Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

6,267 results · page 55 of 126

Oct 25, 2025Product Filter by WBW: Unauthorized modification of dataCVE-2025-11269 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings.
Product
Product Filter by WBW
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 25, 2025Password Protected: Authorization bypassCVE-2025-11244 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the "Use transients" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the "Use transients" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers.
Product
Password Protected
Affected
up to 2.7.11
What to do
Affects up to 2.7.11. Update Password Protected to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 25, 2025User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds: Unauthorized access of dataCVE-2025-10694 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `maybe_load_onboarding_wizard` function in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to access the onboarding wizard page and view configuration information including the administrator email address.
Product
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2025BackWPup – WordPress Backup & Restore: Unauthorized access of dataCVE-2025-10579 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'backwpup_working' AJAX action in all versions up to, and including, 5.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve access to a back-up's filename while a backup is running. This information has little value on it's own, but could be used to aid in a brute force attack to retrieve back-up contents in limited environments (i.e. NGINX).
Product
BackWPup – WordPress Backup & Restore
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update BackWPup – WordPress Backup & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 24, 2025ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns: Unauthorized modification of dataCVE-2025-12134 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_popup_status() function in all versions up to, and including, 2.3.11. This makes it possible for unauthenticated attackers to enable/disable popups.
Product
ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2025NGINX Cache Optimizer: Unauthorized modification of dataCVE-2025-12014 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer-blacklist-update' AJAX action in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add URLs to the Exclude URLs From Dynamic Caching setting.
Product
NGINX Cache Optimizer
Affected
up to 1.1
What to do
Affects up to 1.1. Update NGINX Cache Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 24, 2025Supervisor: Unauthorized modification of dataCVE-2025-11887 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update various plugin settings.
Product
Supervisor
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Supervisor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2025LLM Hubspot Blog Import: Unauthorized modification of dataCVE-2025-11257 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_save_blogs' AJAX endpoint in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger an import of all Hubspot data.
Product
LLM Hubspot Blog Import
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update LLM Hubspot Blog Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 24, 2025Check Plagiarism: Unauthorized modification of dataCVE-2025-11172 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action() function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the API key.
Product
Check Plagiarism
Affected
up to 2.0
What to do
Affects up to 2.0. Update Check Plagiarism to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2025Originality.ai AI Checker: Unauthorized loss of dataCVE-2025-10902 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versions up to, and including, 1.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
Product
Originality.ai AI Checker
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Originality.ai AI Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2025Originality.ai AI Checker: Unauthorized access of dataCVE-2025-10901 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all versions up to, and including, 1.0.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read all data in the wp_originalityai_log database table, which can include post titles, scan scores, credits used, and other data.
Product
Originality.ai AI Checker
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update Originality.ai AI Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 24, 2025Microsoft Azure Storage for: Unauthorized Arbitrary Media DeletionCVE-2025-10749 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the replace_attachment parameter granted they can access the nonce which is exposed to all authenticated users.
Product
Microsoft Azure Storage for
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update Microsoft Azure Storage for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 24, 2025URL Shortener Plugin For: Unauthorized access to functionality provided by the APICVE-2025-10740 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capability check on the verifyRequest function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify links.
Product
URL Shortener Plugin For
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update URL Shortener Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025MeetingHub: Missing AuthorizationCVE-2025-62073 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sovlix MeetingHub meetinghub.This issue affects MeetingHub: from n/a through <= 1.23.9.
Product
MeetingHub
Affected
up to 1.23.9
What to do
Affects up to 1.23.9. Update MeetingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Front End Users: Missing AuthorizationCVE-2025-62072 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33.
Product
Front End Users
Affected
up to 3.2.33
What to do
Affects up to 3.2.33. Update Front End Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Social proof testimonials and reviews by Repuso: Missing AuthorizationCVE-2025-62071 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.29.
Product
Social proof testimonials and reviews by Repuso
Affected
up to 5.29
What to do
Affects up to 5.29. Update Social proof testimonials and reviews by Repuso to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WowRevenue: Missing AuthorizationCVE-2025-62070 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPXPO WowRevenue revenue.This issue affects WowRevenue: from n/a through <= 1.2.13.
Product
WowRevenue
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update WowRevenue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025One Page Express Companion: Missing AuthorizationCVE-2025-62052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through <= 1.6.43.
Product
One Page Express Companion
Affected
up to 1.6.43
What to do
Affects up to 1.6.43. Update One Page Express Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025SmartCrawl: Missing AuthorizationCVE-2025-62048 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform SmartCrawl smartcrawl-seo.This issue affects SmartCrawl: from n/a through <= 3.14.3.
Product
SmartCrawl
Affected
up to 3.14.3
What to do
Affects up to 3.14.3. Update SmartCrawl to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Event Tickets: Missing AuthorizationCVE-2025-62027 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3.
Product
Event Tickets
Affected
up to 5.26.3
What to do
Affects up to 5.26.3. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025BuddyPress: Missing AuthorizationCVE-2025-62022 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4.
Product
BuddyPress
Affected
up to 14.3.4
What to do
Affects up to 14.3.4. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Acknowledgify: Missing AuthorizationCVE-2025-62021 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Made Neat Acknowledgify acknowledgify.This issue affects Acknowledgify: from n/a through <= 1.1.3.
