Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,212 results · page 96 of 485
Jun 17, 2026JetEngine: SQL injectionCVE-2026-12360 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL construction. This makes it possible for unauthenticated attackers to perform time-based or boolean blind SQL injection by appending a malicious meta_query value to a Load More AJAX request captured from any public Listing Grid page.
- Product
- JetEngine
- Affected
- up to 3.8.10.1
- What to do
- Affects up to 3.8.10.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcrocoblock.complugins.trac.wordpress.org
Jun 17, 2026Fusion Builder: Deserialization of Untrusted DataCVE-2026-12256 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
- Product
- Fusion Builder
- Affected
- up to 3.15.3
- What to do
- Affects up to 3.15.3. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe: Privilege EscalationCVE-2026-12165 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the `RegistryUserRole` parameter. This is due to the plugin's admin menu being registered at the `edit_posts` capability level — granting Contributor-level users access to the plugin's admin pages and a valid `cg_admin` nonce — while the option-saving handler in `change-options-and-sizes.php` performs no `current_user_can()` capability check beyond `check_admin_referer('cg_admin')`, and the `RegistryUserRole` value is processed only through `sanitize_text_field()` and `htmlentities()` without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored `RegistryUserRole` option with `administrator`, which the `cg_create_wp_user_from_google_user` function then reads back from the `contest_gal1ery_registry_and_login_options` database table without any allowlist validation and passes directly to `wp_update_user()`, effectively promoting a newly registered Google sign-in account to Administrat
- Product
- Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
- Affected
- up to 30.0.2
- What to do
- Affects up to 30.0.2. Update Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026Counter Box – Add Countdowns, Timers & Dynamic Counters to: PHP Object InjectionCVE-2026-12115 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization is triggered automatically upon the post-import redirect that renders the list table, and again when any item is opened for editing, requiring no additional navigation beyond the import action itself.
- Product
- Counter Box – Add Countdowns, Timers & Dynamic Counters to
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update Counter Box – Add Countdowns, Timers & Dynamic Counters to to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.CVE-2025-69179 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.CVE-2025-69178 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.
- Affected
- up to 4.3.14.2
- What to do
- Affects up to 4.3.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.CVE-2025-69177 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.CVE-2025-69176 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.CVE-2025-69173 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.CVE-2025-69172 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.CVE-2025-69171 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Spike <= 1.2 versions.CVE-2025-69168 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Spike <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Eros <= 1.3 versions.CVE-2025-69167 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Eros <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.CVE-2025-69165 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.CVE-2025-69163 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.
- Affected
- up to 3.17
- What to do
- Affects up to 3.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.CVE-2025-69162 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.
- Affected
- up to 5.17
- What to do
- Affects up to 5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.CVE-2025-69161 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Gita <= 1.11 versions.CVE-2025-69160 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Gita <= 1.11 versions.
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Printo <= 1.11 versions.CVE-2025-69159 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Printo <= 1.11 versions.
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.CVE-2025-69151 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.CVE-2025-69150 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.
- Affected
- up to 1.14
- What to do
- Affects up to 1.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.CVE-2025-69149 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.CVE-2025-69148 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Putter <= 1.17 versions.CVE-2025-69147 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Putter <= 1.17 versions.
- Affected
- up to 1.17
- What to do
- Affects up to 1.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Dom <= 1.24 versions.CVE-2025-69146 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Dom <= 1.24 versions.
- Affected
- up to 1.24
- What to do
- Affects up to 1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Gat <= 1.16 versions.CVE-2025-69145 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Gat <= 1.16 versions.
- Affected
- up to 1.16
- What to do
- Affects up to 1.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Mission <= 1.22 versions.CVE-2025-69143 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Mission <= 1.22 versions.
- Affected
- up to 1.22
- What to do
- Affects up to 1.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.CVE-2025-69142 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.
- Affected
- up to 1.22
- What to do
- Affects up to 1.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.CVE-2025-69141 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.CVE-2025-69139 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.CVE-2025-69138 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Access Control in Genemy <= 1.6.6 versions.CVE-2025-69137 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Genemy <= 1.6.6 versions.
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.CVE-2025-69136 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.CVE-2025-69135 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.CVE-2025-69131 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.CVE-2025-69129 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.CVE-2025-69125 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Especio <= 1.0 versions.CVE-2025-69124 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Especio <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.CVE-2025-69122 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.CVE-2025-69121 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.CVE-2025-69119 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.
- Affected
- up to 1.15.0
- What to do
- Affects up to 1.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.CVE-2025-69118 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.CVE-2025-69117 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.
- Affected
- up to 1.14.0
- What to do
- Affects up to 1.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.CVE-2025-69116 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.CVE-2025-69114 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.CVE-2025-69113 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.CVE-2025-69112 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.
- Affected
- up to 1.14.0
- What to do
- Affects up to 1.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.CVE-2025-69110 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.CVE-2025-69109 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.CVE-2025-69108 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.