Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,269 results · page 77 of 126
Jan 24, 2025Post Duplicator: Missing AuthorizationCVE-2025-24736 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through <= 2.35.
- Product
- Post Duplicator
- Affected
- up to 2.35
- What to do
- Affects up to 2.35. Update Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Thim Elementor Kit: Missing AuthorizationCVE-2025-24725 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thim Elementor Kit: from n/a through <= 1.2.8.
- Product
- Thim Elementor Kit
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Thim Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Plethora Plugins Tabs + Accordions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24709 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plethora Plugins Plethora Plugins Tabs + Accordions plethora-tabs-accordions allows Stored XSS.This issue affects Plethora Plugins Tabs + Accordions: from n/a through <= 1.1.5.
- Product
- Plethora Plugins Tabs + Accordions
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Plethora Plugins Tabs + Accordions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce Quick View: Missing AuthorizationCVE-2025-24705 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arshid WooCommerce Quick View woo-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Quick View: from n/a through <= 1.1.1.
- Product
- WooCommerce Quick View
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WooCommerce Quick View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Advanced Notifications: Missing AuthorizationCVE-2025-24693 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Yehi Advanced Notifications advanced-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Notifications: from n/a through <= 1.2.7.
- Product
- Advanced Notifications
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Advanced Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025People Lists: Missing AuthorizationCVE-2025-24691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ctltwp People Lists people-lists allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects People Lists: from n/a through <= 1.3.10.
- Product
- People Lists
- Affected
- up to 1.3.10
- What to do
- Affects up to 1.3.10. Update People Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Super Block Slider: Missing AuthorizationCVE-2025-24682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Michael Super Block Slider super-block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Block Slider: from n/a through <= 2.7.9.
- Product
- Super Block Slider
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update Super Block Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Internal Links Manager: Missing AuthorizationCVE-2025-24679 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webraketen Internal Links Manager seo-automated-link-building allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Links Manager: from n/a through <= 2.5.2.
- Product
- Internal Links Manager
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Internal Links Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Duplicate: Missing AuthorizationCVE-2025-24652 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in revmakx WP Duplicate local-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Duplicate: from n/a through <= 1.1.6.
- Product
- WP Duplicate
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update WP Duplicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Admin and Site Enhancements (ASE): Missing AuthorizationCVE-2025-24649 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.
- Product
- Admin and Site Enhancements (ASE)
- Affected
- up to 7.6.2
- What to do
- Affects up to 7.6.2. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Build Private Store For Woocommerce: Missing AuthorizationCVE-2025-24633 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: from n/a through <= 1.0.
- Product
- Build Private Store For Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Build Private Store For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Taxonomy/Term and Role based Discounts for WooCommerce: Missing AuthorizationCVE-2025-24625 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1.
- Product
- Taxonomy/Term and Role based Discounts for WooCommerce
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update Taxonomy/Term and Role based Discounts for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025ElementInvader Addons for Elementor: Missing AuthorizationCVE-2025-24618 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.1.
- Product
- ElementInvader Addons for Elementor
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025FV Thoughtful Comments: Missing AuthorizationCVE-2025-24613 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.
- Product
- FV Thoughtful Comments
- Affected
- up to 0.3.5
- What to do
- Affects up to 0.3.5. Update FV Thoughtful Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025VPSUForm: Missing AuthorizationCVE-2025-24604 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.0.5.
- Product
- VPSUForm
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update VPSUForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WooCommerce Product Table Lite: Missing AuthorizationCVE-2025-24596 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through <= 3.8.7.
- Product
- WooCommerce Product Table Lite
- Affected
- up to 3.8.7
- What to do
- Affects up to 3.8.7. Update WooCommerce Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Linet ERP-Woocommerce Integration: Missing AuthorizationCVE-2025-24594 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Linet ERP-Woocommerce Integration: from n/a through <= 3.5.7.
- Product
- Linet ERP-Woocommerce Integration
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Linet ERP-Woocommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025GDPR CCPA Compliance Support: Missing AuthorizationCVE-2025-24591 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.
