Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 63 of 126
Jun 20, 2025App Builder: Missing AuthorizationCVE-2025-49989 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in App Cheap App Builder app-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Builder: from n/a through <= 5.5.6.
- Product
- App Builder
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Contact Form 7 AWeber Extension: Missing AuthorizationCVE-2025-49988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through <= 0.1.40.
- Product
- Contact Form 7 AWeber Extension
- Affected
- up to 0.1.40
- What to do
- Affects up to 0.1.40. Update Contact Form 7 AWeber Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025CRM ERP Business Solution: Missing AuthorizationCVE-2025-49987 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CRM ERP Business Solution: from n/a through <= 1.13.
- Product
- CRM ERP Business Solution
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update CRM ERP Business Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Video List Manager: Missing AuthorizationCVE-2025-49986 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in thanhtungtnt Video List Manager video-list-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Video List Manager: from n/a through <= 1.7.
- Product
- Video List Manager
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP Customer Area: Missing AuthorizationCVE-2025-49982 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through <= 8.3.4.
- Product
- WP Customer Area
- Affected
- up to 8.3.4
- What to do
- Affects up to 8.3.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025User Roles and Capabilities: Missing AuthorizationCVE-2025-49981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through <= 1.2.6.
- Product
- User Roles and Capabilities
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update User Roles and Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025WP User Profile Avatar: Missing AuthorizationCVE-2025-49980 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.
- Product
- WP User Profile Avatar
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Media Hygiene: Missing AuthorizationCVE-2025-49979 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through <= 4.0.1.
- Product
- Media Hygiene
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Media Hygiene to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025JobSearch: Authorization Bypass Through User-Controlled KeyCVE-2025-49978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.
- Product
- JobSearch
- What to do
- Update JobSearch to the newest version.
Jun 20, 2025Notifier: Missing AuthorizationCVE-2025-49976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.12.
- Product
- Notifier
- Affected
- up to 2.7.12
- What to do
- Affects up to 2.7.12. Update Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025UpStream: a Project Management Plugin for: Missing AuthorizationCVE-2025-49974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through <= 2.1.1.
- Product
- UpStream: a Project Management Plugin for
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update UpStream: a Project Management Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: Missing AuthorizationCVE-2025-49973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes: from n/a through <= 1.0.10.
- Product
- Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025eDS Responsive Menu: Missing AuthorizationCVE-2025-49971 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
- Product
- eDS Responsive Menu
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update eDS Responsive Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Hello FSE Blog: Missing AuthorizationCVE-2025-49970 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through <= 1.0.6.
- Product
- Hello FSE Blog
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Hello FSE Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Zara 4 Image Compression: Missing AuthorizationCVE-2025-49969 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through <= 1.2.17.2.
- Product
- Zara 4 Image Compression
- Affected
- up to 1.2.17.2
- What to do
- Affects up to 1.2.17.2. Update Zara 4 Image Compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2025AI Engine: Unauthorized modification of data and loss of dataCVE-2025-5071 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Meow_MWAI_Labs_MCP::can_access_mcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the MCP and run various commands like 'wp_create_user', 'wp_update_user' and 'wp_update_option', which can be used for privilege escalation, and 'wp_update_post', 'wp_delete_post', 'wp_update_comment' and 'wp_delete_comment', which can be used to edit and delete posts and comments.
- Product
- AI Engine
- Affected
- 2.8.0 to 2.8.3
- What to do
- Affects 2.8.0 to 2.8.3. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized view and modification of dataCVE-2025-4571 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 18, 2025Breeze: Missing AuthorizationCVE-2025-23999 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.13.
- Product
- Breeze
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2025Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Unauthorized arbitrary plugin installationCVE-2025-1562 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.
- Product
- Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2025CubeWP Forms: Missing AuthorizationCVE-2025-49880 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.5.
- Product
- CubeWP Forms
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CubeWP Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Arconix FAQ: Missing AuthorizationCVE-2025-49874 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix FAQ: from n/a through <= 1.9.6.
- Product
- Arconix FAQ
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update Arconix FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025myCred: Missing AuthorizationCVE-2025-49872 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects myCred: from n/a through <= 2.9.4.2.
- Product
- myCred
- Affected
- up to 2.9.4.2
- What to do
- Affects up to 2.9.4.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025AFS Analytics: Missing AuthorizationCVE-2025-49864 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AFS Analytics AFS Analytics addfreestats allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AFS Analytics: from n/a through <= 4.21.
- Product
- AFS Analytics
- Affected
- up to 4.21
- What to do
- Affects up to 4.21. Update AFS Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025myCred: Missing AuthorizationCVE-2025-49857 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.4.2.
- Product
- myCred
- Affected
- up to 2.9.4.2
- What to do
- Affects up to 2.9.4.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025WP Dummy Content Generator: Missing AuthorizationCVE-2025-49234 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through <= 3.4.6.
- Product
- WP Dummy Content Generator
- Affected
- up to 3.4.6
- What to do
- Affects up to 3.4.6. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Unauthorized modification of dataCVE-2025-3880 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected.
- Product
- Poll, Survey & Quiz Maker Plugin by Opinion Stage
- Affected
- up to 19.9.0
- What to do
- Affects up to 19.9.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2025Traffic Monitor: Unauthorized modification of dataCVE-2025-5815 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging.
