Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 54 of 126
Oct 29, 2025MasterStudy LMS Pro: Missing AuthorizationCVE-2025-64212 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
- Product
- MasterStudy LMS Pro
- What to do
- Update MasterStudy LMS Pro to the newest version.
Oct 29, 2025Masterstudy Elementor Widgets: Missing AuthorizationCVE-2025-64211 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Masterstudy Elementor Widgets: Missing AuthorizationCVE-2025-64210 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025wpresidence: Missing AuthorizationCVE-2025-64199 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through <= 5.3.2.
- Product
- wpresidence
- Affected
- up to 5.3.2
- What to do
- Affects up to 5.3.2. Update wpresidence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Blog Designer PRO: Missing AuthorizationCVE-2025-58711 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blog Designer PRO: from n/a through <= 3.4.8.
- Product
- Blog Designer PRO
- Affected
- up to 3.4.8
- What to do
- Affects up to 3.4.8. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2025Facebook for WooCommerce: Missing AuthorizationCVE-2025-64296 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.
- Product
- Facebook for WooCommerce
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Facebook for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 27, 2025IDonate: Does not have authorisation and CSRFCVE-2025-11154 · WordPress plugins & themes · reported by WPScanMedium 5.4
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.
- Product
- IDonate
- Fixed in
- 2.1.13
- What to do
- Update IDonate to 2.1.13 or newer.
Oct 26, 2025Persian Admnin Fonts: Missing AuthorizationCVE-2025-62980 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in MDZ Persian Admnin Fonts persian-admin-fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Persian Admnin Fonts: from n/a through <= 4.1.03.
- Product
- Persian Admnin Fonts
- Affected
- up to 4.1.03
- What to do
- Affects up to 4.1.03. Update Persian Admnin Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025KiotViet Sync: Missing AuthorizationCVE-2025-62978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.
- Product
- KiotViet Sync
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025百度站长SEO合集(支持百度/神马/Bing/头条推送): Missing AuthorizationCVE-2025-62977 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 沃之涛 百度站长SEO合集(支持百度/神马/Bing/头条推送) baiduseo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 百度站长SEO合集(支持百度/神马/Bing/头条推送): from n/a through <= 2.1.4.
- Product
- 百度站长SEO合集(支持百度/神马/Bing/头条推送)
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update 百度站长SEO合集(支持百度/神马/Bing/头条推送) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Sendle Shipping: Missing AuthorizationCVE-2025-62976 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sendle Shipping: from n/a through <= 6.02.
- Product
- Sendle Shipping
- Affected
- up to 6.02
- What to do
- Affects up to 6.02. Update Sendle Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025BuddyForms: Missing AuthorizationCVE-2025-62973 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.
- Product
- BuddyForms
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WebinarPress: Missing AuthorizationCVE-2025-62972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.
- Product
- WebinarPress
- Affected
- up to 1.33.28
- What to do
- Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Link Whisper Free: Missing AuthorizationCVE-2025-62970 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
- Product
- Link Whisper Free
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025GoCache: Missing AuthorizationCVE-2025-62966 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apiki GoCache gocache-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoCache: from n/a through <= 1.3.6.
- Product
- GoCache
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update GoCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Admin Management Xtended: Missing AuthorizationCVE-2025-62965 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin Management Xtended : from n/a through <= 2.5.1.
- Product
- Admin Management Xtended
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Admin Management Xtended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025MDTF: Missing AuthorizationCVE-2025-62964 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.6.
- Product
- MDTF
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Revive Old Posts: Missing AuthorizationCVE-2025-62954 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in rsocial Revive Old Posts tweet-old-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive Old Posts: from n/a through <= 9.3.3.
- Product
- Revive Old Posts
- Affected
- up to 9.3.3
- What to do
- Affects up to 9.3.3. Update Revive Old Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Welcart e-Commerce: Missing AuthorizationCVE-2025-62953 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.24
- What to do
- Affects up to 2.11.24. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025ChatBot: Missing AuthorizationCVE-2025-62952 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.7.3.
- Product
- ChatBot
- Affected
- up to 7.7.3
- What to do
- Affects up to 7.7.3. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Everest Backup: Missing AuthorizationCVE-2025-62946 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.
- Product
- Everest Backup
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025MSTW CSV EXPORTER: Missing AuthorizationCVE-2025-62944 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mark O'Donnell MSTW CSV EXPORTER mstw-csv-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSTW CSV EXPORTER: from n/a through <= 1.4.
- Product
- MSTW CSV EXPORTER
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update MSTW CSV EXPORTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Reoon Email Verifier: Missing AuthorizationCVE-2025-62938 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Reoon Technology Reoon Email Verifier reoon-email-verifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reoon Email Verifier: from n/a through <= 2.0.1.
- Product
- Reoon Email Verifier
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Reoon Email Verifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Open Close WooCommerce Store: Missing AuthorizationCVE-2025-62935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 5.0.0.
- Product
- Open Close WooCommerce Store
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Table Block by RioVizual: Missing AuthorizationCVE-2025-62932 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wprio Table Block by RioVizual riovizual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by RioVizual: from n/a through <= 3.0.0.
