Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,275 results · page 54 of 86
Jan 21, 2025Widget Options: Missing AuthorizationCVE-2025-22722 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.
- Product
- Widget Options
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ApplyOnline: Missing AuthorizationCVE-2025-22721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline: from n/a through <= 2.6.7.1.
- Product
- ApplyOnline
- Affected
- up to 2.6.7.1
- What to do
- Affects up to 2.6.7.1. Update ApplyOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025My Tickets: Missing AuthorizationCVE-2025-22717 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My Tickets: from n/a through <= 2.0.9.
- Product
- My Tickets
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Standard Box Sizes – for WooCommerce: Missing AuthorizationCVE-2025-22318 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for WooCommerce: from n/a through <= 1.6.13.
- Product
- Standard Box Sizes – for WooCommerce
- Affected
- up to 1.6.13
- What to do
- Affects up to 1.6.13. Update Standard Box Sizes – for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Mark Posts: Missing AuthorizationCVE-2025-23963 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in flymke Mark Posts mark-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark Posts: from n/a through <= 2.2.4.
- Product
- Mark Posts
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Mark Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Goldstar: Missing AuthorizationCVE-2025-23962 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in jjtrabucco Goldstar goldstar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Goldstar: from n/a through <= 2.1.1.
- Product
- Goldstar
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Goldstar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WordPress Graphs & Charts: Missing AuthorizationCVE-2025-23961 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wptasker WordPress Graphs & Charts graph-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Graphs & Charts: from n/a through <= 2.0.8.
- Product
- WordPress Graphs & Charts
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update WordPress Graphs & Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Sur.ly: Missing AuthorizationCVE-2025-23957 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in surdotly Sur.ly surly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sur.ly: from n/a through <= 3.0.3.
- Product
- Sur.ly
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Sur.ly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Xola: Missing AuthorizationCVE-2025-23955 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in xola Xola xola-bookings-for-tours-activities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xola: from n/a through <= 1.6.
- Product
- Xola
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Xola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Salvador – AI Image Generator: Missing AuthorizationCVE-2025-23954 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in awcode Salvador – AI Image Generator salvador-ai-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salvador – AI Image Generator: from n/a through <= 1.0.11.
- Product
- Salvador – AI Image Generator
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Salvador – AI Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025PayPal Marketing Solutions: Missing AuthorizationCVE-2025-23930 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paypalmuse PayPal Marketing Solutions paypal-promotions-and-insights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Marketing Solutions: from n/a through <= 1.2.
- Product
- PayPal Marketing Solutions
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update PayPal Marketing Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Email Capture & Lead Generation: Missing AuthorizationCVE-2025-23929 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation email-capture-lead-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email Capture & Lead Generation: from n/a through <= 1.0.2.
- Product
- Email Capture & Lead Generation
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Email Capture & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Chamber Dashboard Business Directory: Missing AuthorizationCVE-2025-23917 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Chandrika Guntur, Morgan Kay Chamber Dashboard Business Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.8.
- Product
- Chamber Dashboard Business Directory
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update Chamber Dashboard Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WP Meetup: Missing AuthorizationCVE-2025-23916 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Nuanced Media WP Meetup wp-meetup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meetup: from n/a through <= 2.3.0.
- Product
- WP Meetup
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WP Meetup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Contact Form 7 Anti Spambot: Missing AuthorizationCVE-2025-23862 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SzMake Contact Form 7 Anti Spambot contact-form-7-anti-spambot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 Anti Spambot: from n/a through <= 1.0.1.
- Product
- Contact Form 7 Anti Spambot
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Contact Form 7 Anti Spambot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025AI Responsive Gallery Album: Missing AuthorizationCVE-2025-23785 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in August Infotech AI Responsive Gallery Album ai-responsive-gallery-album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Responsive Gallery Album: from n/a through <= 1.4.
