Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

6,268 results · page 74 of 126

Mar 3, 2025Authors Autocomplete Meta Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-25169 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through <= 1.2.
Product
Authors Autocomplete Meta Box
Affected
up to 1.2
What to do
Affects up to 1.2. Update Authors Autocomplete Meta Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WAH Forms: Missing AuthorizationCVE-2025-23763 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Alex Volkov WAH Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WAH Forms: from n/a through 1.0.
Product
WAH Forms
Affected
up to 1.0
What to do
Affects up to 1.0. Update WAH Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 20254 author cheer up donate: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23670 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in montashov 4 author cheer up donate 4-author-cheer-up-donate allows Reflected XSS.This issue affects 4 author cheer up donate: from n/a through <= 1.3.
Product
4 author cheer up donate
Affected
up to 1.3
What to do
Affects up to 1.3. Update 4 author cheer up donate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025Interactive Page Hierarchy: Missing AuthorizationCVE-2025-23615 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in gtekelis Interactive Page Hierarchy interactive-page-hierarchy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Page Hierarchy: from n/a through <= 1.0.1.
Product
Interactive Page Hierarchy
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Interactive Page Hierarchy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025WP Journal: Missing AuthorizationCVE-2025-23613 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in mediabeta WP Journal wpjournal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Journal: from n/a through <= 1.1.
Product
WP Journal
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Journal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025ts-tree: Missing AuthorizationCVE-2025-23515 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tsecher ts-tree ts-tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ts-tree: from n/a through <= 0.1.1.
Product
ts-tree
Affected
up to 0.1.1
What to do
Affects up to 0.1.1. Update ts-tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025radSLIDE: Missing AuthorizationCVE-2025-23440 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in radicaldesigns radSLIDE radslide allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects radSLIDE: from n/a through <= 2.1.
Product
radSLIDE
Affected
up to 2.1
What to do
Affects up to 2.1. Update radSLIDE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2025SEO Plugin by Squirrly SEO: Missing AuthorizationCVE-2025-24654 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo.This issue affects SEO Plugin by Squirrly SEO: from n/a through <= 12.4.07.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.4.07
What to do
Affects up to 12.4.07. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 1, 2025Secure Copy Content Protection and Content Locking: Unauthorized access of dataCVE-2025-1404 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_sccp_reports_user_search() function in all versions up to, and including, 4.4.7. This makes it possible for unauthenticated attackers to retrieve a list of registered user emails.
Product
Secure Copy Content Protection and Content Locking
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 1, 2025The Authors List: Arbitrary shortcode executionCVE-2024-13806 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Authors List
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update The Authors List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2025IP2Location Redirection: Unauthorized access of dataCVE-2025-1502 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download the plugin's settings.
Product
IP2Location Redirection
Affected
up to 1.33.3
What to do
Affects up to 1.33.3. Update IP2Location Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 1, 2025Booking Calendar and Notification: Unauthorized access, modification, and loss of dataCVE-2024-13746 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on the wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() functions in all versions up to, and including, 4.0.3. This makes it possible for unauthenticated attackers to extract data, create or update bookings, or delete arbitrary posts.
Product
Booking Calendar and Notification
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Booking Calendar and Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2025BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages: Unauthorized accessCVE-2025-1780 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.25. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
Product
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Affected
up to 3.4.25
What to do
Affects up to 3.4.25. Update BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages: Unauthorized accessCVE-2024-13358 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
Product
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Affected
up to 3.4.24
What to do
Affects up to 3.4.24. Update BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025NextMove Lite – Thank You Page for WooCommerce: Unauthorized submission of dataCVE-2024-10860 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on the _submit_uninstall_reason_action() function in all versions up to, and including, 2.19.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit a deactivation reason on behalf of a site.
