Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

515 results · page 6 of 11

Dec 18, 2025Demo Importer Plus: Unauthorized modification of data, loss of data, and privilege escalationCVE-2025-14364 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full site reset, dropping all database tables except users/usermeta and re-running wp_install(), which also assigns the Administrator role to the attacking subscriber account.
Product
Demo Importer Plus
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Demo Importer Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2025Fox LMS – WordPress LMS: Privilege escalationCVE-2025-14156 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/payments/create-order` REST API endpoint. This makes it possible for unauthenticated attackers to create new user accounts with arbitrary roles, including administrator, leading to complete site compromise.
Product
Fox LMS – WordPress LMS
Affected
up to 1.0.5.1
What to do
Affects up to 1.0.5.1. Update Fox LMS – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Postem Ipsum: Unauthorized modification of data to Privilege EscalationCVE-2025-14397 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary user accounts with the administrator role.
Product
Postem Ipsum
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Postem Ipsum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 11, 2025LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart: Privilege escalationCVE-2025-12963 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin
Product
LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart
Affected
up to 1.2.29
What to do
Affects up to 1.2.29. Update LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 10, 2025WP CarDealer: Privilege EscalationCVE-2025-13764 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Product
WP CarDealer
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update WP CarDealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Dec 5, 2025CRM Memberships: Privilege escalationCVE-2025-13313 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CRM Memberships plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 2.6. This is due to missing authorization and authentication checks on the `ntzcrm_changepassword` AJAX action. This makes it possible for unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts via the `ntzcrm_changepassword` endpoint, granted they can obtain or enumerate a target user's email address. The plugin also exposes the `ntzcrm_get_users` endpoint without authentication, allowing attackers to enumerate subscriber email addresses, facilitating the exploitation of the password reset vulnerability.
Product
CRM Memberships
Affected
up to 2.6
What to do
Affects up to 2.6. Update CRM Memberships to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 2, 2025DesignThemes LMS: Privilege EscalationCVE-2025-13542 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.4. This is due to the 'dtlms_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Product
DesignThemes LMS
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update DesignThemes LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Dec 2, 2025ELEX WordPress HelpDesk & Customer Ticketing System: Privilege EscalationCVE-2025-13534 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WSDesk privileges from limited "Reply Tickets" permissions to full helpdesk administrator capabilities, gaining unauthorized access to ticket management, settings configuration, agent administration, and sensitive customer data.
Product
ELEX WordPress HelpDesk & Customer Ticketing System
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 27, 2025Tiger: Privilege EscalationCVE-2025-13680 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user->set_role() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
Product
Tiger
Affected
up to 101.2.1
What to do
Affects up to 101.2.1. Update Tiger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 27, 2025Tiger: Privilege EscalationCVE-2025-13675 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Product
Tiger
Affected
up to 101.2.1
What to do
Affects up to 101.2.1. Update Tiger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 27, 2025Tiare Membership: Privilege EscalationCVE-2025-13540 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiare_membership_init_rest_api_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Product
Tiare Membership
Affected
up to 1.2
What to do
Affects up to 1.2. Update Tiare Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 27, 2025FindAll Listing: Privilege EscalationCVE-2025-13538 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin.
Product
FindAll Listing
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update FindAll Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 25, 2025EduKart Pro: Privilege EscalationCVE-2025-13559 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EduKart Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'edukart_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Product
EduKart Pro
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update EduKart Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 21, 2025Realty Portal: Unauthorized modification of data that can lead to privilege escalationCVE-2025-11985 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0.1 to 0.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Realty Portal
Affected
0.1 to 0.4.1
What to do
Affects 0.1 to 0.4.1. Update Realty Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org developer.wordpress.org
Nov 12, 2025LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes: Privilege escalationCVE-2025-11923 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation. This is due to the plugin not properly validating a user's identity prior to allowing them to modify their own role via the REST API. The permission check in the update_item_permissions_check() function returns true when a user updates their own account without verifying the role changes. This makes it possible for authenticated attackers, with student-level access and above, to escalate their privileges to administrator by updating their own roles array via a crafted REST API request. Another endpoint intended for instructors also provides an attack vector. Affected version ranges are 3.5.3-3.41.2, 4.0.0-4.21.3, 5.0.0-5.10.0, 6.0.0-6.11.0, 7.0.0-7.8.7, 8.0.0-8.0.7, 9.0.0-9.0.7, 9.1.0.
Product
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
What to do
Update LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 10, 2025EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce: Privilege EscalationCVE-2025-11457 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privilege Escalation in versions 0.9.0-beta2 to 1.8.2. This is due to the /easycommerce/v1/orders REST API endpoint not properly restricting the ability for users to select roles during registration. This makes it possible for unauthenticated attackers to gain administrator-level access to a vulnerable site.