- Product
- AI Responsive Gallery Album
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update AI Responsive Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025User Sync ActiveCampaign: Missing AuthorizationCVE-2025-23778 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Pravin Durugkar User Sync ActiveCampaign registered-user-sync-activecampaign allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Sync ActiveCampaign: from n/a through <= 1.3.2.
- Product
- User Sync ActiveCampaign
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update User Sync ActiveCampaign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Cache Sniper for Nginx: Missing AuthorizationCVE-2025-23776 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ekaterir Cache Sniper for Nginx snipe-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cache Sniper for Nginx: from n/a through <= 1.0.4.2.
- Product
- Cache Sniper for Nginx
- Affected
- up to 1.0.4.2
- What to do
- Affects up to 1.0.4.2. Update Cache Sniper for Nginx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Copy Move Posts: Missing AuthorizationCVE-2025-23764 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ujjavaljani Copy Move Posts copy-move-posts.This issue affects Copy Move Posts: from n/a through <= 1.6.
- Product
- Copy Move Posts
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Copy Move Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Woo Tuner: Missing AuthorizationCVE-2025-23761 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Alex Volkov Woo Tuner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woo Tuner: from n/a through 0.1.2.
- Product
- Woo Tuner
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update Woo Tuner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Loginplus: Missing AuthorizationCVE-2025-23514 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sanjay Prasad Loginplus loginplus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Loginplus: from n/a through <= 1.2.
- Product
- Loginplus
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Loginplus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025SendGrid for: Missing AuthorizationCVE-2025-23423 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., SendGrid for WordPress wp-sendgrid-mailer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SendGrid for WordPress: from n/a through <= 1.4.
- Product
- SendGrid for
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update SendGrid for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Button Block: Missing AuthorizationCVE-2025-22787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.
- Product
- Button Block
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Button Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025WP News Sliders: Missing AuthorizationCVE-2025-22779 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP News Sliders: from n/a through <= 1.0.
- Product
- WP News Sliders
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP News Sliders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025WpTravelly: Missing AuthorizationCVE-2025-22737 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through <= 1.8.5.
- Product
- WpTravelly
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025VOD Infomaniak: Missing AuthorizationCVE-2025-22729 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from n/a through <= 1.5.9.
- Product
- VOD Infomaniak
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update VOD Infomaniak to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Poll Maker: Missing AuthorizationCVE-2024-56295 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 5.5.6.
- Product
- Poll Maker
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2025Post SMTP: Missing AuthorizationCVE-2025-22800 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 2.9.11.
- Product
- Post SMTP
- Affected
- up to 2.9.11
- What to do
- Affects up to 2.9.11. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 11, 2025GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-12877 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this was only partially patched in 3.19.3, a fully sufficient patch was not released until 3.19.4. However, another CVE was assigned by another CNA for version 3.19.3 so we will leave this as affecting 3.19.2 and before. We have recommended the vendor use JSON encoding to prevent any further deserialization vulnerabilities from being present.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 3.19.2
- What to do
- Affects up to 3.19.2. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2025Title Experiments Free: Missing AuthorizationCVE-2025-22561 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in kbowson Title Experiments Free wp-experiments-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Title Experiments Free: from n/a through <= 9.0.4.
- Product
- Title Experiments Free
- Affected
- up to 9.0.4
- What to do
- Affects up to 9.0.4. Update Title Experiments Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Allada T-shirt Designer for Woocommerce: Missing AuthorizationCVE-2025-22363 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Hermann LAHAMI Allada T-shirt Designer for Woocommerce allada-tshirt-designer-for-woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through <= 1.1.
- Product
- Allada T-shirt Designer for Woocommerce
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Allada T-shirt Designer for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Social Media Share Buttons | MashShare: Missing AuthorizationCVE-2025-22319 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in DearHive Social Media Share Buttons | MashShare.This issue affects Social Media Share Buttons | MashShare: from n/a through 4.0.47.
