Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

10,137 results · page 86 of 203

Dec 9, 2025Portfolio and Projects: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.
Product
Portfolio and Projects
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: Missing AuthorizationCVE-2025-67468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms: from n/a through <= 1.4.6.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Trinity Audio: Missing AuthorizationCVE-2025-67466 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3.
Product
Trinity Audio
Affected
up to 5.23.3
What to do
Affects up to 5.23.3. Update Trinity Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025The Aisle: Missing AuthorizationCVE-2025-66534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elated-Themes The Aisle theaisle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Aisle: from n/a through <= 2.9.
Product
The Aisle
Affected
up to 2.9
What to do
Affects up to 2.9. Update The Aisle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Powerlift: Missing AuthorizationCVE-2025-66532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mikado-Themes Powerlift powerlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Powerlift: from n/a through < 3.2.1.
Product
Powerlift
Fixed in
3.2.1
What to do
Update Powerlift to 3.2.1 or newer.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Webba Booking: Missing AuthorizationCVE-2025-66530 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 6.2.1.
Product
Webba Booking
Affected
up to 6.2.1
What to do
Affects up to 6.2.1. Update Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Thank You Page Customizer for WooCommerce: Missing AuthorizationCVE-2025-66528 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.8.
Product
Thank You Page Customizer for WooCommerce
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Thank You Page Customizer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Lobo: Missing AuthorizationCVE-2025-66527 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in VanKarWai Lobo lobo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lobo: from n/a through <= 2.8.6.
Product
Lobo
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Lobo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Tablesome: Missing AuthorizationCVE-2025-66526 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.34.
Product
Tablesome
Affected
up to 1.1.34
What to do
Affects up to 1.1.34. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Elastic Email Sender: Missing AuthorizationCVE-2025-66525 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Elastic Email Elastic Email Sender elastic-email-sender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Sender: from n/a through <= 1.2.20.
Product
Elastic Email Sender
Affected
up to 1.2.20
What to do
Affects up to 1.2.20. Update Elastic Email Sender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025My Tickets: Missing AuthorizationCVE-2025-64257 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Tickets: from n/a through <= 2.1.0.
Product
My Tickets
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Admin and Site Enhancements (ASE): Missing AuthorizationCVE-2025-64255 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.0.8.
Product
Admin and Site Enhancements (ASE)
Affected
up to 8.0.8
What to do
Affects up to 8.0.8. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Photo Block: Missing AuthorizationCVE-2025-64254 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Ronald Huereca Photo Block photo-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Block: from n/a through <= 1.5.1.
Product
Photo Block
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Photo Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Happy Addons for Elementor: Missing AuthorizationCVE-2025-63077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.3.
Product
Happy Addons for Elementor
Affected
up to 3.20.3
What to do
Affects up to 3.20.3. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Download Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63070 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.32.
Product
Download Manager
Affected
up to 3.3.32
What to do
Affects up to 3.3.32. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Ivory Search: Missing AuthorizationCVE-2025-63069 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vinod Dalvi Ivory Search add-search-to-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ivory Search: from n/a through <= 5.5.12.
Product
Ivory Search
Affected
up to 5.5.12
What to do
Affects up to 5.5.12. Update Ivory Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Porto Theme - Functionality: Missing AuthorizationCVE-2025-63067 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 3.7.3.
Product
Porto Theme - Functionality
What to do
Update Porto Theme - Functionality to the newest version.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Media LIbrary Assistant: Authorization Bypass Through User-Controlled KeyCVE-2025-63065 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through <= 3.29.
Product
Media LIbrary Assistant
Affected
up to 3.29
What to do
Affects up to 3.29. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Yandex.Metrica: Missing AuthorizationCVE-2025-63063 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Yandex Metrika Yandex.Metrica wp-yandex-metrika allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yandex.Metrica: from n/a through <= 1.2.2.
Product
Yandex.Metrica
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Yandex.Metrica to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Custom Field Template: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63058 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Retrieve Embedded Sensitive Data.This issue affects Custom Field Template: from n/a through <= 2.7.6.
Product
Custom Field Template
Affected
up to 2.7.6
What to do
Affects up to 2.7.6. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Contact Form by BestWebSoft: Missing AuthorizationCVE-2025-63056 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bestwebsoft Contact Form by BestWebSoft contact-form-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by BestWebSoft: from n/a through <= 4.3.6.
Product
Contact Form by BestWebSoft
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update Contact Form by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Quiz And Survey Master: Missing AuthorizationCVE-2025-63054 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.2.
Product
Quiz And Survey Master
Affected
up to 10.3.2
What to do
Affects up to 10.3.2. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025ListingPro Lead Form: Missing AuthorizationCVE-2025-63049 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ListingPro Lead Form: from n/a through <= 1.0.7.
Product
ListingPro Lead Form
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update ListingPro Lead Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025ListingPro: Missing AuthorizationCVE-2025-63047 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.
Product
ListingPro
Affected
up to 2.9.9
What to do
Affects up to 2.9.9. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Page View Count: Missing AuthorizationCVE-2025-63034 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Steve Truman Page View Count page-views-count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page View Count: from n/a through <= 2.9.0.
Product
Page View Count
Affected
up to 2.9.0
What to do
Affects up to 2.9.0. Update Page View Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Traveler: Missing AuthorizationCVE-2025-63028 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
Product
Traveler
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update Traveler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Xagio SEO: Missing AuthorizationCVE-2025-63025 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Xagio SEO Xagio SEO xagio-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xagio SEO: from n/a through <= 7.1.0.37.
Product
Xagio SEO
Affected
up to 7.1.0.37
What to do
Affects up to 7.1.0.37. Update Xagio SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-63024 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.3.1.
