directory, causing data loss and denial of service for plugin workflows that rely on these artifacts.
Product
Crypto
Affected
up to 2.22
What to do
Affects up to 2.22. Update Crypto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025Shelf Planner: Unauthorized modification of dataCVE-2025-11894 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings like the ServerKey and LicenseKey.
Product
Shelf Planner
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Shelf Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 8, 2025Gallery Plugin for WordPress – Envira Photo Gallery: Unauthorized modification of dataCVE-2025-11448 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries.
Product
Gallery Plugin for WordPress – Envira Photo Gallery
Affected
up to 1.11.0
What to do
Affects up to 1.11.0. Update Gallery Plugin for WordPress – Envira Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 8, 2025Flexible Refund and Return Order for WooCommerce: Unauthorized modification of dataCVE-2025-12621 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.
Product
Flexible Refund and Return Order for WooCommerce
Affected
up to 1.0.42
What to do
Affects up to 1.0.42. Update Flexible Refund and Return Order for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2025EventPrime – Events Calendar, Bookings and Tickets: Unauthorized booking note creationCVE-2025-12498 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.
Product
EventPrime – Events Calendar, Bookings and Tickets
Affected
up to 4.2.0.0
What to do
Affects up to 4.2.0.0. Update EventPrime – Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025Ovatheme Events Manager: Unauthorized accessCVE-2025-7663 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to delete ticket files, download tickets, and more.
Product
Ovatheme Events Manager
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Ovatheme Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 7, 2025WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales: Unauthorized user registrationCVE-2025-12353 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.
Product
WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales
Affected
up to 3.6.2
What to do
Affects up to 3.6.2. Update WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025Download Manager: Unauthorized accessCVE-2025-12177 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache.
Product
Download Manager
Affected
up to 3.3.30
What to do
Affects up to 3.3.30. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025Contact Form 7 AWeber Extension: Unauthorized modification of dataCVE-2025-12167 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_aweber_logreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the AWeber logs.
Product
Contact Form 7 AWeber Extension
Affected
up to 0.1.42
What to do
Affects up to 0.1.42. Update Contact Form 7 AWeber Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025Course Booking System: Unauthorized access of dataCVE-2025-12042 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to directly access the file and obtain an export of all booking data.
Product
Course Booking System
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update Course Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2025Simple Downloads List: Unauthorized modification of dataCVE-2025-12583 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_neofix_sdl_edit' AJAX endpoint along with many others in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to alter many of the plugin's settings/downloads and inject malicious web scripts.
Product
Simple Downloads List
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Simple Downloads List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2025Page & Post Notes: Unauthorized modification of notesCVE-2025-12527 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page & Post Notes plugin for WordPress is vulnerable to unauthorized modification of notes due to a missing capability check on the 'yydev_notes_save_dashboard_data' function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify notes.
Product
Page & Post Notes
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Page & Post Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2025Effect Maker: Missing AuthorizationCVE-2025-62914 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Effect Maker: from n/a through <= 1.2.1.
Product
Effect Maker
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Effect Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Cost Calculator Builder: Missing AuthorizationCVE-2025-62049 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <= 3.5.32.
Product
Cost Calculator Builder
Affected
up to 3.5.32
What to do
Affects up to 3.5.32. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025TheGem Demo Import (for WPBakery): Missing AuthorizationCVE-2025-62046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CodexThemes TheGem Demo Import (for WPBakery) thegem-importer.This issue affects TheGem Demo Import (for WPBakery): from n/a through <= 5.10.5.
Product
TheGem Demo Import (for WPBakery)
Affected
up to 5.10.5
What to do
Affects up to 5.10.5. Update TheGem Demo Import (for WPBakery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Togo: Missing AuthorizationCVE-2025-62037 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
Product
Togo
What to do
Update Togo to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Togo: Missing AuthorizationCVE-2025-62033 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
Product
Togo
What to do
Update Togo to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Salient: Missing AuthorizationCVE-2025-62028 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a through < 17.4.0.
Product
Salient
What to do
Update Salient to the newest version.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025KALLYAS: Missing AuthorizationCVE-2025-62018 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.
Product
KALLYAS
Affected
up to 4.22.0
What to do
Affects up to 4.22.0. Update KALLYAS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025KALLYAS: Missing AuthorizationCVE-2025-62017 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.
Product
KALLYAS
Affected
up to 4.22.0
What to do
Affects up to 4.22.0. Update KALLYAS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2025Bux Woocommerce: Missing AuthorizationCVE-2025-60247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Bux Bux Woocommerce bux-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bux Woocommerce: from n/a through <= 1.2.3.
Product
Bux Woocommerce
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Bux Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.