Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,090 results · page 7 of 22

Jan 28, 2026WP Adminify: Sensitive Information ExposureCVE-2026-1060 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs.
Product
WP Adminify
Affected
up to 4.0.7.7
What to do
Affects up to 4.0.7.7. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026CubeWP – All-in-One Dynamic Content Framework: Information ExposureCVE-2025-6461 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the search feature in class-cubewp-search-ajax-hooks.php due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Product
CubeWP – All-in-One Dynamic Content Framework
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update CubeWP – All-in-One Dynamic Content Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2026WP Directory Kit: Sensitive Information ExposureCVE-2025-13920 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action AJAX handler. This makes it possible for unauthenticated attackers to extract email addresses for users with Directory Kit-specific user roles.
Product
WP Directory Kit
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2026MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor: Sensitive Information ExposureCVE-2026-0633 · WordPress plugins & themes · reported by WordfenceLow 3.7
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.0. This is due to the use of a forgeable cookie value derived only from the entry ID and current user ID without a server-side secret. This makes it possible for unauthenticated attackers to access form submission entry data via MetForm shortcodes for entries created within the transient TTL (default is 15 minutes).
Product
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2026AWP Classifieds: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24593 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: from n/a through <= 4.4.3.
Product
AWP Classifieds
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Fraud Prevention For Woocommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24553 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects Fraud Prevention For Woocommerce: from n/a through <= 2.3.2.
Product
Fraud Prevention For Woocommerce
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Fraud Prevention For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Webpushr: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0.
Product
Webpushr
Affected
up to 4.38.0
What to do
Affects up to 4.38.0. Update Webpushr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026WP FullCalendar: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.
Product
WP FullCalendar
Affected
up to 1.6
What to do
Affects up to 1.6. Update WP FullCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Nexter Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24377 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.6.3.
Product
Nexter Blocks
Affected
up to 4.6.3
What to do
Affects up to 4.6.3. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Contact Form & Lead Form Elementor Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.
Product
Contact Form & Lead Form Elementor Builder
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Contact Form & Lead Form Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026Salon booking system: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67954 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.
Product
Salon booking system
Affected
up to 10.30.3
What to do
Affects up to 10.30.3. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 22, 2026REHub Framework: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63051 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue affects REHub Framework: from n/a through < 19.9.9.4.
Product
REHub Framework
What to do
Update REHub Framework to the newest version.
Full record and what to do →NVD record patchstack.com
Jan 19, 2026LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2025-14798 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_permissions_check function. This makes it possible for unauthenticated attackers to extract sensitive data including user first names and last names. Other information such as social profile links and enrollment are also included.
Product
LearnPress – WordPress LMS
Affected
up to 4.3.2.4
What to do
Affects up to 4.3.2.4. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 17, 2026CubeWP – All-in-One Dynamic Content Framework: Information ExposureCVE-2025-12129 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via the /cubewp-posts/v1/query-new and /cubewp-posts/v1/query REST API endpoints due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Product
CubeWP – All-in-One Dynamic Content Framework
Affected
up to 1.1.27
What to do
Affects up to 1.1.27. Update CubeWP – All-in-One Dynamic Content Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2026WP Hotel Booking: Sensitive Information ExposureCVE-2025-14075 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Hotel Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.7. This is due to the plugin exposing the 'hotel_booking_fetch_customer_info' AJAX action to unauthenticated users without proper capability checks, relying only on a nonce for protection. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including full names, addresses, phone numbers, and email addresses by providing a valid email address and a publicly accessible nonce.
Product
WP Hotel Booking
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Essential Addons for Elementor: Sensitive Information ExposureCVE-2026-1004 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated attackers to retrieve WooCommerce product information for products with draft, pending, or private status, which should normally be restricted.
Product
Essential Addons for Elementor
Affected
up to 6.5.5
What to do
Affects up to 6.5.5. Update Essential Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 16, 2026WP Recipe Maker: Information ExposureCVE-2025-15527 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the api_get_post_summary function due to insufficient restrictions on which posts can be retrieved. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from posts they may not be able to edit or read otherwise. This also affects password protected, private, or draft posts that they should not have access to.
Product
WP Recipe Maker
Affected
up to 10.2.2
What to do
Affects up to 10.2.2. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2026Fancy Product Designer: Full Path DisclosureCVE-2025-15526 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.fancyproductdesigner.com wordfence.com
Jan 16, 2026Booking Calendar: Missing Authorization leading to Sensitive Information ExposureCVE-2025-14982 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view all booking records in the database, including personally identifiable information (PII) such as names, email addresses, phone numbers, physical addresses, payment status, booking costs, and booking hashes belonging to other users.