Product
Acknowledgify
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Acknowledgify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2025-62019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.
Product
Recipe Card Blocks for Gutenberg & Elementor
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update Recipe Card Blocks for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025UiChemy: Missing AuthorizationCVE-2025-62013 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in POSIMYTH UiChemy uichemy.This issue affects UiChemy: from n/a through <= 4.0.0.
Product
UiChemy
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update UiChemy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WP SMS: Missing AuthorizationCVE-2025-62006 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1.
Product
WP SMS
Affected
up to 7.0.1
What to do
Affects up to 7.0.1. Update WP SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025MasterStudy LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59575 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Product
MasterStudy LMS
Affected
up to 3.6.20
What to do
Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Author: Munzir: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58916 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munzir Author: Munzir myshouts-shoutbox allows Reflected XSS.This issue affects Author: Munzir: from n/a through <= 0.9.
Product
Author: Munzir
Affected
up to 0.9
What to do
Affects up to 0.9. Update Author: Munzir to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WooCommerce Orders & Customers Exporter: Missing AuthorizationCVE-2025-53424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.
Product
WooCommerce Orders & Customers Exporter
Affected
up to 5.4
What to do
Affects up to 5.4. Update WooCommerce Orders & Customers Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Accordion: Missing AuthorizationCVE-2025-53421 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.
Product
Accordion
Affected
up to 2.3.14
What to do
Affects up to 2.3.14. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025UDesign Core: Missing AuthorizationCVE-2025-53236 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in AndonDesign UDesign Core u-design-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UDesign Core: from n/a through <= 4.14.0.
Product
UDesign Core
Affected
up to 4.14.0
What to do
Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025SUMO Memberships for WooCommerce: Missing AuthorizationCVE-2025-52757 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.
Product
SUMO Memberships for WooCommerce
What to do
Update SUMO Memberships for WooCommerce to the newest version.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025IDonatePro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-52752 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.
Product
IDonatePro
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update IDonatePro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Wikipedia Preview: Missing AuthorizationCVE-2025-52738 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.
Product
Wikipedia Preview
Affected
up to 1.15.0
What to do
Affects up to 1.15.0. Update Wikipedia Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Breeze Checkout: Missing AuthorizationCVE-2025-49961 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Breeze Team Breeze Checkout breeze-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze Checkout: from n/a through <= 1.4.0.
Product
Breeze Checkout
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Breeze Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Houzez: Authorization Bypass Through User-Controlled KeyCVE-2025-49952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.
Product
Houzez
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update Houzez to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Official Integration for Billingo: Missing AuthorizationCVE-2025-49950 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in billingo Official Integration for Billingo billingo allows Privilege Escalation.This issue affects Official Integration for Billingo: from n/a through <= 4.3.0.
Product
Official Integration for Billingo
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update Official Integration for Billingo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Templazee: Missing AuthorizationCVE-2025-49949 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in templazee Templazee templazee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templazee: from n/a through <= 1.0.2.
Product
Templazee
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Templazee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Smash Balloon Social Post Feed: Missing AuthorizationCVE-2025-49937 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.
Product
Smash Balloon Social Post Feed
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update Smash Balloon Social Post Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WPLMS: Missing AuthorizationCVE-2025-49925 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.
Product
WPLMS
Affected
up to 1.9.9.7
What to do
Affects up to 1.9.9.7. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WPeMatico RSS Feed Fetcher: Missing AuthorizationCVE-2025-49922 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.3.
Product
WPeMatico RSS Feed Fetcher
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Web Accessibility By accessiBe: Missing AuthorizationCVE-2025-49920 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10.
Product
Web Accessibility By accessiBe
Affected
up to 2.10
What to do
Affects up to 2.10. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025MultiVendorX: Missing AuthorizationCVE-2025-49916 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.
Product
MultiVendorX
Affected
up to 4.2.23
What to do
Affects up to 4.2.23. Update MultiVendorX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025CoSchedule: Missing AuthorizationCVE-2025-49913 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.
Product
CoSchedule
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update CoSchedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WPGuppy: Missing AuthorizationCVE-2025-49910 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4.
Product
WPGuppy
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025MDTF: Missing AuthorizationCVE-2025-49907 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.3.9.
Product
MDTF
Affected
up to 1.3.3.9
What to do
Affects up to 1.3.3.9. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025WPComplete: Missing AuthorizationCVE-2025-49906 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3.
Product
WPComplete
Affected
up to 2.9.5.3
What to do
Affects up to 2.9.5.3. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025ZoloBlocks: Missing AuthorizationCVE-2025-49903 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in bdthemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through <= 2.3.11.
Product
ZoloBlocks
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update ZoloBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Whydonate: Missing AuthorizationCVE-2025-49899 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15.
Product
Whydonate
Affected
up to 4.0.15
What to do
Affects up to 4.0.15. Update Whydonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Hydra Booking: Missing AuthorizationCVE-2025-49377 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9.
Product
Hydra Booking
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025DELUCKS SEO: Missing AuthorizationCVE-2025-49376 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects DELUCKS SEO: from n/a through <= 2.5.9.
Product
DELUCKS SEO
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.