Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,274 results · page 53 of 86
Jan 30, 2025Single-user-chat: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13646 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the 'single_user_chat_update_login' function in all versions up to, and including, 0.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update option values to 'login' on the WordPress site. This may be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
- Product
- Single-user-chat
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Single-user-chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 27, 2025Houzez: Missing AuthorizationCVE-2025-24747 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.
- Product
- Houzez
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Bridge Core: Missing AuthorizationCVE-2025-24744 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NotFound Bridge Core. This issue affects Bridge Core: from n/a through 3.3.
- Product
- Bridge Core
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Bridge Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025RTMKit: Missing AuthorizationCVE-2025-24743 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.5.2.
- Product
- RTMKit
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Better Find and Replace: Missing AuthorizationCVE-2025-24734 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Privilege Escalation.This issue affects Better Find and Replace: from n/a through <= 1.6.7.
- Product
- Better Find and Replace
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Better Find and Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025LearnDash LMS: Missing AuthorizationCVE-2025-24662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnDash LMS: from n/a through 4.20.0.1.
- Product
- LearnDash LMS
- Affected
- up to 4.20.0.1
- What to do
- Affects up to 4.20.0.1. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Admin and Site Enhancements (ASE) Pro: Missing AuthorizationCVE-2025-24653 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.
- Product
- Admin and Site Enhancements (ASE) Pro
- Affected
- up to 7.6.1.1
- What to do
- Affects up to 7.6.1.1. Update Admin and Site Enhancements (ASE) Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2025-24606 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.1.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.1
- What to do
- Affects up to 20.8.1. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Print Barcode Labels for your WooCommerce products/orders: Missing AuthorizationCVE-2025-24603 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through <= 3.4.10.
- Product
- Print Barcode Labels for your WooCommerce products/orders
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update Print Barcode Labels for your WooCommerce products/orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025RSVPMarker: Missing AuthorizationCVE-2025-24600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in davidfcarr RSVPMarker rsvpmaker.This issue affects RSVPMarker : from n/a through <= 11.4.5.
- Product
- RSVPMarker
- Affected
- up to 11.4.5
- What to do
- Affects up to 11.4.5. Update RSVPMarker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025picu: Missing AuthorizationCVE-2025-24590 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in picu picu picu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects picu: from n/a through <= 2.4.0.
- Product
- picu
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update picu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Fare Calculator: Missing AuthorizationCVE-2025-23982 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Gopi krishnan Fare Calculator fare-calculator allows Stored XSS.This issue affects Fare Calculator: from n/a through <= 1.1.
- Product
- Fare Calculator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Fare Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025PAPERCITE: Missing AuthorizationCVE-2025-23849 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in bpiwowar PAPERCITE papercite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PAPERCITE: from n/a through <= 0.5.18.
- Product
- PAPERCITE
- Affected
- up to 0.5.18
- What to do
- Affects up to 0.5.18. Update PAPERCITE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Donate visa: Missing AuthorizationCVE-2025-23656 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Saul Morales Pacheco Donate visa donate-visa allows Stored XSS.This issue affects Donate visa: from n/a through <= 1.0.0.
- Product
- Donate visa
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Donate visa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Minterpress: Missing AuthorizationCVE-2025-23529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Minterpress: from n/a through <= 1.0.5.
- Product
- Minterpress
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Houzez: Missing AuthorizationCVE-2025-24754 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.
- Product
- Houzez
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Ultimate Store Kit Elementor Addons: Missing AuthorizationCVE-2025-24584 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.3.0.
- Product
- Ultimate Store Kit Elementor Addons
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WP Triggers Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-13095 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP Triggers Lite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Triggers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Altra Side Menu: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12773 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Altra Side Menu
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Altra Side Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Gutenberg Blocks by Kadence Blocks: Missing AuthorizationCVE-2025-24753 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through <= 3.3.1.
- Product
- Gutenberg Blocks by Kadence Blocks
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025CoBlocks: Missing AuthorizationCVE-2025-24751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoDaddy CoBlocks coblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoBlocks: from n/a through <= 3.1.13.
- Product
- CoBlocks
- Affected
- up to 3.1.13
- What to do
- Affects up to 3.1.13. Update CoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ExactMetrics: Missing AuthorizationCVE-2025-24750 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Syed Balkhi ExactMetrics google-analytics-dashboard-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ExactMetrics: from n/a through <= 8.1.0.
- Product
- ExactMetrics
- Affected
- up to 8.1.0
- What to do
- Affects up to 8.1.0. Update ExactMetrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Post Duplicator: Missing AuthorizationCVE-2025-24736 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through <= 2.35.
- Product
- Post Duplicator
- Affected
- up to 2.35
- What to do
- Affects up to 2.35. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Thim Elementor Kit: Missing AuthorizationCVE-2025-24725 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thim Elementor Kit: from n/a through <= 1.2.8.
- Product
- Thim Elementor Kit
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Thim Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce Quick View: Missing AuthorizationCVE-2025-24705 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arshid WooCommerce Quick View woo-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Quick View: from n/a through <= 1.1.1.