- Product
- Traffic Monitor
- Affected
- up to 3.2.2
- What to do
- Affects up to 3.2.2. Update Traffic Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2025WP Travel Engine – Tour Booking Plugin – Tour Operator Software: Unauthorized loss of dataCVE-2025-5282 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to delete arbitrary posts.
- Product
- WP Travel Engine – Tour Booking Plugin – Tour Operator Software
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 12, 2025WordPress Single Sign-On (SSO): Unauthorized accessCVE-2025-6003 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.
- Product
- WordPress Single Sign-On (SSO)
- Affected
- up to the
- What to do
- Affects up to the. Update WordPress Single Sign-On (SSO) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.miniorange.comwordfence.com
Jun 10, 2025Audio Editor & Recorder: Missing AuthorizationCVE-2025-49509 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audio Editor & Recorder: from n/a through <= 2.2.1.
- Product
- Audio Editor & Recorder
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Audio Editor & Recorder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Membership For WooCommerce: Missing AuthorizationCVE-2025-49265 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.8.1.
- Product
- Membership For WooCommerce
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025CryptoCloud - Crypto Payment Gateway: Missing AuthorizationCVE-2025-48147 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through <= 2.1.2.
- Product
- CryptoCloud - Crypto Payment Gateway
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update CryptoCloud - Crypto Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025StyleAI: Missing AuthorizationCVE-2025-48139 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in relentlo StyleAI relentlosoftware allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects StyleAI: from n/a through <= 1.0.4.
- Product
- StyleAI
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update StyleAI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Icegram Collect: Missing AuthorizationCVE-2025-47527 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect: from n/a through <= 1.3.18.
- Product
- Icegram Collect
- Affected
- up to 1.3.18
- What to do
- Affects up to 1.3.18. Update Icegram Collect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Stock Locations for WooCommerce: Missing AuthorizationCVE-2025-47463 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 2.8.6.
- Product
- Stock Locations for WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Stock Locations for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Team Builder: Missing AuthorizationCVE-2025-32308 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in looks_awesome Team Builder a-team-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Builder: from n/a through <= 1.5.7.
- Product
- Team Builder
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Team Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025elfsight Contact Form widget: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31045 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows Retrieve Embedded Sensitive Data.This issue affects elfsight Contact Form widget: from n/a through <= 2.3.1.
- Product
- elfsight Contact Form widget
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update elfsight Contact Form widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2025Profiler – What Slowing Down Your WP: Unauthorized modification of dataCVE-2025-5814 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsd_plugin_control() function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate previously deactivated plugins after accessing the "Profiler" page.
- Product
- Profiler – What Slowing Down Your WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Profiler – What Slowing Down Your WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 7, 2025MaxiBlocks: Missing AuthorizationCVE-2025-47601 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Privilege Escalation.This issue affects MaxiBlocks: from n/a through <= 2.1.0.
- Product
- MaxiBlocks
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update MaxiBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Interactive Regional Map of Florida: Missing AuthorizationCVE-2025-49441 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Map Plugins Interactive Regional Map of Florida interactive-map-of-florida allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Regional Map of Florida: from n/a through <= 1.0.
- Product
- Interactive Regional Map of Florida
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Interactive Regional Map of Florida to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Foxit eSign for: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-49419 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Foxit eSign for WordPress: from n/a through <= 2.0.3.
- Product
- Foxit eSign for
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Foxit eSign for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Job Board Manager: Missing AuthorizationCVE-2025-49324 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.60.
- Product
- Job Board Manager
- Affected
- up to 2.1.60
- What to do
- Affects up to 2.1.60. Update Job Board Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025FraudLabs Pro for WooCommerce: Missing AuthorizationCVE-2025-49320 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FraudLabs Pro for WooCommerce: from n/a through <= 2.22.11.
- Product
- FraudLabs Pro for WooCommerce
- Affected
- up to 2.22.11
- What to do
- Affects up to 2.22.11. Update FraudLabs Pro for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Crawlomatic Multisite Scraper Post Generator: Missing AuthorizationCVE-2025-49293 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
- Product
- Crawlomatic Multisite Scraper Post Generator
- Affected
- up to 2.6.8.2
- What to do
- Affects up to 2.6.8.2. Update Crawlomatic Multisite Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025PDF for WPForms: Missing AuthorizationCVE-2025-49289 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.5.0.
- Product
- PDF for WPForms
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update PDF for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Ultimate WP Mail: Missing AuthorizationCVE-2025-49288 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through <= 1.3.5.
- Product
- Ultimate WP Mail
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Ultimate WP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Product Feed for WooCommerce: Missing AuthorizationCVE-2025-49287 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.
- Product
- Product Feed for WooCommerce
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Trinity Audio: Missing AuthorizationCVE-2025-49272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0.
- Product
- Trinity Audio
- Affected
- up to 5.20.0
- What to do
- Affects up to 5.20.0. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025WP-CRM System: Missing AuthorizationCVE-2025-49270 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.
- Product
- WP-CRM System
- Affected
- up to 3.4.2
- What to do
- Affects up to 3.4.2. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2025Verge3D: Missing AuthorizationCVE-2025-49268 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.
- Product
- Verge3D
- Affected
- up to 4.9.4
- What to do
- Affects up to 4.9.4. Update Verge3D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.