Product
EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce
Affected
0.9.0-beta2 to 1.8.2
What to do
Affects 0.9.0-beta2 to 1.8.2. Update EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 10, 2025Mementor Core: Privilege EscalationCVE-2025-11168 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality.
Product
Mementor Core
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Mementor Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 7, 2025IDonate – Blood Donation, Request And Donor Management System: Privilege EscalationCVE-2025-4519 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_password() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate a password reset for any user (including administrators) and elevate their privileges for full site takeover.
Product
IDonate – Blood Donation, Request And Donor Management System
Affected
2.1.5 to 2.1.9
What to do
Affects 2.1.5 to 2.1.9. Update IDonate – Blood Donation, Request And Donor Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 6, 2025LC Wizard: Privilege EscalationCVE-2025-5483 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The LC Wizard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check in the ghl-wizard/inc/wp_user.php file in versions 1.2.10 to 1.3.0. This makes it possible for unauthenticated attackers to create new user accounts with the administrator role when the PRO functionality is enabled.
Product
LC Wizard
Affected
1.2.10 to 1.3.0
What to do
Affects 1.2.10 to 1.3.0. Update LC Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 4, 2025Simple User Capabilities: Privilege EscalationCVE-2025-12158 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.
Product
Simple User Capabilities
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple User Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Nov 3, 2025Doccure Core: Privilege escalationCVE-2025-8900 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Product
Doccure Core
What to do
Update Doccure Core to the newest version.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 1, 2025Service Finder Bookings: Privilege escalationCVE-2025-6574 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
Service Finder Bookings
What to do
Update Service Finder Bookings to the newest version.
Full record and what to do →NVD record themeforest.net wordfence.com
Nov 1, 2025Service Finder Bookings: Privilege escalationCVE-2025-5949 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change request. This makes it possible for authenticated attackers with subscriber access or higher to reset other users' passwords, including those of admins.
Product
Service Finder Bookings
Affected
up to 6.0
What to do
Affects up to 6.0. Update Service Finder Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 31, 2025King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor: Privilege escalationCVE-2025-8489 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.
Product
King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor
Affected
24.12.92 to 51.1.14
What to do
Affects 24.12.92 to 51.1.14. Update King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 22, 2025Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Privilege escalationCVE-2025-11086 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin not properly validating a user's role prior to registering a user via the Social Login addon. This makes it possible for unauthenticated attackers to update their role to Administrator when registering on the site.
Product
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Affected
up to 3.3.7
What to do
Affects up to 3.3.7. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record academylms.net academylms.net
Oct 15, 2025Orion SMS OTP Verification: Privilege escalationCVE-2025-9967 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number
Product
Orion SMS OTP Verification
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Orion SMS OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025WPBifröst – Instant Passwordless Temporary Login Links: Privilege EscalationCVE-2025-10299 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts and subsequently log in as those.
Product
WPBifröst – Instant Passwordless Temporary Login Links
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update WPBifröst – Instant Passwordless Temporary Login Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 15, 2025Keyy Two Factor Authentication (like Clef): Privilege escalationCVE-2025-10293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity associated with a token generated. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate valid auth tokens and leverage that to auto-login as other accounts, including administrators, as long as the administrator has the 2FA set up.
Product
Keyy Two Factor Authentication (like Clef)
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Keyy Two Factor Authentication (like Clef) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 15, 2025Binary MLM Plan: Limited Privilege EscalationCVE-2025-10038 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings.
Product
Binary MLM Plan
Affected
up to 3.0
What to do
Affects up to 3.0. Update Binary MLM Plan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity: Privilege escalationCVE-2025-6042 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.0. This is due to the plugin assigning the editor role by default. While limitations with respect to capabilities are put in place, use of the API is not restricted. This vulnerability can be leveraged together with CVE-2025-6038 to obtain admin privileges.
Product
Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 11, 2025WP Freeio: Privilege EscalationCVE-2025-11533 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Product
WP Freeio
Affected
up to 1.2.21
What to do
Affects up to 1.2.21. Update WP Freeio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 9, 2025Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity: Privilege escalationCVE-2025-6038 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including those of administrators.
Product
Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 3, 2025Appy Pie Connect for WooCommerce: Privilege EscalationCVE-2025-9286 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to reset the password of arbitrary users, including administrators, thereby gaining administrative access.
Product
Appy Pie Connect for WooCommerce
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Appy Pie Connect for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 24, 2025MultiLoca - WooCommerce Multi Locations Inventory Management: Unauthorized modification of data that can lead to privilege escalationCVE-2025-9054 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
MultiLoca - WooCommerce Multi Locations Inventory Management
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update MultiLoca - WooCommerce Multi Locations Inventory Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 19, 2025Miniorange OTP Verification with Firebase: Privilege escalationCVE-2025-7665 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to Administrator. Premium features must be enabled in order to exploit the vulnerability.