Product
NextMove Lite – Thank You Page for WooCommerce
Affected
up to 2.19.0
What to do
Affects up to 2.19.0. Update NextMove Lite – Thank You Page for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2025WHMPress - WHMCS Client Area: Unauthorized modification of data that can lead to privilege escalationCVE-2024-9195 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WHMPress - WHMCS Client Area plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the update_settings case in the /admin/ajax.php file in all versions up to, and including, 4.3-revision-3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
WHMPress - WHMCS Client Area
Affected
up to 4.3-revision-3
What to do
Affects up to 4.3-revision-3. Update WHMPress - WHMCS Client Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Feb 28, 2025Forex Calculators: Unauthorized modification of dataCVE-2024-13716 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_settings_callback() function in all versions up to, and including, 1.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
Product
Forex Calculators
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Forex Calculators to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2025Cardealer: Unauthorized modification of data and loss of dataCVE-2025-1681 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sanitization on the demo theme scheme AJAX functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to change or delete arbitrary css and js files.
Product
Cardealer
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Cardealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net webtemplatemasters.com
Feb 27, 2025DefendWP Firewall: Missing AuthorizationCVE-2025-22280 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through <= 1.1.0.
Product
DefendWP Firewall
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update DefendWP Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 26, 2025Events Manager: Missing AuthorizationCVE-2025-1249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through <= 6.6.4.1.
Product
Events Manager
Affected
up to 6.6.4.1
What to do
Affects up to 6.6.4.1. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Simple Photo Feed: Missing AuthorizationCVE-2025-27000 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Photo Feed: from n/a through <= 1.4.0.
Product
Simple Photo Feed
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Simple Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Market Exporter: Missing AuthorizationCVE-2025-26995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Anton Vanyukov Market Exporter market-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Market Exporter: from n/a through <= 2.0.21.
Product
Market Exporter
Affected
up to 2.0.21
What to do
Affects up to 2.0.21. Update Market Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2025-26983 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.3.
Product
Recipe Card Blocks for Gutenberg & Elementor
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Recipe Card Blocks for Gutenberg & Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Filebird: Authorization Bypass Through User-Controlled KeyCVE-2025-26977 · WordPress plugins & themes · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Ninja Team Filebird filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through <= 6.4.2.1.
Product
Filebird
Affected
up to 6.4.2.1
What to do
Affects up to 6.4.2.1. Update Filebird to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Strong Testimonials: Missing AuthorizationCVE-2025-26975 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through <= 3.2.3.
Product
Strong Testimonials
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Amelia: Authorization Bypass Through User-Controlled KeyCVE-2025-26965 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.16.
Product
Amelia
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Small Package Quotes – Unishippers Edition: Missing AuthorizationCVE-2025-26960 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Unishippers Edition: from n/a through <= 2.4.9.
Product
Small Package Quotes – Unishippers Edition
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Small Package Quotes – Unishippers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Pie Register Premium: Missing AuthorizationCVE-2025-26948 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.
Product
Pie Register Premium
Affected
up to 3.8.3.2
What to do
Affects up to 3.8.3.2. Update Pie Register Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Order Limit for WooCommerce: Missing AuthorizationCVE-2025-26928 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Limit for WooCommerce: from n/a through <= 3.0.2.
Product
Order Limit for WooCommerce
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Order Limit for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025System Dashboard: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-26911 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <= 2.8.18.
Product
System Dashboard
Affected
up to 2.8.18
What to do
Affects up to 2.8.18. Update System Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Essential Blocks for Gutenberg: Missing AuthorizationCVE-2025-26871 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.
Product
Essential Blocks for Gutenberg
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update Essential Blocks for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Enfold: Unauthorized access of dataCVE-2024-13693 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. This makes it possible for unauthenticated attackers to export all avia settings which may included sensitive information such as the Mailchimp API Key, reCAPTCHA Secret Key, or Envato private token if they are set.
Product
Enfold
Affected
up to 6.0.9
What to do
Affects up to 6.0.9. Update Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Feb 24, 2025Sticky Header On Scroll: Missing AuthorizationCVE-2025-27356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Hardik Sticky Header On Scroll sticky-header-on-scroll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Header On Scroll: from n/a through <= 1.0.
Product
Sticky Header On Scroll
Affected
up to 1.0
What to do
Affects up to 1.0. Update Sticky Header On Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025WP About Author: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27323 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jon Bishop WP About Author wp-about-author allows DOM-Based XSS.This issue affects WP About Author: from n/a through <= 1.5.