Product
Booking Calendar
Affected
up to 10.14.11
What to do
Affects up to 10.14.11. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026LottieFiles – Lottie block for Gutenberg: Sensitive Information ExposureCVE-2026-0717 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the 'Share LottieFiles account with other WordPress users' option is enabled.
Product
LottieFiles – Lottie block for Gutenberg
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update LottieFiles – Lottie block for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 14, 2026PDF Resume Parser: Sensitive Information ExposureCVE-2025-14464 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0. This is due to the plugin registering an AJAX action handler that is accessible to unauthenticated users and exposes SMTP configuration data including credentials. This makes it possible for unauthenticated attackers to extract sensitive SMTP credentials (username and password) from the WordPress configuration, which could be leveraged to compromise email accounts and potentially gain unauthorized access to other systems using the same credentials.
Product
PDF Resume Parser
Affected
up to 1.0
What to do
Affects up to 1.0. Update PDF Resume Parser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 13, 2026EventPrime - Events Calendar, Bookings and Tickets: Sensitive Information ExposureCVE-2025-14507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0.
Product
EventPrime - Events Calendar, Bookings and Tickets
Affected
up to 4.2.7.0
What to do
Affects up to 4.2.7.0. Update EventPrime - Events Calendar, Bookings and Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 10, 2026Blog2Social: Social Media Auto Post & Scheduler: Sensitive Information ExposureCVE-2025-14943 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. This is due to a misconfigured authorization check on the 'getShipItemFullText' function which only verifies that a user has the 'read' capability (Subscriber-level) and a valid nonce, but fails to verify whether the user has permission to access the specific post being requested. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password-protected, private, or draft posts.
Product
Blog2Social: Social Media Auto Post & Scheduler
Affected
up to 8.7.2
What to do
Affects up to 8.7.2. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Booking Calendar: Sensitive Information ExposureCVE-2025-14146 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIMELINE_NAV` AJAX action. This is due to the nonce verification being conditionally disabled by default (`booking_is_nonce_at_front_end` option is `'Off'` by default). When the `booking_is_show_popover_in_timeline_front_end` option is enabled (which is the default in demo installations and can be enabled by administrators), it is possible for unauthenticated attackers to extract sensitive booking data including customer names, email addresses, phone numbers, and booking details.
Product
Booking Calendar
Affected
up to 10.14.10
What to do
Affects up to 10.14.10. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026BetterDocs: Sensitive Information ExposureCVE-2025-14980 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive data including the OpenAI API key stored in plugin settings.
Product
BetterDocs
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Jan 9, 2026weDocs: Sensitive Information ExposureCVE-2025-14574 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including third party services API keys.
Product
weDocs
Affected
up to 2.1.15
What to do
Affects up to 2.1.15. Update weDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026MoneySpace: Sensitive Information ExposureCVE-2025-13371 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.9. This is due to the plugin storing full payment card details (PAN, card holder name, expiry month/year, and CVV) in WordPress post_meta using base64_encode(), and then embedding these values into the publicly accessible mspaylink page's inline JavaScript without any authentication or authorization check. This makes it possible for unauthenticated attackers who know or can guess an order_id to access the mspaylink endpoint and retrieve full credit card numbers and CVV codes directly from the HTML/JS response, constituting a severe PCI-DSS violation.
Product
MoneySpace
Affected
up to 2.13.9
What to do
Affects up to 2.13.9. Update MoneySpace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 7, 2026ShareThis Dashboard for Google Analytics: Sensitive Information ExposureCVE-2025-12540 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4. This is due to the Google Analytics client_ID and client_secret being stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to craft a link to the sharethis.com server, which will share an authorization token for Google Analytics with a malicious website, if the attacker can trick an administrator logged into the website and Google Analytics to click the link.
Product
ShareThis Dashboard for Google Analytics
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update ShareThis Dashboard for Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026aBlocks – WordPress Gutenberg Blocks: Unauthorized modification of data and disclosure of sensitive informationCVE-2025-12449 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. This makes it possible for authenticated attackers, with subscriber level access and above, to read plugin settings including block visibility, maintenance mode configuration, and third-party email marketing API keys, as well as read sensitive configuration data including API keys for email marketing services.
Product
aBlocks – WordPress Gutenberg Blocks
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update aBlocks – WordPress Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 6, 2026Plant - Gardening & Houseplants: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-31051 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EngoTheme Plant - Gardening & Houseplants WordPress Theme allows Retrieve Embedded Sensitive Data.This issue affects Plant - Gardening & Houseplants WordPress Theme: from n/a through 1.0.0.
