Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 57 of 126
Sep 26, 2025TheGem: Missing AuthorizationCVE-2025-60097 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5.
- Product
- TheGem
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update TheGem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025TheGem (Elementor): Missing AuthorizationCVE-2025-60096 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.
- Product
- TheGem (Elementor)
- Affected
- up to 5.10.5
- What to do
- Affects up to 5.10.5. Update TheGem (Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Stackable: Missing AuthorizationCVE-2025-60094 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through <= 3.18.1.
- Product
- Stackable
- Affected
- up to 3.18.1
- What to do
- Affects up to 3.18.1. Update Stackable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Download Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-60092 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25.
- Product
- Download Manager
- Affected
- up to 3.3.25
- What to do
- Affects up to 3.3.25. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Traveler: Missing AuthorizationCVE-2025-59011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Sep 26, 2025Wide Banner: Missing AuthorizationCVE-2025-58919 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in guihom Wide Banner wide-banner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wide Banner: from n/a through <= 1.0.4.
- Product
- Wide Banner
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Wide Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Acclectic Media Organizer: Missing AuthorizationCVE-2025-48326 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Acclectic Media Acclectic Media Organizer acclectic-media-organizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acclectic Media Organizer: from n/a through <= 1.4.
- Product
- Acclectic Media Organizer
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Acclectic Media Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Authorsy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27006 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeplugs Authorsy authorsy allows Stored XSS.This issue affects Authorsy: from n/a through <= 1.0.5.
- Product
- Authorsy
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Authorsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2025Featured Image from URL (FIFU): Unauthorized access of dataCVE-2025-9984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protected posts.
- Product
- Featured Image from URL (FIFU)
- Affected
- up to 5.2.7
- What to do
- Affects up to 5.2.7. Update Featured Image from URL (FIFU) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2025ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Unauthorized accessCVE-2025-10173 · WordPress plugins & themes · reported by WordfenceLow 2.7
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-level access and above, to update the plugin's settings.
- Product
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 24, 2025MultiLoca - WooCommerce Multi Locations Inventory Management: Unauthorized modification of data that can lead to privilege escalationCVE-2025-9054 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- MultiLoca - WooCommerce Multi Locations Inventory Management
- Affected
- up to 4.2.8
- What to do
- Affects up to 4.2.8. Update MultiLoca - WooCommerce Multi Locations Inventory Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Sep 22, 2025wpDiscuz: Missing AuthorizationCVE-2025-59591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.33.
- Product
- wpDiscuz
- Affected
- up to 7.6.33
- What to do
- Affects up to 7.6.33. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Ajax Load More: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59582 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through <= 7.6.0.2.
- Product
- Ajax Load More
- Affected
- up to 7.6.0.2
- What to do
- Affects up to 7.6.0.2. Update Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Ibtana: Missing AuthorizationCVE-2025-59581 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through <= 1.2.5.3.
- Product
- Ibtana
- Affected
- up to 1.2.5.3
- What to do
- Affects up to 1.2.5.3. Update Ibtana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-59576 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.20
- What to do
- Affects up to 3.6.20. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Coupon Affiliates: Missing AuthorizationCVE-2025-59567 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.8.0.
- Product
- Coupon Affiliates
- Affected
- up to 6.8.0
- What to do
- Affects up to 6.8.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Academy LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-59562 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.3.4.
- Product
- Academy LMS
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Smart Blocks: Missing AuthorizationCVE-2025-59561 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.
- Product
- Smart Blocks
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Smart Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Payrexx Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-59559 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in payrexx Payrexx Payment Gateway for WooCommerce woo-payrexx-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payrexx Payment Gateway for WooCommerce: from n/a through <= 3.1.5.
- Product
- Payrexx Payment Gateway for WooCommerce
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Payrexx Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Revive.so: Missing AuthorizationCVE-2025-59551 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.6.
- Product
- Revive.so
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Revive.so to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Custom Login URL: Missing AuthorizationCVE-2025-58969 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through <= 1.0.2.
- Product
- Custom Login URL
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Custom Login URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025MaxiBlocks: Missing AuthorizationCVE-2025-58968 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MaxiBlocks: from n/a through <= 2.1.3.
- Product
- MaxiBlocks
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update MaxiBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025VPSUForm: Missing AuthorizationCVE-2025-58957 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.2.20.
- Product
- VPSUForm
- Affected
- up to 3.2.20
- What to do
- Affects up to 3.2.20. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Cecabank WooCommerce: Missing AuthorizationCVE-2025-58685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cecabank WooCommerce Plugin: from n/a through <= 0.3.4.
- Product
- Cecabank WooCommerce
- Affected
- up to 0.3.4
- What to do
- Affects up to 0.3.4. Update Cecabank WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Easy Quotes: Missing AuthorizationCVE-2025-58681 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Quotes: from n/a through <= 1.2.4.
- Product
- Easy Quotes
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Easy Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Gutentor: Missing AuthorizationCVE-2025-58680 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.2.
- Product
- Gutentor
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Gutentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025AppMySite: Missing AuthorizationCVE-2025-58679 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AppMySite: from n/a through <= 3.15.0.
- Product
- AppMySite
- Affected
- up to 3.15.0
- What to do
- Affects up to 3.15.0. Update AppMySite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Accordion: Missing AuthorizationCVE-2025-58678 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.15.
