Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,145 results · page 92 of 203
Oct 26, 2025KiotViet Sync: Missing AuthorizationCVE-2025-62978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.
- Product
- KiotViet Sync
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update KiotViet Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025百度站长SEO合集(支持百度/神马/Bing/头条推送): Missing AuthorizationCVE-2025-62977 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in 沃之涛 百度站长SEO合集(支持百度/神马/Bing/头条推送) baiduseo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 百度站长SEO合集(支持百度/神马/Bing/头条推送): from n/a through <= 2.1.4.
- Product
- 百度站长SEO合集(支持百度/神马/Bing/头条推送)
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update 百度站长SEO合集(支持百度/神马/Bing/头条推送) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Sendle Shipping: Missing AuthorizationCVE-2025-62976 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sendle Shipping: from n/a through <= 6.02.
- Product
- Sendle Shipping
- Affected
- up to 6.02
- What to do
- Affects up to 6.02. Update Sendle Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025BuddyForms: Missing AuthorizationCVE-2025-62973 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.
- Product
- BuddyForms
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WebinarPress: Missing AuthorizationCVE-2025-62972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarPress: from n/a through <= 1.33.28.
- Product
- WebinarPress
- Affected
- up to 1.33.28
- What to do
- Affects up to 1.33.28. Update WebinarPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Link Whisper Free: Missing AuthorizationCVE-2025-62970 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Spencer Haws Link Whisper Free link-whisper allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through <= 0.9.2.
- Product
- Link Whisper Free
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Link Whisper Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025GoCache: Missing AuthorizationCVE-2025-62966 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Apiki GoCache gocache-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoCache: from n/a through <= 1.3.6.
- Product
- GoCache
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update GoCache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Admin Management Xtended: Missing AuthorizationCVE-2025-62965 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin Management Xtended : from n/a through <= 2.5.1.
- Product
- Admin Management Xtended
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Admin Management Xtended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025MDTF: Missing AuthorizationCVE-2025-62964 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.6.
- Product
- MDTF
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Revive Old Posts: Missing AuthorizationCVE-2025-62954 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in rsocial Revive Old Posts tweet-old-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive Old Posts: from n/a through <= 9.3.3.
- Product
- Revive Old Posts
- Affected
- up to 9.3.3
- What to do
- Affects up to 9.3.3. Update Revive Old Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Welcart e-Commerce: Missing AuthorizationCVE-2025-62953 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24.
- Product
- Welcart e-Commerce
- Affected
- up to 2.11.24
- What to do
- Affects up to 2.11.24. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025ChatBot: Missing AuthorizationCVE-2025-62952 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.7.3.
- Product
- ChatBot
- Affected
- up to 7.7.3
- What to do
- Affects up to 7.7.3. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Everest Backup: Missing AuthorizationCVE-2025-62946 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.
- Product
- Everest Backup
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Everest Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025MSTW CSV EXPORTER: Missing AuthorizationCVE-2025-62944 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mark O'Donnell MSTW CSV EXPORTER mstw-csv-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSTW CSV EXPORTER: from n/a through <= 1.4.
- Product
- MSTW CSV EXPORTER
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update MSTW CSV EXPORTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Reoon Email Verifier: Missing AuthorizationCVE-2025-62938 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Reoon Technology Reoon Email Verifier reoon-email-verifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reoon Email Verifier: from n/a through <= 2.0.1.
- Product
- Reoon Email Verifier
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Reoon Email Verifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Open Close WooCommerce Store: Missing AuthorizationCVE-2025-62935 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 5.0.0.
- Product
- Open Close WooCommerce Store
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update Open Close WooCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Table Block by RioVizual: Missing AuthorizationCVE-2025-62932 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wprio Table Block by RioVizual riovizual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by RioVizual: from n/a through <= 3.0.0.
- Product
- Table Block by RioVizual
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Table Block by RioVizual to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025MSN Partner Hub: Missing AuthorizationCVE-2025-62931 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSN Partner Hub: from n/a through <= 2.9.
- Product
- MSN Partner Hub
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update MSN Partner Hub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Testimonial Slider: Missing AuthorizationCVE-2025-62929 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.
