Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,268 results · page 71 of 126
Apr 1, 2025Publitio: Missing AuthorizationCVE-2025-31799 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Publitio: from n/a through <= 2.1.8.
- Product
- Publitio
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Publitio: Missing AuthorizationCVE-2025-31798 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Publitio: from n/a through <= 2.1.8.
- Product
- Publitio
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Publitio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Pin Generator: Missing AuthorizationCVE-2025-31791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Oliver Boyers Pin Generator pin-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pin Generator: from n/a through <= 2.0.0.
- Product
- Pin Generator
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Pin Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Cue: Missing AuthorizationCVE-2025-31787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AudioTheme Cue cue allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cue: from n/a through <= 2.4.4.
- Product
- Cue
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Cue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Simple Icons: Missing AuthorizationCVE-2025-31786 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Travis Simple Icons simple-icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Icons: from n/a through <= 2.8.4.
- Product
- Simple Icons
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Simple Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025mb.YTPlayer: Missing AuthorizationCVE-2025-31782 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in pupunzi mb.YTPlayer wpmbytplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects mb.YTPlayer: from n/a through <= 3.3.8.
- Product
- mb.YTPlayer
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update mb.YTPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Gift Cards for WooCommerce: Missing AuthorizationCVE-2025-31781 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ahmadshyk Gift Cards for WooCommerce woo-giftcards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Cards for WooCommerce: from n/a through <= 1.5.8.
- Product
- Gift Cards for WooCommerce
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Gift Cards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Append Content: Missing AuthorizationCVE-2025-31780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Andy Stratton Append Content append-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Append Content: from n/a through <= 2.1.1.
- Product
- Append Content
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Append Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Clockinator Lite: Missing AuthorizationCVE-2025-31777 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BeastThemes Clockinator Lite clockify-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clockinator Lite: from n/a through <= 1.0.9.
- Product
- Clockinator Lite
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Clockinator Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Astra Security Suite: Missing AuthorizationCVE-2025-31774 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebProtect.ai Astra Security Suite getastra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Astra Security Suite: from n/a through <= 0.2.
- Product
- Astra Security Suite
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Astra Security Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ship Per Product: Missing AuthorizationCVE-2025-31773 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cedcommerce Ship Per Product ship-per-product allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ship Per Product: from n/a through <= 2.1.0.
- Product
- Ship Per Product
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Ship Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025GDPR Cookie Notice: Missing AuthorizationCVE-2025-31765 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themeqx GDPR Cookie Notice gdpr-cookie-notice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR Cookie Notice: from n/a through <= 1.2.0.
- Product
- GDPR Cookie Notice
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update GDPR Cookie Notice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Free Woocommerce Product Table View: Missing AuthorizationCVE-2025-31757 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Free Woocommerce Product Table View: from n/a through <= 1.78.
- Product
- Free Woocommerce Product Table View
- Affected
- up to 1.78
- What to do
- Affects up to 1.78. Update Free Woocommerce Product Table View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025pCloud Backup: Missing AuthorizationCVE-2025-31755 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in josselynj pCloud Backup pcloud-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects pCloud Backup: from n/a through <= 1.0.1.
- Product
- pCloud Backup
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update pCloud Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Bulk Fields Editor: Missing AuthorizationCVE-2025-31752 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in termel Bulk Fields Editor bulk-user-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Fields Editor: from n/a through <= 1.8.0.
- Product
- Bulk Fields Editor
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Bulk Fields Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025GB Gallery Slideshow: Missing AuthorizationCVE-2025-31732 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GB Gallery Slideshow: from n/a through <= 1.3.
- Product
- GB Gallery Slideshow
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update GB Gallery Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Author Bio Shortcode: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31731 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Philip John Author Bio Shortcode author-bio-shortcode allows Stored XSS.This issue affects Author Bio Shortcode: from n/a through <= 2.5.3.
- Product
- Author Bio Shortcode
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Author Bio Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Zoho Flow: Missing AuthorizationCVE-2025-31408 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zoho Flow Zoho Flow zoho-flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho Flow: from n/a through <= 2.13.3.
