Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

10,145 results · page 94 of 203

Oct 18, 2025FileBird – WordPress Media Library Folders & File Manager: Unauthorized modification of dataCVE-2025-11510 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions up to, and including, 6.4.9. This makes it possible for authenticated attackers, with author-level access and above, to reset all of the plugin's configuration data.
Product
FileBird – WordPress Media Library Folders & File Manager
Affected
up to 6.4.9
What to do
Affects up to 6.4.9. Update FileBird – WordPress Media Library Folders & File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2025WPC Smart Wishlist for WooCommerce: Unauthorized access of dataCVE-2025-11742 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's wishlist data and information.
Product
WPC Smart Wishlist for WooCommerce
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update WPC Smart Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2025ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF: Unauthorized modification of dataCVE-2025-11378 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.
Product
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
Affected
up to 6.3.4
What to do
Affects up to 6.3.4. Update ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 16, 2025Felan Framework: Improper authenticationCVE-2025-10850 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue.
Product
Felan Framework
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 16, 2025Felan Framework: Unauthorized modification of dataCVE-2025-10849 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_plugin_actions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate or deactivate arbitrary plugins.
Product
Felan Framework
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 16, 2025Classified Pro: Unauthorized plugin installationCVE-2025-10706 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible. Note: The required nonce for the vulnerability is in the CubeWP Framework plugin.
Product
Classified Pro
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Classified Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 15, 2025Oceanpayment CreditCard Gateway: Unauthenticated and unauthorized modification of dataCVE-2025-11728 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0. This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs.
Product
Oceanpayment CreditCard Gateway
Affected
up to 6.0
What to do
Affects up to 6.0. Update Oceanpayment CreditCard Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Zip Attachments: Unauthorized access of dataCVE-2025-11701 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.
Product
Zip Attachments
Affected
up to 1.6
What to do
Affects up to 1.6. Update Zip Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Zip Attachments: Unauthorized loss of dataCVE-2025-11692 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.
Product
Zip Attachments
Affected
up to 1.6
What to do
Affects up to 1.6. Update Zip Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 15, 2025YourMembership Single Sign On – YM SSO Login: Unauthorized access of dataCVE-2025-10648 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login.
Product
YourMembership Single Sign On – YM SSO Login
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update YourMembership Single Sign On – YM SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025Find And Replace content for: Unauthorized Stored Cross-Site Scripting and Arbitrary Content ReplacementCVE-2025-10313 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the far_admin_ajax_fun() function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that can make privilege escalation and malicious redirects possible.
Product
Find And Replace content for
Affected
up to 1.1
What to do
Affects up to 1.1. Update Find And Replace content for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 15, 2025Library Management System: Unauthorized modification of dataCVE-2025-10303 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_management_ajax_handler() function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and manipulate several of the plugin's settings and features.
Product
Library Management System
Affected
up to 3.1
What to do
Affects up to 3.1. Update Library Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 15, 2025OwnID Passwordless Login: Authentication BypassCVE-2025-10294 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownid_shared_secret value is empty prior to authenticating a user via JWT. This makes it possible for unauthenticated attackers to log in as other users, including administrators, on instances where the plugin has not been fully configured yet.
Product
OwnID Passwordless Login
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update OwnID Passwordless Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 15, 2025Keyy Two Factor Authentication (like Clef): Privilege escalationCVE-2025-10293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity associated with a token generated. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate valid auth tokens and leverage that to auto-login as other accounts, including administrators, as long as the administrator has the 2FA set up.
Product
Keyy Two Factor Authentication (like Clef)
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Keyy Two Factor Authentication (like Clef) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 15, 2025WhyDonate – FREE Donate button – Crowdfunding – Fundraising: Unauthorized loss of dataCVE-2025-10186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
Product
WhyDonate – FREE Donate button – Crowdfunding – Fundraising
Affected
up to 4.0.15
What to do
Affects up to 4.0.15. Update WhyDonate – FREE Donate button – Crowdfunding – Fundraising to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 11, 2025Newsup: Unauthorized plugin installationCVE-2025-8682 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin.
Product
Newsup
Affected
up to 5.0.10
What to do
Affects up to 5.0.10. Update Newsup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org themes.trac.wordpress.org
Oct 11, 2025GSheetConnector For Gravity Forms: Authorization bypassCVE-2025-8593 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a missing capability check on the 'install_plugin' function. This makes it possible for authenticated attackers, with subscriber-level access and above to install plugins on the target site and potentially achieve arbitrary code execution on the server under certain conditions.