- Product
- Testimonial Slider
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Testimonial Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025SEO Meta Description Updater: Missing AuthorizationCVE-2025-62928 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Joby Joseph SEO Meta Description Updater seo-meta-description-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Meta Description Updater: from n/a through <= 1.2.0.
- Product
- SEO Meta Description Updater
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update SEO Meta Description Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Nelio Content: Missing AuthorizationCVE-2025-62927 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Content: from n/a through <= 4.0.5.
- Product
- Nelio Content
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update Nelio Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Conversios.io: Missing AuthorizationCVE-2025-62925 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.13.
- Product
- Conversios.io
- Affected
- up to 7.2.13
- What to do
- Affects up to 7.2.13. Update Conversios.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Post Grid and Gutenberg Blocks: Missing AuthorizationCVE-2025-62924 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.
- Product
- Post Grid and Gutenberg Blocks
- Affected
- up to 2.3.17
- What to do
- Affects up to 2.3.17. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Export Categories: Missing AuthorizationCVE-2025-62922 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shambhu Patnaik Export Categories export-categories allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export Categories: from n/a through <= 1.0.
- Product
- Export Categories
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Export Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025TS Demo Importer: Missing AuthorizationCVE-2025-62919 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in themeshopy TS Demo Importer ts-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Demo Importer: from n/a through <= 0.1.3.
- Product
- TS Demo Importer
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update TS Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025IgnitionDeck: Missing AuthorizationCVE-2025-62918 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ignitionwp IgnitionDeck ignitiondeck allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IgnitionDeck: from n/a through <= 2.0.15.
- Product
- IgnitionDeck
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update IgnitionDeck to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Flights & Hotels Booking WP: Missing AuthorizationCVE-2025-62916 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Travon WP Flights & Hotels Booking WP Plugin adiaha-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flights & Hotels Booking WP Plugin: from n/a through <= 3.1.
- Product
- Flights & Hotels Booking WP
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Flights & Hotels Booking WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025SMS Contact Form 7 Notifications by ClickSend: Missing AuthorizationCVE-2025-62915 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through <= 1.4.0.
- Product
- SMS Contact Form 7 Notifications by ClickSend
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update SMS Contact Form 7 Notifications by ClickSend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Smart WeTransfer: Missing AuthorizationCVE-2025-62909 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mrityunjay Smart WeTransfer smart-wetransfer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WeTransfer: from n/a through <= 1.3.
- Product
- Smart WeTransfer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Smart WeTransfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Referral Link Tracker: Missing AuthorizationCVE-2025-62906 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in epiphanyit321 Referral Link Tracker referral-link-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Referral Link Tracker: from n/a through <= 1.1.4.
- Product
- Referral Link Tracker
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Referral Link Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP Popup Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62902 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedded Sensitive Data.This issue affects WP Popup Builder: from n/a through <= 1.3.8.
- Product
- WP Popup Builder
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update WP Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Sunshine Photo Cart: Missing AuthorizationCVE-2025-62892 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.3.
- Product
- Sunshine Photo Cart
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025King Addons for Elementor: Missing AuthorizationCVE-2025-62889 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in KingAddons.com King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through <= 51.1.61.
- Product
- King Addons for Elementor
- Affected
- up to 51.1.61
- What to do
- Affects up to 51.1.61. Update King Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Coupon Affiliates: Missing AuthorizationCVE-2025-62884 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coupon Affiliates: from n/a through <= 7.2.0.
- Product
- Coupon Affiliates
- Affected
- up to 7.2.0
- What to do
- Affects up to 7.2.0. Update Coupon Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Premmerce User Roles: Missing AuthorizationCVE-2025-62883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.
- Product
- Premmerce User Roles
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025Seriously Simple Podcasting: Missing AuthorizationCVE-2025-62882 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.13.0
- What to do
- Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 26, 2025WP-Lister Lite for eBay: Missing AuthorizationCVE-2025-62881 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.3.
- Product
- WP-Lister Lite for eBay
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2025Password Policy Manager | Password Manager: Unauthorized modification of dataCVE-2025-11255 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to, and including, 2.0.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log out the site's connection to miniorange.
