Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,145 results · page 97 of 203
Sep 11, 2025Ultimate Classified Listings: Unauthorized modification of dataCVE-2025-0763 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_custom_fields function in all versions up to, and including, 1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin custom fields.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2025Maspik: Missing Authorization in version 2CVE-2025-9979 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks on the Maspik_spamlog_download_csv function. This makes it possible for authenticated attackers, with subscriber-level access and above, to export and download the spam log database containing blocked submission attempts, which may include misclassified but legitimate submissions with sensitive data.
- Product
- Maspik
- What to do
- Update Maspik to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net: Time-based SQL InjectionCVE-2025-9463 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 1.117.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net
- Affected
- up to 1.117.5
- What to do
- Affects up to 1.117.5. Update Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025NitroPack: Unauthorized modification of dataCVE-2025-8778 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the nitropack_set_compression_ajax() function in all versions up to, and including, 1.18.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the nitropack-enableCompression option and effectively change plugin compression settings.
- Product
- NitroPack
- Affected
- up to 1.18.4
- What to do
- Affects up to 1.18.4. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2025WP Import – Ultimate CSV XML Importer for: Unauthorized access of dataCVE-2025-10040 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ftp_details' AJAX action in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve a configured set of SFTP/FTP credentials.
- Product
- WP Import – Ultimate CSV XML Importer for
- Affected
- up to 7.27
- What to do
- Affects up to 7.27. Update WP Import – Ultimate CSV XML Importer for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2025Categorify: Missing AuthorizationCVE-2025-59005 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Categorify: from n/a through <= 1.0.7.5.
- Product
- Categorify
- Affected
- up to 1.0.7.5
- What to do
- Affects up to 1.0.7.5. Update Categorify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
- Product
- Accessibility Checker by Equalize Digital
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Export WP Page to Static HTML/CSS: Missing AuthorizationCVE-2025-58980 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HTML/CSS: from n/a through <= 4.1.0.
- Product
- Export WP Page to Static HTML/CSS
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025BerqWP: Missing AuthorizationCVE-2025-58979 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqWP: from n/a through <= 2.2.53.
- Product
- BerqWP
- Affected
- up to 2.2.53
- What to do
- Affects up to 2.2.53. Update BerqWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025PDF Generator for: Missing AuthorizationCVE-2025-58978 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Generator for WordPress: from n/a through <= 1.5.4.
- Product
- PDF Generator for
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update PDF Generator for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
- Product
- Accessibility Checker by Equalize Digital
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Kalium: Missing AuthorizationCVE-2025-53348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.
- Product
- Kalium
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update Kalium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Awesome Support: Missing AuthorizationCVE-2025-53340 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Support: from n/a through <= 6.3.6.
- Product
- Awesome Support
- Affected
- up to 6.3.6
- What to do
- Affects up to 6.3.6. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Spreadconnect: Missing AuthorizationCVE-2025-53291 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5.
- Product
- Spreadconnect
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Spreadconnect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Majestic Support: Missing AuthorizationCVE-2025-49860 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.
- Product
- Majestic Support
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Church Admin: Missing AuthorizationCVE-2025-39553 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.
- Product
- Church Admin
- Affected
- up to 5.0.9
- What to do
- Affects up to 5.0.9. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025WP Simple Booking Calendar: Missing AuthorizationCVE-2025-39541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/a through <= 2.0.13.
- Product
- WP Simple Booking Calendar
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update WP Simple Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Target Video Easy Publish: Missing AuthorizationCVE-2025-32688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through <= 3.8.9.
- Product
- Target Video Easy Publish
- Affected
- up to 3.8.9
- What to do
- Affects up to 3.8.9. Update Target Video Easy Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Unauthorized access and modification of dataCVE-2025-9542 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify integration settings or view existing automations.
- Product
- AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in
- Affected
- up to 5.3.7
- What to do
- Affects up to 5.3.7. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2025AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in: Unauthorized modification of dataCVE-2025-9539 · WordPress plugins & themes · reported by WordfenceHigh 8
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the automatorwp_ajax_import_automation_from_url function in all versions up to, and including, 5.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary automations, which can lead to Remote Code Execution or Privilege escalation once such automation is activated by the administrator
- Product
- AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in
- Affected
- up to 5.3.6
- What to do
- Affects up to 5.3.6. Update AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 8, 2025Ditty: Lacks authorization and authentication for requests to its displayItems endpointCVE-2025-8085 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
- Product
- Ditty
- Fixed in
- 3.1.58
- What to do
- Update Ditty to 3.1.58 or newer.
Sep 6, 2025Cloud SAML SSO: Unauthorized modification of dataCVE-2025-7040 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings' action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters for organization settings and passes them directly to update_option() without any check of the user’s capabilities or a CSRF nonce. This makes it possible for unauthenticated attackers to change critical configuration (including toggling signing and encryption), potentially breaking the SSO flow and causing a denial-of-service.
- Product
- Cloud SAML SSO
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Cloud SAML SSO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2025AdForest: Authentication BypassCVE-2025-8359 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, including administrators, without access to a password.
- Product
- AdForest
- Affected
- up to 6.0.9
- What to do
- Affects up to 6.0.9. Update AdForest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Sep 5, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-54744 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.15.