- Product
- Table Block by RioVizual
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Table Block by RioVizual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025MSN Partner Hub: Missing AuthorizationCVE-2025-62931 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSN Partner Hub: from n/a through <= 2.9.
- Product
- MSN Partner Hub
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update MSN Partner Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Testimonial Slider: Missing AuthorizationCVE-2025-62929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.
- Product
- Testimonial Slider
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025SEO Meta Description Updater: Missing AuthorizationCVE-2025-62928 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joby Joseph SEO Meta Description Updater seo-meta-description-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Meta Description Updater: from n/a through <= 1.2.0.
- Product
- SEO Meta Description Updater
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update SEO Meta Description Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Nelio Content: Missing AuthorizationCVE-2025-62927 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Content: from n/a through <= 4.0.5.
- Product
- Nelio Content
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update Nelio Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Conversios.io: Missing AuthorizationCVE-2025-62925 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.13.
- Product
- Conversios.io
- Affected
- up to 7.2.13
- What to do
- Affects up to 7.2.13. Update Conversios.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Post Grid and Gutenberg Blocks: Missing AuthorizationCVE-2025-62924 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.
- Product
- Post Grid and Gutenberg Blocks
- Affected
- up to 2.3.17
- What to do
- Affects up to 2.3.17. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Export Categories: Missing AuthorizationCVE-2025-62922 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shambhu Patnaik Export Categories export-categories allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export Categories: from n/a through <= 1.0.
- Product
- Export Categories
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Export Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025TS Demo Importer: Missing AuthorizationCVE-2025-62919 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in themeshopy TS Demo Importer ts-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Demo Importer: from n/a through <= 0.1.3.
- Product
- TS Demo Importer
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update TS Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025IgnitionDeck: Missing AuthorizationCVE-2025-62918 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ignitionwp IgnitionDeck ignitiondeck allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IgnitionDeck: from n/a through <= 2.0.15.
- Product
- IgnitionDeck
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update IgnitionDeck to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Flights & Hotels Booking WP: Missing AuthorizationCVE-2025-62916 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Travon WP Flights & Hotels Booking WP Plugin adiaha-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flights & Hotels Booking WP Plugin: from n/a through <= 3.1.
- Product
- Flights & Hotels Booking WP
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Flights & Hotels Booking WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025SMS Contact Form 7 Notifications by ClickSend: Missing AuthorizationCVE-2025-62915 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through <= 1.4.0.
- Product
- SMS Contact Form 7 Notifications by ClickSend
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update SMS Contact Form 7 Notifications by ClickSend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Smart WeTransfer: Missing AuthorizationCVE-2025-62909 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mrityunjay Smart WeTransfer smart-wetransfer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WeTransfer: from n/a through <= 1.3.
- Product
- Smart WeTransfer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Smart WeTransfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Referral Link Tracker: Missing AuthorizationCVE-2025-62906 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in epiphanyit321 Referral Link Tracker referral-link-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Referral Link Tracker: from n/a through <= 1.1.4.
- Product
- Referral Link Tracker
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Referral Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP Popup Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62902 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through <= 1.3.8.
- Product
- WP Popup Builder
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Sunshine Photo Cart: Missing AuthorizationCVE-2025-62892 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.3.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025King Addons for Elementor: Missing AuthorizationCVE-2025-62889 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in KingAddons.com King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through <= 51.1.61.
- Product
- King Addons for Elementor
- Affected
- up to 51.1.61
- What to do
- Affects up to 51.1.61. Update King Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Coupon Affiliates: Missing AuthorizationCVE-2025-62884 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coupon Affiliates: from n/a through <= 7.2.0.
- Product
- Coupon Affiliates
- Affected
- up to 7.2.0
- What to do
- Affects up to 7.2.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Premmerce User Roles: Missing AuthorizationCVE-2025-62883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.
- Product
- Premmerce User Roles
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Seriously Simple Podcasting: Missing AuthorizationCVE-2025-62882 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.13.0
- What to do
- Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP-Lister Lite for eBay: Missing AuthorizationCVE-2025-62881 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.3.
- Product
- WP-Lister Lite for eBay
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2025Password Policy Manager | Password Manager: Unauthorized modification of dataCVE-2025-11255 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log out the site's connection to miniorange.
- Product
- Password Policy Manager | Password Manager
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Password Policy Manager | Password Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025WP VR – 360 Panorama and Free Virtual Tour Builder For: Unauthorized access of dataCVE-2025-12005 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.
- Product
- WP VR – 360 Panorama and Free Virtual Tour Builder For
- Affected
- up to 8.5.41
- What to do
- Affects up to 8.5.41. Update WP VR – 360 Panorama and Free Virtual Tour Builder For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2025ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Unauthorized modification of dataCVE-2025-11888 · WordPress plugins & themes · reported by WordfenceLow 2.7
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.
- Product
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
- Affected
- up to 4.8.4
- What to do
- Affects up to 4.8.4. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025GenerateBlocks: Unauthorized access of dataCVE-2025-11879 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins.
- Product
- GenerateBlocks
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2025Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2025-11564 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.