Product
Plant - Gardening & Houseplants
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Plant - Gardening & Houseplants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Shortcodes and extra features for Phlox: Information ExposureCVE-2025-13215 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.17.13 via the auxels_ajax_search due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract titles of draft posts that they should not have access to.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.17.13
What to do
Affects up to 2.17.13. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 5, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Sensitive Information ExposureCVE-2025-11723 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.5 via the hash() function due to use of a hardcoded fall-back salt. This makes it possible for unauthenticated attackers to generate a valid token across sites running the plugin that have not manually set a salt in the wp-config.php file and access booking information that will allow them to make modifications.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.9.5
What to do
Affects up to 1.6.9.5. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 31, 2025BoomDevs WordPress Coming Soon: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62083 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs allows Retrieve Embedded Sensitive Data.This issue affects BoomDevs WordPress Coming Soon: from n/a through <= 1.0.4.
Product
BoomDevs WordPress Coming Soon
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update BoomDevs WordPress Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Direct Payments WP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-49340 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2.
Product
Direct Payments WP
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Direct Payments WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Post Video Players: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Retrieve Embedded Sensitive Data.This issue affects Post Video Players: from n/a through <= 1.163.
Product
Post Video Players
Affected
up to 1.163
What to do
Affects up to 1.163. Update Post Video Players to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Download Media Library: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62114 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in marcelotorres Download Media Library download-media-library allows Retrieve Embedded Sensitive Data.This issue affects Download Media Library: from n/a through <= 0.2.1.
Product
Download Media Library
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Download Media Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025PopupKit: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-69026 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue affects PopupKit: from n/a through <= 2.1.5.
Product
PopupKit
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update PopupKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025Poptics: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-69025 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.
Product
Poptics
Affected
up to 1.0.20
What to do
Affects up to 1.0.20. Update Poptics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025E-Invoice App Malaysia: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.
Product
E-Invoice App Malaysia
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update E-Invoice App Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 29, 2025PixelYourSite: Sensitive Information ExposureCVE-2025-14280 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, when the "Meta API logs" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully patched in version 11.1.5.1.
Product
PixelYourSite
Affected
up to 11.1.5
What to do
Affects up to 11.1.5. Update PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 24, 2025PostX: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.This issue affects PostX: from n/a through <= 5.0.3.
Product
PostX
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Virusdie: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6.
Product
Virusdie
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Virusdie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Premium Addons for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68494 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.53.
Product
Premium Addons for Elementor
Affected
up to 4.11.53
What to do
Affects up to 4.11.53. Update Premium Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Eight Day Week Print Workflow: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67621 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.
Product
Eight Day Week Print Workflow
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Eight Day Week Print Workflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 23, 2025VPSUForm: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68551 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vikas Ratudi VPSUForm v-form allows Retrieve Embedded Sensitive Data.This issue affects VPSUForm: from n/a through <= 3.2.24.
Product
VPSUForm
Affected
up to 3.2.24
What to do
Affects up to 3.2.24. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 21, 2025TempTool [Show Current Template Info]: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62955 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-name allows Retrieve Embedded Sensitive Data.This issue affects TempTool [Show Current Template Info]: from n/a through <= 1.3.1.
Product
TempTool [Show Current Template Info]
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update TempTool [Show Current Template Info] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 21, 2025SureForms: Stored Cross-Site ScriptingCVE-2025-14855 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SureForms
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2025Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6.CVE-2023-47232 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6.
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vdp.patchstack.com
Dec 20, 2025Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Sensitive Information ExposureCVE-2025-12492 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.0 via the ajax_get_members function. This is due to the use of a predictable low-entropy token (5 hex characters derived from md5 of post ID) to identify member directories and insufficient authorization checks on the unauthenticated AJAX endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, display names, user roles (including administrator accounts), profile URLs, and user IDs by enumerating predictable directory_id values or brute-forcing the small 16^5 token space.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.11.0
What to do
Affects up to 2.11.0. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2025Appointment Booking Calendar — Simply Schedule Appointments Booking: Sensitive Information ExposureCVE-2025-13754 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.9.16. This is due to the plugin exposing its admin embed endpoint at `/wp-json/ssa/v1/embed-inner-admin` without authentication, which leaks plugin settings including staff names, business names, and configuration data that are not publicly displayed on the booking form. This makes it possible for unauthenticated attackers to extract private business configuration. In premium versions with integrations configured, this might also expose other sensitive data including API keys for external services.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.9.16
What to do
Affects up to 1.6.9.16. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.