Product
GSheetConnector For Gravity Forms
What to do
Update GSheetConnector For Gravity Forms to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2025Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning: Unauthorized access of dataCVE-2025-11380 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'everest_process_status' AJAX action in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to retrieve back-up file locations that can be subsequently accessed and downloaded. This does require a back-up to be running in order for an attacker to retrieve the back-up location.
Product
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 10, 2025The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6.CVE-2025-7374 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to authorization bypass in all versions up to, and including, 7.6. This is due to insufficient login restrictions on inactive and pending accounts. This makes it possible for authenticated attackers, with Candidate- and Employer-level access and above, to log in to the site even if their account is inactive or pending.
Affected
up to 7.6
What to do
Affects up to 7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 9, 2025Slider Revolution: Unauthorized access and modification of dataCVE-2025-10249 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above, to install and activate plugin add-ons, create sliders, and download arbitrary files.
Product
Slider Revolution
Affected
up to 6.7.37
What to do
Affects up to 6.7.37. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sliderrevolution.com wordfence.com
Oct 9, 2025Search & Go - Directory: Authentication BypassCVE-2025-11522 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user() function This makes it possible for unauthenticated attackers to gain access to other user's accounts, including administrators, when Facebook login is enabled. CVE-2025-62064 is likely a duplicate of this CVE.
Product
Search & Go - Directory
Affected
up to 2.7
What to do
Affects up to 2.7. Update Search & Go - Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themeforest.net wordfence.com
Oct 8, 2025Chartify – WordPress Chart: Missing Authentication for Critical FunctionCVE-2025-11171 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9. This is due to the plugin registering an unauthenticated AJAX action that dispatches to admin-class methods based on a request parameter, without any nonce or capability checks. This makes it possible for unauthenticated attackers to execute administrative functions via the wp-admin/admin-ajax.php endpoint granted they can identify callable method names.
Product
Chartify – WordPress Chart
Affected
up to 3.5.9
What to do
Affects up to 3.5.9. Update Chartify – WordPress Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025OAuth Single Sign On – SSO (OAuth Client): Improper Verification of Cryptographic SignatureCVE-2025-9485 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12. This is due to the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. This makes it possible for unauthenticated attackers to bypass authentication and gain access to any existing user account - including administrators in certain configurations - or to create arbitrary subscriber-level accounts.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.12
What to do
Affects up to 6.26.12. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Cost Calculator Builder: Unauthorizedmodification of dataCVE-2025-9243 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status.
Product
Cost Calculator Builder
Affected
up to 3.5.32
What to do
Affects up to 3.5.32. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder: Missing authorizationCVE-2025-9029 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorization via the wdkit_handle_review_submission function in versions less than, or equal to, 1.2.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to submit feedback data to external services.
Product
WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
What to do
Update WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-11228 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
Product
GiveWP – Donation Plugin and Fundraising Platform
Affected
up to 4.10.0
What to do
Affects up to 4.10.0. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Integrate Dynamics 365 CRM: Unauthorized accessCVE-2025-10746 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters.
Product
Integrate Dynamics 365 CRM
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Integrate Dynamics 365 CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025RestroPress – Online Food Ordering System: Authentication BypassCVE-2025-9209 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
Product
RestroPress – Online Food Ordering System
Affected
3.0.0 to 3.1.9.2
What to do
Affects 3.0.0 to 3.1.9.2. Update RestroPress – Online Food Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 3, 2025Constructor: Unauthorized modification of dataCVE-2025-9194 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() function in all versions up to, and including, 1.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a theme clean.
Product
Constructor
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Constructor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.svn.wordpress.org wordfence.com
Oct 3, 2025SiteAlert (Formerly WP Health): Unauthorized access of dataCVE-2025-10212 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to view the site health information, including a list of installed and outdated plugins, PHP and Database version, etc.
Product
SiteAlert (Formerly WP Health)
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update SiteAlert (Formerly WP Health) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025Spirit Framework: Authentication bypassCVE-2025-6388 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username.