- Product
- Accordion
- Affected
- up to 2.3.15
- What to do
- Affects up to 2.3.15. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WP User Frontend: Missing AuthorizationCVE-2025-58672 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.1.12.
- Product
- WP User Frontend
- Affected
- up to 4.1.12
- What to do
- Affects up to 4.1.12. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025WPLMS: Missing AuthorizationCVE-2025-58668 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.
- Product
- WPLMS
- Affected
- up to 4.970
- What to do
- Affects up to 4.970. Update WPLMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025ListingPro Reviews: Missing AuthorizationCVE-2025-58667 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro Reviews: from n/a through < 2.9.11.
- Product
- ListingPro Reviews
- What to do
- Update ListingPro Reviews to the newest version.
Sep 22, 2025Website Chat Button: Kommo integration: Missing AuthorizationCVE-2025-58666 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kommo Website Chat Button: Kommo integration website-chat-button-kommo-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Website Chat Button: Kommo integration: from n/a through <= 1.3.1.
- Product
- Website Chat Button: Kommo integration
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Website Chat Button: Kommo integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Text To Speech TTS Accessibility: Missing AuthorizationCVE-2025-58664 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Azizul Hasan Text To Speech TTS Accessibility text-to-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Text To Speech TTS Accessibility: from n/a through <= 1.9.30.
- Product
- Text To Speech TTS Accessibility
- Affected
- up to 1.9.30
- What to do
- Affects up to 1.9.30. Update Text To Speech TTS Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Qubely: Missing AuthorizationCVE-2025-58663 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely: from n/a through <= 1.8.14.
- Product
- Qubely
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Oshine Core: Missing AuthorizationCVE-2025-58660 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in brandexponents Oshine Core oshine-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oshine Core: from n/a through <= 1.5.5.
- Product
- Oshine Core
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Oshine Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025All In One SEO Pack: Missing AuthorizationCVE-2025-58650 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.
- Product
- All In One SEO Pack
- Affected
- up to 4.8.7.1
- What to do
- Affects up to 4.8.7.1. Update All In One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Lazy Blocks: Missing AuthorizationCVE-2025-58258 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nK Lazy Blocks lazy-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lazy Blocks: from n/a through <= 4.1.0.
- Product
- Lazy Blocks
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Lazy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Sticky Header Effects for Elementor: Missing AuthorizationCVE-2025-58251 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in POSIMYTH Sticky Header Effects for Elementor sticky-header-effects-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header Effects for Elementor: from n/a through <= 2.1.2.
- Product
- Sticky Header Effects for Elementor
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Sticky Header Effects for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025TI WooCommerce Wishlist: Missing AuthorizationCVE-2025-58247 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.
- Product
- TI WooCommerce Wishlist
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Team Manager: Missing AuthorizationCVE-2025-58222 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Dynamic Web Lab Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Manager: from n/a through 2.6.8.
- Product
- Team Manager
- Affected
- up to 2.6.8
- What to do
- Affects up to 2.6.8. Update Team Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025PilotPress: Missing AuthorizationCVE-2025-58221 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through <= 2.0.36.
- Product
- PilotPress
- Affected
- up to 2.0.36
- What to do
- Affects up to 2.0.36. Update PilotPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Classic Widgets with Block-based Widgets: Missing AuthorizationCVE-2025-58029 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classic Widgets with Block-based Widgets: from n/a through <= 1.0.1.
- Product
- Classic Widgets with Block-based Widgets
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Classic Widgets with Block-based Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CF7 Submissions: Missing AuthorizationCVE-2025-58016 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.26.
- Product
- CF7 Submissions
- Affected
- up to 0.26
- What to do
- Affects up to 0.26. Update CF7 Submissions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Quiz Maker: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58015 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Data.This issue affects Quiz Maker: from n/a through <= 6.7.0.65.
- Product
- Quiz Maker
- Affected
- up to 6.7.0.65
- What to do
- Affects up to 6.7.0.65. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Content Mask: Authorization Bypass Through User-Controlled KeyCVE-2025-58012 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Mask: from n/a through <= 1.8.5.3.
- Product
- Content Mask
- Affected
- up to 1.8.5.3
- What to do
- Affects up to 1.8.5.3. Update Content Mask to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025CP Multi View Event Calendar: Missing AuthorizationCVE-2025-58009 · WordPress plugins & themes · reported by PatchstackLow 3.8
Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.35.
- Product
- CP Multi View Event Calendar
- Affected
- up to 1.4.35
- What to do
- Affects up to 1.4.35. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Hubbub Lite: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58007 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through <= 1.35.2.
- Product
- Hubbub Lite
- Affected
- up to 1.35.2
- What to do
- Affects up to 1.35.2. Update Hubbub Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025DriCub: Missing AuthorizationCVE-2025-58004 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DriCub: from n/a through <= 2.9.
- Product
- DriCub
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update DriCub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Javo Core: Missing AuthorizationCVE-2025-58003 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.266.
- Product
- Javo Core
- Affected
- up to 3.0.0.266
- What to do
- Affects up to 3.0.0.266. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2025Memberful - Membership: Missing AuthorizationCVE-2025-58000 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a through <= 1.75.0.
- Product
- Memberful - Membership
- Affected
- up to 1.75.0
- What to do
- Affects up to 1.75.0. Update Memberful - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.