Product
Miniorange OTP Verification with Firebase
Affected
3.1.0 to 3.6.2
What to do
Affects 3.1.0 to 3.6.2. Update Miniorange OTP Verification with Firebase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 19, 2025Service Finder Bookings: Privilege escalationCVE-2025-5948 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claim_business AJAX action. This makes it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges or brute-forcing are needed when completing the business takeover. The claim_id is needed to takeover the admin account, but brute-forcing is a practical approach to obtaining valid IDs.
Product
Service Finder Bookings
Affected
up to 6.0
What to do
Affects up to 6.0. Update Service Finder Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 11, 2025BeyondCart Connector: Privilege EscalationCVE-2025-8570 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 3.0.1. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.
Product
BeyondCart Connector
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update BeyondCart Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 11, 2025My WP Translate: Unauthorized modification of data that can lead to privilege escalationCVE-2025-8425 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The My WP Translate plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_import_strings() function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
My WP Translate
Affected
up to 1.1
What to do
Affects up to 1.1. Update My WP Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2025Resideo Plugin for Resideo - Real Estate: Privilege escalationCVE-2025-7718 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.5.4. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
Resideo Plugin for Resideo - Real Estate
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Resideo Plugin for Resideo - Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Sep 10, 2025WPGYM - Wordpress Gym Management System: Privilege escalationCVE-2025-7049 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ_gmgt_gmgt_add_user' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the email, password, and other details of any user, including Administrator users.
Product
WPGYM - Wordpress Gym Management System
Affected
up to 67.7.0
What to do
Affects up to 67.7.0. Update WPGYM - Wordpress Gym Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Aug 26, 2025Event List: Privilege escalationCVE-2025-6366 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Event List plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.0.4. This is due to the plugin not properly validating a user's capabilities prior to updating their profile in the el_update_profile() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their capabilities to those of an administrator.
Product
Event List
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Event List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 26, 2025Dokan Pro: Privilege escalationCVE-2025-5931 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.5. This is due to the plugin not properly validating a user's identity prior to updating their password during a staff password reset. This makes it possible for authenticated attackers, with vendor-level access and above, to elevate their privilege to the level of a staff member and then change arbitrary user passwords, including those of administrators in order to gain access to their accounts. By default, the plugin allows customers to become vendors.
Product
Dokan Pro
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Dokan Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dokan.co wordfence.com
Aug 19, 2025Real Spaces - WordPress Properties Directory: Privilege escalationCVE-2025-8218 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during a profile update.
Product
Real Spaces - WordPress Properties Directory
Affected
up to 3.5
What to do
Affects up to 3.5. Update Real Spaces - WordPress Properties Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 19, 2025Real Spaces - WordPress Properties Directory: Privilege escalationCVE-2025-6758 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible for unauthenticated attackers to arbitrarily choose their role, including the Administrator role, during user registration.
Product
Real Spaces - WordPress Properties Directory
Affected
up to 3.6
What to do
Affects up to 3.6. Update Real Spaces - WordPress Properties Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 16, 2025Taxi Booking Manager for Woocommerce | E-cab: Privilege escalationCVE-2025-8898 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.0. This is due to the plugin not properly validating a user's capabilities prior to updating a plugin setting or their identity prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. CVE-2025-54713 is likely a duplicate of this issue.
Product
Taxi Booking Manager for Woocommerce | E-cab
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Taxi Booking Manager for Woocommerce | E-cab to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 12, 2025B Blocks: Privilege EscalationCVE-2025-8059 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and assign it the administrator role.
Product
B Blocks
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update B Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2025Eventin: Privilege escalationCVE-2025-4796 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Product
Eventin
Affected
up to 4.0.34
What to do
Affects up to 4.0.34. Update Eventin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 6, 2025Reveal Listing plugin by smartdatasoft: Privilege escalationCVE-2025-6994 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'listing_user_role' field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
Product
Reveal Listing plugin by smartdatasoft
Affected
up to 3.3
What to do
Affects up to 3.3. Update Reveal Listing plugin by smartdatasoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Aug 2, 2025SEO Metrics: Privilege EscalationCVE-2025-6754 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_click() AJAX handler and the seo_metrics_handle_custom_endpoint() function in all versions up to, and including, 1.0.15. Because the AJAX action only verifies a nonce, without checking the caller’s capabilities, a subscriber-level user can retrieve the token and then access the custom endpoint to obtain full administrator cookies.
Product
SEO Metrics
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update SEO Metrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2025Service Finder Bookings: Privilege escalationCVE-2025-5947 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins.
Product
Service Finder Bookings
Affected
up to 6.0
What to do
Affects up to 6.0. Update Service Finder Bookings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.