Product
Spirit Framework
Affected
up to 1.2.14
What to do
Affects up to 1.2.14. Update Spirit Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themespirit.com wordfence.com
Oct 2, 2025Ajax WooSearch: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9697 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Ajax WooSearch
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ajax WooSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 2, 2025CTL Behance Importer Lite: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2025-9587 · WordPress plugins & themes · reported by WPScanHigh 8.6
The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
CTL Behance Importer Lite
Affected
up to 1.0
What to do
Affects up to 1.0. Update CTL Behance Importer Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 1, 2025auth0-PHP is an SDK for Auth0 Authentication and Management APIs.CVE-2025-58769 · WordPress plugins & themes · reported by GitHubLow 3.3
auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0–8.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0.
Affected
up to 8.16.0
Fixed in
8.17.0
What to do
Update the plugin to 8.17.0 or newer.
Full record and what to do →NVD record github.com github.com
Oct 1, 2025Custom Searchable Data Entry System: Unauthenticated database wipingCVE-2020-36852 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazale_sds_delete_entries_table_row() function. This makes it possible for unauthenticated attackers to completely wipe database tables such as wp_users.
Product
Custom Searchable Data Entry System
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Custom Searchable Data Entry System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Sep 30, 2025LatePoint: Authentication BypassCVE-2025-7038 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the latepoint_route_call AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the client-supplied customer email and related customer fields before invoking the internal login handler without verifying login status, capability checks, or a valid AJAX nonce. This makes it possible for unauthenticated attackers to log into any customer’s account.
Product
LatePoint
Affected
up to 5.1.94
What to do
Affects up to 5.1.94. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2025SmartCrawl SEO checker, analyzer & optimizer: Unauthorized modification of dataCVE-2025-11163 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SmartCrawl SEO checker, analyzer & optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_submodule() function in all versions up to, and including, 3.14.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's setttings.
Product
SmartCrawl SEO checker, analyzer & optimizer
Affected
up to 3.14.3
What to do
Affects up to 3.14.3. Update SmartCrawl SEO checker, analyzer & optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 26, 2025Page Manager for Elementor: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-60167 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.
Product
Page Manager for Elementor
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Page Manager for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025WP Subscription Forms PRO: Missing AuthorizationCVE-2025-60166 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO wp-subscription-forms-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscription Forms PRO: from n/a through <= 2.0.5.
Product
WP Subscription Forms PRO
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update WP Subscription Forms PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Frames: Missing AuthorizationCVE-2025-60165 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HaruTheme Frames frames allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frames: from n/a through <= 1.5.7.
Product
Frames
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Frames to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Nota Fiscal Eletrônica WooCommerce: Missing AuthorizationCVE-2025-60159 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webmaniabr Nota Fiscal Eletrônica WooCommerce nota-fiscal-eletronica-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nota Fiscal Eletrônica WooCommerce: from n/a through <= 3.4.0.9.
Product
Nota Fiscal Eletrônica WooCommerce
Affected
up to 3.4.0.9
What to do
Affects up to 3.4.0.9. Update Nota Fiscal Eletrônica WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025WP Virtual Assistant: Missing AuthorizationCVE-2025-60155 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Virtual Assistant: from n/a through <= 3.0.
Product
WP Virtual Assistant
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP Virtual Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Subscribe To Unlock: Missing AuthorizationCVE-2025-60152 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe To Unlock: from n/a through <= 1.1.5.
Product
Subscribe To Unlock
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Subscribe To Unlock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Subscribe to Download: Missing AuthorizationCVE-2025-60148 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe to Download: from n/a through <= 2.0.9.
Product
Subscribe to Download
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Subscribe to Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Netgsm: Missing AuthorizationCVE-2025-60143 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through <= 2.9.69.
Product
Netgsm
Affected
up to 2.9.69
What to do
Affects up to 2.9.69. Update Netgsm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025WEDOS Global: Missing AuthorizationCVE-2025-60130 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS Global: from n/a through <= 1.2.2.
Product
WEDOS Global
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update WEDOS Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Yext: Missing AuthorizationCVE-2025-60129 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Yext Yext yext allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yext: from n/a through <= 1.1.3.
Product
Yext
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Yext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025Delisho: Missing AuthorizationCVE-2025-60128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through <= 1.1.3.
Product
Delisho
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Delisho to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025CopySafe Web Protection: Missing AuthorizationCVE-2025-60127 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CopySafe Web Protection: from n/a through <= 5.1.
Product
CopySafe Web Protection
Affected
up to 5.1
What to do
Affects up to 5.1. Update CopySafe Web Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 26, 2025HivePress Claim Listings: Missing AuthorizationCVE-2025-60123 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.
Product
HivePress Claim Listings
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update HivePress Claim Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.