- Product
- Social Media Share Buttons | MashShare
- Affected
- up to 4.0.47
- What to do
- Affects up to 4.0.47. Update Social Media Share Buttons | MashShare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Hide Category by User Role for WooCommerce: Missing AuthorizationCVE-2024-56272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeSupport Hide Category by User Role for WooCommerce hide-category-by-user-role-for-woocommerce.This issue affects Hide Category by User Role for WooCommerce: from n/a through <= 2.1.1.
- Product
- Hide Category by User Role for WooCommerce
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Hide Category by User Role for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP SecureSubmit: Missing AuthorizationCVE-2024-56270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Retrieve Embedded Sensitive Data.This issue affects WP SecureSubmit: from n/a through <= 1.5.20.
- Product
- WP SecureSubmit
- Affected
- up to 1.5.20
- What to do
- Affects up to 1.5.20. Update WP SecureSubmit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22592 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 20251003 Mortgage Application: Missing AuthorizationCVE-2025-22591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.87
- What to do
- Affects up to 1.87. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Saoshyant Page Builder: Missing AuthorizationCVE-2025-22560 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in saoshyant1994 Saoshyant Page Builder saoshyant-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Saoshyant Page Builder: from n/a through <= 3.8.
- Product
- Saoshyant Page Builder
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Saoshyant Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025ST Gallery WP: Missing AuthorizationCVE-2025-22543 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through <= 1.0.8.
- Product
- ST Gallery WP
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update ST Gallery WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Delete Post Copies: Missing AuthorizationCVE-2025-22541 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in etruel WP Delete Post Copies etruel-del-post-copies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delete Post Copies: from n/a through <= 5.5.
- Product
- WP Delete Post Copies
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update WP Delete Post Copies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Slides & Presentations: Missing AuthorizationCVE-2025-22534 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ella Van Durpe Slides & Presentations slide allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slides & Presentations: from n/a through <= 0.0.39.
- Product
- Slides & Presentations
- Affected
- up to 0.0.39
- What to do
- Affects up to 0.0.39. Update Slides & Presentations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SingSong: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22522 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roya khosravi SingSong singsong allows Stored XSS.This issue affects SingSong: from n/a through <= 1.2.
- Product
- SingSong
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update SingSong to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Help Scout: Missing AuthorizationCVE-2025-22512 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Help Scout help-scout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Help Scout: from n/a through <= 6.5.6.
- Product
- Help Scout
- Affected
- up to 6.5.6
- What to do
- Affects up to 6.5.6. Update Help Scout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Wp advertising management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simone Marcon Wp advertising management advertising-management allows Reflected XSS.This issue affects Wp advertising management: from n/a through <= 1.0.3.
- Product
- Wp advertising management
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Wp advertising management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Visitor Statistics (Real Time Traffic): Missing AuthorizationCVE-2025-22304 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.5.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 7.5
- What to do
- Affects up to 7.5. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Wand: Missing AuthorizationCVE-2025-22302 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Wand: from n/a through <= 1.2.5.
- Product
- WP Wand
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Wand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025AI for SEO: Missing AuthorizationCVE-2025-22299 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Space Codes AI for SEO ai-for-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI for SEO: from n/a through <= 1.2.9.
- Product
- AI for SEO
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update AI for SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Hive Support: Missing AuthorizationCVE-2025-22298 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hive Support: from n/a through <= 1.1.6.
- Product
- Hive Support
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Hive Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Nexter Blocks: Missing AuthorizationCVE-2024-56294 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nexter Blocks: from n/a through <= 4.0.7.
- Product
- Nexter Blocks
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Contact Form by WPForms: Missing AuthorizationCVE-2024-56276 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.2.2.
- Product
- Contact Form by WPForms
- Affected
- up to 1.9.2.2
- What to do
- Affects up to 1.9.2.2. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPvivid Backup and Migration: Missing AuthorizationCVE-2024-56273 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPvivid Backup and Migration: from n/a through <= 0.9.106.
- Product
- WPvivid Backup and Migration
- Affected
- up to 0.9.106
- What to do
- Affects up to 0.9.106. Update WPvivid Backup and Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.