- Product
- WooCommerce Quick View
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WooCommerce Quick View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Advanced Notifications: Missing AuthorizationCVE-2025-24693 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Yehi Advanced Notifications advanced-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Notifications: from n/a through <= 1.2.7.
- Product
- Advanced Notifications
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Advanced Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025People Lists: Missing AuthorizationCVE-2025-24691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ctltwp People Lists people-lists allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects People Lists: from n/a through <= 1.3.10.
- Product
- People Lists
- Affected
- up to 1.3.10
- What to do
- Affects up to 1.3.10. Update People Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Super Block Slider: Missing AuthorizationCVE-2025-24682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Michael Super Block Slider super-block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Block Slider: from n/a through <= 2.7.9.
- Product
- Super Block Slider
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update Super Block Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Internal Links Manager: Missing AuthorizationCVE-2025-24679 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webraketen Internal Links Manager seo-automated-link-building allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Links Manager: from n/a through <= 2.5.2.
- Product
- Internal Links Manager
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Internal Links Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Duplicate: Missing AuthorizationCVE-2025-24652 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in revmakx WP Duplicate local-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Duplicate: from n/a through <= 1.1.6.
- Product
- WP Duplicate
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update WP Duplicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Admin and Site Enhancements (ASE): Missing AuthorizationCVE-2025-24649 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.
- Product
- Admin and Site Enhancements (ASE)
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Build Private Store For Woocommerce: Missing AuthorizationCVE-2025-24633 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: from n/a through <= 1.0.
- Product
- Build Private Store For Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Build Private Store For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Taxonomy/Term and Role based Discounts for WooCommerce: Missing AuthorizationCVE-2025-24625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1.
- Product
- Taxonomy/Term and Role based Discounts for WooCommerce
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update Taxonomy/Term and Role based Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ElementInvader Addons for Elementor: Missing AuthorizationCVE-2025-24618 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.1.
- Product
- ElementInvader Addons for Elementor
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025FV Thoughtful Comments: Missing AuthorizationCVE-2025-24613 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.
- Product
- FV Thoughtful Comments
- Affected
- up to 0.3.5
- What to do
- Affects up to 0.3.5. Update FV Thoughtful Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025VPSUForm: Missing AuthorizationCVE-2025-24604 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.0.5.
- Product
- VPSUForm
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce Product Table Lite: Missing AuthorizationCVE-2025-24596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through <= 3.8.7.
- Product
- WooCommerce Product Table Lite
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Linet ERP-Woocommerce Integration: Missing AuthorizationCVE-2025-24594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.7.
- Product
- Linet ERP-Woocommerce Integration
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-24591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025JSM Show Post Metadata: Missing AuthorizationCVE-2025-24589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.
- Product
- JSM Show Post Metadata
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update JSM Show Post Metadata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Patreon: Missing AuthorizationCVE-2025-24588 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.
- Product
- Patreon
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Patreon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 202512 Step Meeting List: Missing AuthorizationCVE-2025-24580 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
- Product
- 12 Step Meeting List
- Affected
- up to 3.16.5
- What to do
- Affects up to 3.16.5. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-24571 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.
- Product
- WP Fast Total Search
- Affected
- up to 1.78.258
- What to do
- Affects up to 1.78.258. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Product Size Charts Plugin for WooCommerce: Missing AuthorizationCVE-2025-23991 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dotstore Product Size Charts Plugin for WooCommerce woo-advanced-product-size-chart.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through <= 2.4.5.
- Product
- Product Size Charts Plugin for WooCommerce
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Product Size Charts Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025SEO Blogger to WordPress Migration using 301 Redirection: Reflected Cross-Site ScriptingCVE-2024-13422 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SEO Blogger to WordPress Migration using 301 Redirection
- Affected
- up to 0.4.8
- What to do
- Affects up to 0.4.8. Update SEO Blogger to WordPress Migration using 301 Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 22, 2025Debug Tool: Missing AuthorizationCVE-2025-23684 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Tool: from n/a through <= 2.2.
- Product
- Debug Tool
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Debug Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Team 118GROUP Agent: Missing AuthorizationCVE-2025-23512 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 118group Team 118GROUP Agent team-118group-agent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team 118GROUP Agent: from n/a through <= 1.6.0.
- Product
- Team 118GROUP Agent
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Team 118GROUP Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Database Sync: Missing AuthorizationCVE-2025-23486 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tamlyn Database Sync database-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database Sync: from n/a through <= 0.5.1.
- Product
- Database Sync
- Affected
- up to 0.5.1
- What to do
- Affects up to 0.5.1. Update Database Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Realty Workstation: Missing AuthorizationCVE-2025-23477 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through <= 1.0.45.
- Product
- Realty Workstation
- Affected
- up to 1.0.45
- What to do
- Affects up to 1.0.45. Update Realty Workstation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Widget Options: Missing AuthorizationCVE-2025-22722 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.
- Product
- Widget Options
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.