- Product
- GDPR CCPA Compliance Support
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update GDPR CCPA Compliance Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025JSM Show Post Metadata: Missing AuthorizationCVE-2025-24589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.
- Product
- JSM Show Post Metadata
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update JSM Show Post Metadata to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Patreon: Missing AuthorizationCVE-2025-24588 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.
- Product
- Patreon
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Patreon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 202512 Step Meeting List: Missing AuthorizationCVE-2025-24580 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
- Product
- 12 Step Meeting List
- Affected
- up to 3.16.5
- What to do
- Affects up to 3.16.5. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025WP Fast Total Search: Missing AuthorizationCVE-2025-24571 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.
- Product
- WP Fast Total Search
- Affected
- up to 1.78.258
- What to do
- Affects up to 1.78.258. Update WP Fast Total Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Product Size Charts Plugin for WooCommerce: Missing AuthorizationCVE-2025-23991 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Dotstore Product Size Charts Plugin for WooCommerce woo-advanced-product-size-chart.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through <= 2.4.5.
- Product
- Product Size Charts Plugin for WooCommerce
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update Product Size Charts Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Jobify - Job Board: Unauthorized access and modification of dataCVE-2024-13698 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site's OpenAI key.
- Product
- Jobify - Job Board
- Affected
- up to 4.2.7
- What to do
- Affects up to 4.2.7. Update Jobify - Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jan 24, 2025Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates: Unauthorized accessCVE-2024-13335 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoder_theme_install_func() function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install a theme.
- Product
- Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 22, 2025Debug Tool: Missing AuthorizationCVE-2025-23684 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Eugen Bobrowski Debug Tool debug-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Tool: from n/a through <= 2.2.
- Product
- Debug Tool
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Debug Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Team 118GROUP Agent: Missing AuthorizationCVE-2025-23512 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in 118group Team 118GROUP Agent team-118group-agent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team 118GROUP Agent: from n/a through <= 1.6.0.
- Product
- Team 118GROUP Agent
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Team 118GROUP Agent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Database Sync: Missing AuthorizationCVE-2025-23486 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tamlyn Database Sync database-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database Sync: from n/a through <= 0.5.1.
- Product
- Database Sync
- Affected
- up to 0.5.1
- What to do
- Affects up to 0.5.1. Update Database Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025WP Hotel Booking: Unauthorized access of dataCVE-2024-13447 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a list of registered user emails.
- Product
- WP Hotel Booking
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2025AI Power: Complete AI Pack: Unauthorized accessCVE-2024-13361 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpaicg_save_image_media function in all versions up to, and including, 1.8.96. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload image files and embed shortcode attributes in the image_alt value that will execute when sending a POST request to the attachment page.
- Product
- AI Power: Complete AI Pack
- Affected
- up to 1.8.96
- What to do
- Affects up to 1.8.96. Update AI Power: Complete AI Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 22, 2025WPBot Pro Wordpress Chatbot: Unauthorized modification of dataCVE-2024-12879 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qc_wp_latest_update_check_pro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create Simple Text Responses to chat queries.
- Product
- WPBot Pro Wordpress Chatbot
- Affected
- up to 13.5.5
- What to do
- Affects up to 13.5.5. Update WPBot Pro Wordpress Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwpbot.pro
Jan 21, 2025Realty Workstation: Missing AuthorizationCVE-2025-23477 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in realtyworkstation Realty Workstation realty-workstation allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Realty Workstation: from n/a through <= 1.0.45.
- Product
- Realty Workstation
- Affected
- up to 1.0.45
- What to do
- Affects up to 1.0.45. Update Realty Workstation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Widget Options: Missing AuthorizationCVE-2025-22722 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.
- Product
- Widget Options
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ApplyOnline: Missing AuthorizationCVE-2025-22721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline: from n/a through <= 2.6.7.1.