- Product
- Zoho Flow
- Affected
- up to 2.13.3
- What to do
- Affects up to 2.13.3. Update Zoho Flow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025YayExtra: Missing AuthorizationCVE-2025-31415 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in YayCommerce YayExtra yayextra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayExtra: from n/a through <= 1.5.2.
- Product
- YayExtra
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update YayExtra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025King Addons for Elementor: Missing AuthorizationCVE-2025-30926 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in KingAddons.com King Addons for Elementor king-addons.This issue affects King Addons for Elementor: from n/a through <= 24.12.58.
- Product
- King Addons for Elementor
- Affected
- up to 24.12.58
- What to do
- Affects up to 24.12.58. Update King Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025JS Help Desk: Missing AuthorizationCVE-2025-30880 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through <= 2.9.2.
- Product
- JS Help Desk
- Affected
- up to 2.9.2
- What to do
- Affects up to 2.9.2. Update JS Help Desk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025About Author: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30808 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin About Author about-author allows Reflected XSS.This issue affects About Author: from n/a through <= 1.6.2.
- Product
- About Author
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update About Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Our Team Members: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-30802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPBean Our Team Members our-team-members.This issue affects Our Team Members: from n/a through <= 2.2.
- Product
- Our Team Members
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Our Team Members to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Greek Multi Tool – Fix peralinks, accents, auto create menus and more: Missing AuthorizationCVE-2025-30797 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in bigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto create menus and more greek-multi-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greek Multi Tool – Fix peralinks, accents, auto create menus and more: from n/a through <= 2.3.1.
- Product
- Greek Multi Tool – Fix peralinks, accents, auto create menus and more
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Greek Multi Tool – Fix peralinks, accents, auto create menus and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Connector to CiviCRM with CiviMcRestFace: Missing AuthorizationCVE-2025-31618 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.10.
- Product
- Connector to CiviCRM with CiviMcRestFace
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Connector to CiviCRM with CiviMcRestFace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Auto Post After Image Upload: Missing AuthorizationCVE-2025-31611 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Post After Image Upload: from n/a through <= 1.6.
- Product
- Auto Post After Image Upload
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Auto Post After Image Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025WPCargo Track & Trace: Missing AuthorizationCVE-2025-31609 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
- Product
- WPCargo Track & Trace
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025SP Blog Designer: Missing AuthorizationCVE-2025-31606 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Missing Authorization vulnerability in softpulseinfotech SP Blog Designer sp-blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SP Blog Designer: from n/a through <= 1.0.0.
- Product
- SP Blog Designer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SP Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025CF7 Spreadsheets: Missing AuthorizationCVE-2025-31603 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
- Product
- CF7 Spreadsheets
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update CF7 Spreadsheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Chat by Chatwee: Missing AuthorizationCVE-2025-31596 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Chatwee Chat by Chatwee chatwee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chat by Chatwee: from n/a through <= 2.1.3.
- Product
- Chat by Chatwee
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Chat by Chatwee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Elfsight Testimonials Slider: Missing AuthorizationCVE-2025-31584 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
- Product
- Elfsight Testimonials Slider
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Elfsight Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025PostmarkApp Email Integrator: Missing AuthorizationCVE-2025-31576 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostmarkApp Email Integrator: from n/a through <= 2.4.
- Product
- PostmarkApp Email Integrator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update PostmarkApp Email Integrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025ContentMX Content Publisher: Missing AuthorizationCVE-2025-31555 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ContentMX ContentMX Content Publisher contentmx-content-publisher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ContentMX Content Publisher: from n/a through <= 1.0.6.
- Product
- ContentMX Content Publisher
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update ContentMX Content Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Swiss Toolkit For WP: Missing AuthorizationCVE-2025-31546 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Swiss Toolkit For WP: from n/a through <= 1.4.0.
- Product
- Swiss Toolkit For WP
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Swiss Toolkit For WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Safe Ai Malware Protection for WP: Missing AuthorizationCVE-2025-31545 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Messiah Safe Ai Malware Protection for WP safe-ai-malware-protection-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Safe Ai Malware Protection for WP: from n/a through <= 1.0.20.
- Product
- Safe Ai Malware Protection for WP
- Affected
- up to 1.0.20
- What to do
- Affects up to 1.0.20. Update Safe Ai Malware Protection for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Swiss Toolkit For WP: Missing AuthorizationCVE-2025-31544 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Swiss Toolkit For WP swiss-toolkit-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Swiss Toolkit For WP: from n/a through <= 1.4.5.