Product
Order Delivery Date for WooCommerce
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Payment Gateway for PayPal on WooCommerce: Missing AuthorizationCVE-2025-63023 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Easy Payment Payment Gateway for PayPal on WooCommerce woo-paypal-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway for PayPal on WooCommerce: from n/a through <= 9.0.53.
Product
Payment Gateway for PayPal on WooCommerce
Affected
up to 9.0.53
What to do
Affects up to 9.0.53. Update Payment Gateway for PayPal on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WooCommerce Payment Gateway - Paysera: Missing AuthorizationCVE-2025-63015 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in paysera WooCommerce Payment Gateway - Paysera woo-payment-gateway-paysera allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Payment Gateway - Paysera: from n/a through <= 3.10.0.
Product
WooCommerce Payment Gateway - Paysera
Affected
up to 3.10.0
What to do
Affects up to 3.10.0. Update WooCommerce Payment Gateway - Paysera to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP Hotel Booking: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63013 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedded Sensitive Data.This issue affects WP Hotel Booking: from n/a through <= 2.2.7.
Product
WP Hotel Booking
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP Google Analytics Events: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows Retrieve Embedded Sensitive Data.This issue affects WP Google Analytics Events: from n/a through <= 2.8.2.
Product
WP Google Analytics Events
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update WP Google Analytics Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP ERP: Missing AuthorizationCVE-2025-63008 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.16.7.
Product
WP ERP
Affected
up to 1.16.7
What to do
Affects up to 1.16.7. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025EventPrime: Missing AuthorizationCVE-2025-63006 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.4.1.
Product
EventPrime
Affected
up to 4.2.4.1
What to do
Affects up to 4.2.4.1. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Litho Addons: Missing AuthorizationCVE-2025-62999 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through <= 3.5.
Product
Litho Addons
Affected
up to 3.5
What to do
Affects up to 3.5. Update Litho Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Custom Layouts – Post + Product grids made easy: Missing AuthorizationCVE-2025-62996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Code Amp Custom Layouts – Post + Product grids made easy custom-layouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Layouts – Post + Product grids made easy: from n/a through <= 1.4.12.
Product
Custom Layouts – Post + Product grids made easy
Affected
up to 1.4.12
What to do
Affects up to 1.4.12. Update Custom Layouts – Post + Product grids made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025MultiParcels Shipping For WooCommerce: Missing AuthorizationCVE-2025-62995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through <= 1.30.12.
Product
MultiParcels Shipping For WooCommerce
Affected
up to 1.30.12
What to do
Affects up to 1.30.12. Update MultiParcels Shipping For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Notification for Telegram: Missing AuthorizationCVE-2025-62993 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notification for Telegram: from n/a through <= 3.5.1.
Product
Notification for Telegram
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Eupago Gateway For Woocommerce: Missing AuthorizationCVE-2025-62870 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Eupago Eupago Gateway For Woocommerce eupago-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eupago Gateway For Woocommerce: from n/a through <= 4.7.1.
Product
Eupago Gateway For Woocommerce
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update Eupago Gateway For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Gravitec.net – Web Push Notifications: Missing AuthorizationCVE-2025-62869 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gravitec.net - Web Push Notifications Gravitec.net – Web Push Notifications gravitec-net-web-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gravitec.net – Web Push Notifications: from n/a through <= 2.9.17.
Product
Gravitec.net – Web Push Notifications
Affected
up to 2.9.17
What to do
Affects up to 2.9.17. Update Gravitec.net – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Ergonet Cache: Missing AuthorizationCVE-2025-62867 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ergonet Cache: from n/a through <= 1.0.13.
Product
Ergonet Cache
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Ergonet Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Post Cloner: Missing AuthorizationCVE-2025-62865 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Evan Herman Post Cloner post-cloner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Cloner: from n/a through <= 1.0.0.
Product
Post Cloner
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Post Cloner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WP-CRM System: Missing AuthorizationCVE-2025-62740 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.6.
Product
WP-CRM System
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update WP-CRM System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Formstack Online Forms: Missing AuthorizationCVE-2025-62738 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mmattax Formstack Online Forms formstack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formstack Online Forms: from n/a through <= 2.0.2.
Product
Formstack Online Forms
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Formstack Online Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Image Cleanup: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62737 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in opicron Image Cleanup image-cleanup allows Retrieve Embedded Sensitive Data.This issue affects Image Cleanup: from n/a through <= 1.9.2.
Product
Image Cleanup
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Image Cleanup: Missing AuthorizationCVE-2025-62736 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in opicron Image Cleanup image-cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Cleanup: from n/a through <= 1.9.2.
Product
Image Cleanup
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025User Spam Remover: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Joel User Spam Remover user-spam-remover allows Retrieve Embedded Sensitive Data.This issue affects User Spam Remover: from n/a through <= 1.1.
Product
User Spam Remover
Affected
up to 1.1
What to do
Affects up to 1.1. Update User Spam Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Quick Interest Slider: Missing AuthorizationCVE-2025-62153 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Graham Quick Interest Slider quick-interest-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Interest Slider: from n/a through <= 3.1.7.
Product
Quick Interest Slider
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update Quick Interest Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025ConveyThis: Missing AuthorizationCVE-2025-62152 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.2.
Product
ConveyThis
Affected
up to 269.2
What to do
Affects up to 269.2. Update ConveyThis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025Virtuaria PagBank / PagSeguro para Woocommerce: Missing AuthorizationCVE-2025-62151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Virtuaria Virtuaria PagBank / PagSeguro para Woocommerce virtuaria-pagseguro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virtuaria PagBank / PagSeguro para Woocommerce: from n/a through <= 3.6.3.
Product
Virtuaria PagBank / PagSeguro para Woocommerce
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Virtuaria PagBank / PagSeguro para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.