- Product
- ApplyOnline
- Affected
- up to 2.6.7.1
- What to do
- Affects up to 2.6.7.1. Update ApplyOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025My Tickets: Missing AuthorizationCVE-2025-22717 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects My Tickets: from n/a through <= 2.0.9.
- Product
- My Tickets
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Social Pug: Author Box: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22706 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai Social Pug: Author Box allows Reflected XSS. This issue affects Social Pug: Author Box: from n/a through 1.0.0.
- Product
- Social Pug: Author Box
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Social Pug: Author Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Standard Box Sizes – for WooCommerce: Missing AuthorizationCVE-2025-22318 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in enituretechnology Standard Box Sizes – for WooCommerce standard-box-sizes.This issue affects Standard Box Sizes – for WooCommerce: from n/a through <= 1.6.13.
- Product
- Standard Box Sizes – for WooCommerce
- Affected
- up to 1.6.13
- What to do
- Affects up to 1.6.13. Update Standard Box Sizes – for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Visual Website Collaboration, Feedback & Project Management – Atarim: Unauthorized loss of dataCVE-2024-12104 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files. CVE-2025-22657 may be a duplicate of this issue.
- Product
- Visual Website Collaboration, Feedback & Project Management – Atarim
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update Visual Website Collaboration, Feedback & Project Management – Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2025Buzz Club – Night Club, DJ and Music Festival Event: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-0515 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
- Product
- Buzz Club – Night Club, DJ and Music Festival Event
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Buzz Club – Night Club, DJ and Music Festival Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Jan 17, 2025Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media: Unauthorized loss of dataCVE-2024-12071 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_network_post() function in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages.
- Product
- Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 17, 2025WP Hotel Booking: Unauthorized modification of dataCVE-2024-12370 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. This makes it possible for unauthenticated attackers to add rooms with custom prices.
- Product
- WP Hotel Booking
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 17, 2025Sandbox: Unauthorized accessCVE-2024-13367 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Sandbox plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the export_download action in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download an entire copy of a sandbox environment which can contain sensitive information like the wp-config.php file.
- Product
- Sandbox
- Affected
- up to 0.4
- What to do
- Affects up to 0.4. Update Sandbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2025Mark Posts: Missing AuthorizationCVE-2025-23963 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in flymke Mark Posts mark-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark Posts: from n/a through <= 2.2.4.
- Product
- Mark Posts
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Mark Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Goldstar: Missing AuthorizationCVE-2025-23962 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in jjtrabucco Goldstar goldstar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Goldstar: from n/a through <= 2.1.1.
- Product
- Goldstar
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Goldstar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025WordPress Graphs & Charts: Missing AuthorizationCVE-2025-23961 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wptasker WordPress Graphs & Charts graph-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Graphs & Charts: from n/a through <= 2.0.8.
- Product
- WordPress Graphs & Charts
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update WordPress Graphs & Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Sur.ly: Missing AuthorizationCVE-2025-23957 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in surdotly Sur.ly surly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sur.ly: from n/a through <= 3.0.3.
- Product
- Sur.ly
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Sur.ly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Xola: Missing AuthorizationCVE-2025-23955 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in xola Xola xola-bookings-for-tours-activities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xola: from n/a through <= 1.6.
- Product
- Xola
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Xola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Salvador – AI Image Generator: Missing AuthorizationCVE-2025-23954 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in awcode Salvador – AI Image Generator salvador-ai-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salvador – AI Image Generator: from n/a through <= 1.0.11.
- Product
- Salvador – AI Image Generator
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Salvador – AI Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025PayPal Marketing Solutions: Missing AuthorizationCVE-2025-23930 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paypalmuse PayPal Marketing Solutions paypal-promotions-and-insights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Marketing Solutions: from n/a through <= 1.2.
- Product
- PayPal Marketing Solutions
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update PayPal Marketing Solutions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Email Capture & Lead Generation: Missing AuthorizationCVE-2025-23929 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation email-capture-lead-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email Capture & Lead Generation: from n/a through <= 1.0.2.
- Product
- Email Capture & Lead Generation
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Email Capture & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.