- Product
- Password Policy Manager | Password Manager
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Password Policy Manager | Password Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025WP VR – 360 Panorama and Free Virtual Tour Builder For: Unauthorized access of dataCVE-2025-12005 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, and including, 8.5.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor level access and above, to modify sensitive plugin options.
- Product
- WP VR – 360 Panorama and Free Virtual Tour Builder For
- Affected
- up to 8.5.41
- What to do
- Affects up to 8.5.41. Update WP VR – 360 Panorama and Free Virtual Tour Builder For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2025ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Unauthorized modification of dataCVE-2025-11888 · WordPress plugins & themes · reported by WordfenceLow 2.7
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the post_deactive() function and post_activate() function in all versions up to, and including, 4.8.4. This makes it possible for authenticated attackers, with Editor-level access and above, to activate and deactivate licenses.
- Product
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
- Affected
- up to 4.8.4
- What to do
- Affects up to 4.8.4. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025GenerateBlocks: Unauthorized access of dataCVE-2025-11879 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins.
- Product
- GenerateBlocks
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2025Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2025-11564 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 3.8.3
- What to do
- Affects up to 3.8.3. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025Product Filter by WBW: Unauthorized modification of dataCVE-2025-11269 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings.
- Product
- Product Filter by WBW
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 25, 2025Password Protected: Authorization bypassCVE-2025-11244 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Password Protected plugin for WordPress is vulnerable to authorization bypass via IP address spoofing in all versions up to, and including, 2.7.11. This is due to the plugin trusting client-controlled HTTP headers (such as X-Forwarded-For, HTTP_CLIENT_IP, and similar headers) to determine user IP addresses in the `pp_get_ip_address()` function when the "Use transients" feature is enabled. This makes it possible for attackers to bypass authorization by spoofing these headers with the IP address of a legitimately authenticated user, granted the "Use transients" option is enabled (non-default configuration) and the site is not behind a CDN or reverse proxy that overwrites these headers.
- Product
- Password Protected
- Affected
- up to 2.7.11
- What to do
- Affects up to 2.7.11. Update Password Protected to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Oct 25, 2025User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds: Unauthorized access of dataCVE-2025-10694 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `maybe_load_onboarding_wizard` function in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to access the onboarding wizard page and view configuration information including the administrator email address.
- Product
- User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 25, 2025BackWPup – WordPress Backup & Restore: Unauthorized access of dataCVE-2025-10579 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'backwpup_working' AJAX action in all versions up to, and including, 5.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve access to a back-up's filename while a backup is running. This information has little value on it's own, but could be used to aid in a brute force attack to retrieve back-up contents in limited environments (i.e. NGINX).
- Product
- BackWPup – WordPress Backup & Restore
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update BackWPup – WordPress Backup & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org
Oct 24, 2025ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns: Unauthorized modification of dataCVE-2025-12134 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_popup_status() function in all versions up to, and including, 2.3.11. This makes it possible for unauthenticated attackers to enable/disable popups.
- Product
- ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 24, 2025IndieAuth: Cross-Site Request ForgeryCVE-2025-12028 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action=indieauth. This makes it possible for unauthenticated attackers to force authenticated users to approve OAuth authorization requests for attacker-controlled applications via a forged request granted they can trick a user into performing an action such as clicking on a link or visiting a malicious page while logged in. The attacker can then exchange the stolen authorization code for an access token, effectively taking over the victim's account with the granted scopes (create, update, delete).
- Product
- IndieAuth
- Affected
- up to 4.5.4
- What to do
- Affects up to 4.5.4. Update IndieAuth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2025NGINX Cache Optimizer: Unauthorized modification of dataCVE-2025-12014 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer-blacklist-update' AJAX action in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add URLs to the Exclude URLs From Dynamic Caching setting.
- Product
- NGINX Cache Optimizer
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update NGINX Cache Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 24, 2025Supervisor: Unauthorized modification of dataCVE-2025-11887 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update various plugin settings.
- Product
- Supervisor
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Supervisor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.