- Product
- Swiss Toolkit For WP
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Swiss Toolkit For WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025ACME Divi Modules: Missing AuthorizationCVE-2025-31540 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in acmemediakits ACME Divi Modules acme-divi-modules allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACME Divi Modules: from n/a through <= 1.3.5.
- Product
- ACME Divi Modules
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update ACME Divi Modules to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Cryptocurrency Widgets Pack: Missing AuthorizationCVE-2025-31539 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Blocksera Cryptocurrency Widgets Pack cryptocurrency-widgets-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets Pack: from n/a through <= 2.0.1.
- Product
- Cryptocurrency Widgets Pack
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Cryptocurrency Widgets Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Salesmate Add-On for Gravity Forms: Missing AuthorizationCVE-2025-31533 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Salesmate.io Salesmate Add-On for Gravity Forms gf-salesmate-add-on allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Salesmate Add-On for Gravity Forms: from n/a through <= 2.0.3.
- Product
- Salesmate Add-On for Gravity Forms
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Salesmate Add-On for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Google SEO Pressor Snippet: Missing AuthorizationCVE-2025-31530 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google SEO Pressor Snippet: from n/a through <= 2.0.
- Product
- Google SEO Pressor Snippet
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Google SEO Pressor Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Slider Path for Elementor: Missing AuthorizationCVE-2025-31529 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Rashid Slider Path for Elementor slider-path allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Path for Elementor: from n/a through <= 3.0.0.
- Product
- Slider Path for Elementor
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Slider Path for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025StaticPress: Missing AuthorizationCVE-2025-31528 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wokamoto StaticPress staticpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StaticPress: from n/a through <= 0.4.5.
- Product
- StaticPress
- Affected
- up to 0.4.5
- What to do
- Affects up to 0.4.5. Update StaticPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Simple:Press: Missing AuthorizationCVE-2025-31386 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in simplepress Simple:Press simplepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple:Press: from n/a through <= 6.11.5.
- Product
- Simple:Press
- Affected
- up to 6.11.5
- What to do
- Affects up to 6.11.5. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025NanoSupport: Missing AuthorizationCVE-2025-31376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mayeenul Islam NanoSupport nanosupport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NanoSupport: from n/a through <= 0.6.0.
- Product
- NanoSupport
- Affected
- up to 0.6.0
- What to do
- Affects up to 0.6.0. Update NanoSupport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025ELEX WooCommerce Request a Quote: Missing AuthorizationCVE-2025-31406 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ELEXtensions ELEX WooCommerce Request a Quote elex-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Request a Quote: from n/a through <= 2.3.9.
- Product
- ELEX WooCommerce Request a Quote
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update ELEX WooCommerce Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025WP Docs: Missing AuthorizationCVE-2025-31417 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through < 2.2.7.
- Product
- WP Docs
- What to do
- Update WP Docs to the newest version.
Mar 31, 2025Ads by WPQuads: Missing AuthorizationCVE-2025-30855 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ads by WPQuads: from n/a through <= 2.0.87.1.
- Product
- Ads by WPQuads
- Affected
- up to 2.0.87.1
- What to do
- Affects up to 2.0.87.1. Update Ads by WPQuads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 29, 2025Checkout Mestres do WP for WooCommerce: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2266 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Checkout Mestres do WP for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the cwmpUpdateOptions() function in versions 8.6.5 to 8.7.5. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Checkout Mestres do WP for WooCommerce
- Affected
- 8.6.5 to 8.7.5
- What to do
- Affects 8.6.5 to 8.7.5. Update Checkout Mestres do WP for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 28, 2025Clear Sucuri Cache: Missing AuthorizationCVE-2025-31469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in webrangers Clear Sucuri Cache clear-sucuri-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clear Sucuri Cache: from n/a through <= 1.4.
- Product
- Clear Sucuri Cache
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Clear Sucuri Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Administrator Z: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2815 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26959 is a duplicate of this issue.
- Product
- Administrator Z
- Affected
- up to 2025.03.24
- What to do
- Affects up to 2025.03.24. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.