- Product
- MasterStudy LMS
- Affected
- up to 3.6.15
- What to do
- Affects up to 3.6.15. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025HAPPY: Missing AuthorizationCVE-2025-53571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.6.
- Product
- HAPPY
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Site Info: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58866 · WordPress plugins & themes · reported by PatchstackLow 2.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Rami Yushuvaev Site Info site-info-dashboard-widget allows Retrieve Embedded Sensitive Data.This issue affects Site Info: from n/a through <= 1.1.
- Product
- Site Info
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Site Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Media Author: Incorrect Privilege AssignmentCVE-2025-58841 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a through <= 1.0.4.
- Product
- Media Author
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Media Author to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Shk Corporate: Missing AuthorizationCVE-2025-58824 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shk Corporate: from n/a through <= 2.4.1.1.
- Product
- Shk Corporate
- Affected
- up to 2.4.1.1
- What to do
- Affects up to 2.4.1.1. Update Shk Corporate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025SoftMe: Missing AuthorizationCVE-2025-58817 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoftMe: from n/a through <= 1.1.27.
- Product
- SoftMe
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update SoftMe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Product Carousel Slider for Elementor: Missing AuthorizationCVE-2025-58816 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Carousel Slider for Elementor: from n/a through <= 2.1.3.
- Product
- Product Carousel Slider for Elementor
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Product Carousel Slider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Consultstreet: Missing AuthorizationCVE-2025-58813 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Consultstreet: from n/a through <= 3.0.0.
- Product
- Consultstreet
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Consultstreet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ninja Charts: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-58797 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embedded Sensitive Data.This issue affects Ninja Charts: from n/a through <= 3.3.5.
- Product
- Ninja Charts
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update Ninja Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Payoneer Checkout: Missing AuthorizationCVE-2025-58795 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through <= 3.4.0.
- Product
- Payoneer Checkout
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Payoneer Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Authors List: Cross-Site Request Forgery (CSRF)CVE-2025-58792 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a through <= 2.0.6.2.
- Product
- Authors List
- Affected
- up to 2.0.6.2
- What to do
- Affects up to 2.0.6.2. Update Authors List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Ray Enterprise Translation: Missing AuthorizationCVE-2025-58785 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.2.
- Product
- Ray Enterprise Translation
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Gutentor: Missing AuthorizationCVE-2025-58783 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.5.
- Product
- Gutentor
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update Gutentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025AI Engine: Unauthorized access and loss of dataCVE-2025-8268 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded by other users.
- Product
- AI Engine
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update AI Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2025Contact Form By Mega Forms: Missing AuthorizationCVE-2025-58639 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms mega-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form By Mega Forms: from n/a through <= 1.6.1.
- Product
- Contact Form By Mega Forms
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Contact Form By Mega Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Support Genix: Missing AuthorizationCVE-2025-58635 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.23.
- Product
- Support Genix
- Affected
- up to 1.4.23
- What to do
- Affects up to 1.4.23. Update Support Genix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025PeachPay Payments: Missing AuthorizationCVE-2025-58634 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in peachpay PeachPay Payments peachpay-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PeachPay Payments: from n/a through <= 1.117.4.
- Product
- PeachPay Payments
- Affected
- up to 1.117.4
- What to do
- Affects up to 1.117.4. Update PeachPay Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Mobile Contact Line: Missing AuthorizationCVE-2025-58622 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile Contact Line: from n/a through <= 2.4.0.
- Product
- Mobile Contact Line
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Mobile Contact Line to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025F4 Media Taxonomies: Missing AuthorizationCVE-2025-58617 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F4 Media Taxonomies: from n/a through <= 1.1.4.
- Product
- F4 Media Taxonomies
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update F4 Media Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Frisbii Pay: Missing AuthorizationCVE-2025-58616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frisbii Pay: from n/a through <= 1.8.2.1.
- Product
- Frisbii Pay
- Affected
- up to 1.8.2.1
- What to do
- Affects up to 1.8.2.1. Update Frisbii Pay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Posts Table with Search & Sort: Missing AuthorizationCVE-2025-58613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through <= 1.4.10.
- Product
- Posts Table with Search & Sort
- Affected
- up to 1.4.10
- What to do
- Affects up to 1.4.10. Update Posts Table with Search & Sort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025SaasLauncher: Missing AuthorizationCVE-2025-58606 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.
- Product
- SaasLauncher
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update SaasLauncher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Surfer: Missing AuthorizationCVE-2025-58603 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.
- Product
- Surfer
- Affected
- up to 1.6.4.574
- What to do
- Affects up to 1.6.4.574. Update Surfer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Classified Listing: Missing AuthorizationCVE-2025-58601 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.
- Product
- Classified Listing
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Paid Member Subscriptions: Missing AuthorizationCVE-2025-58600 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.
- Product
- Paid Member Subscriptions
- Affected
- up to 2.15.9
- What to do
- Affects up to 2.15.9. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025Order Delivery Date for WooCommerce: Missing AuthorizationCVE-2025-58599 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.
- Product
- Order Delivery Date for WooCommerce
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025wpForo Forum: Authorization Bypass Through User-Controlled KeyCVE-2025-58597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.
- Product
- wpForo Forum
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.