Product
WP About Author
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP About Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: Missing AuthorizationCVE-2025-27296 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Missing Authorization vulnerability in revenueflex Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue revenueflex-easy-ads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue: from n/a through <= 1.5.
Product
Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue
Affected
up to 1.5
What to do
Affects up to 1.5. Update Auto Ad Inserter – Increase Google Adsense and Ad Manager Revenue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025WP-Asambleas: Missing AuthorizationCVE-2025-27294 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Asambleas: from n/a through <= 2.85.0.
Product
WP-Asambleas
Affected
up to 2.85.0
What to do
Affects up to 2.85.0. Update WP-Asambleas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 24, 2025Animated Text Block: Missing AuthorizationCVE-2025-26883 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bPlugins Animated Text Block animated-text-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Text Block: from n/a through <= 1.0.7.
Product
Animated Text Block
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Animated Text Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 22, 2025Distance Based Shipping Calculator: Missing AuthorizationCVE-2025-26764 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.22.
Product
Distance Based Shipping Calculator
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update Distance Based Shipping Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 22, 2025Vitepos: Missing AuthorizationCVE-2025-26750 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vitepos: from n/a through <= 3.1.3.
Product
Vitepos
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Vitepos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 22, 2025Post Grid and Gutenberg Blocks – ComboBlocks: Unauthorized order creationCVE-2024-13798 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create new orders for products and mark them as paid without actually completing a payment.
Product
Post Grid and Gutenberg Blocks – ComboBlocks
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2025Event Tickets and Registration: Unauthorized loss of dataCVE-2025-1402 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary Attendee tickets.
Product
Event Tickets and Registration
Affected
up to 5.19.1.1
What to do
Affects up to 5.19.1.1. Update Event Tickets and Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2025LTL Freight Quotes – GlobalTranz Edition: Unauthorized modification of dataCVE-2025-1483 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engtz_wd_save_dropship AJAX endpoint in all versions up to, and including, 2.3.12. This makes it possible for unauthenticated attackers to update the drop shipping settings.
Product
LTL Freight Quotes – GlobalTranz Edition
Affected
up to 2.3.12
What to do
Affects up to 2.3.12. Update LTL Freight Quotes – GlobalTranz Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2025Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported): Unauthorized modification of data|loss of dataCVE-2024-13520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.9. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher.
Product
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
Affected
up to 4.4.9
What to do
Affects up to 4.4.9. Update Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2025Raptive Ads: Unauthorized accessCVE-2024-13364 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Raptive Ads plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the site_ads_files_reset() and cls_file_reset() functions in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to reset the ad and cls files.
Product
Raptive Ads
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Raptive Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 19, 2025WordPress Portfolio Builder – Portfolio Gallery: Unauthorized modification of dataCVE-2024-13231 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_video' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to add arbitrary videos to any portfolio gallery.
Product
WordPress Portfolio Builder – Portfolio Gallery
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WordPress Portfolio Builder – Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2025Trash Duplicate and 301 Redirect: Unauthorized loss of dataCVE-2024-13468 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-action-top' action in all versions up to, and including, 1.9. This makes it possible for unauthenticated attackers to delete arbitrary posts/pages.
Product
Trash Duplicate and 301 Redirect
Affected
up to 1.9
What to do
Affects up to 1.9. Update Trash Duplicate and 301 Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 18, 2025MediCenter - Health Medical Clinic: Missing AuthorizationCVE-2025-27013 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MediCenter - Health Medical Clinic: from n/a through < 14.7.
Product
MediCenter - Health Medical Clinic
What to do
Update MediCenter - Health Medical Clinic to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025Atarim: Missing AuthorizationCVE-2025-22657 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.0.9.
Product
Atarim
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2025FormCraft: Unauthorized access of dataCVE-2024-13783 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may contain sensitive information from form submissions.
Product
FormCraft
Affected
up to 3.9.11
What to do
Affects up to 3.9.11. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net formcraft-wp.com
Feb 18, 2025Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more: Unauthorized accessCVE-2024-13316 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswn_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create coupons.
Product
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.