VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

39,920 total · sorted by risk
  • CVE-2025-12030MedJan 7, 2026
    WordPress
    Acf To REST API
    risk 0.28cvss 4.3epss 0.00

    The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insufficient capability checks in the update_item_permissions_check() method, which only verifies that the current user has the…

  • CVE-2025-69361MedJan 6, 2026
    WordPress
    Post Expirator
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through <= 4.9.3.

  • CVE-2025-69355MedJan 6, 2026
    Tickera
    tickera-event-ticketing-system
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.4.

  • CVE-2025-69354MedJan 6, 2026
    WordPress
    Better Business Reviews
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.

  • CVE-2025-69353MedJan 6, 2026
    WordPress
    Proxy VPN Blocker
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Proxy & VPN Blocker: from n/a through <= 3.5.3.

  • CVE-2025-69348MedJan 6, 2026
    WordPress
    The Events Calendar Countdown Addon
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar Countdown Addon: from n/a through <= 1.4.15.

  • CVE-2025-69346MedJan 6, 2026
    WordPress
    Affiliatex
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in WPCenter AffiliateX affiliatex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AffiliateX: from n/a through <= 1.3.9.3.

  • CVE-2025-69345MedJan 6, 2026
    Boldgrid
    Post And Page Builder
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.

  • CVE-2025-69336MedJan 6, 2026
    WordPress
    Ultimate Store Kit Elementor Addons
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.9.4.

  • CVE-2025-69331MedJan 6, 2026
    WordPress
    Theater for WordPress
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through <= 0.19.

  • CVE-2025-69327MedJan 6, 2026
    WordPress
    Car Rental Manager
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.0.9.

  • CVE-2025-9294MedJan 6, 2026
    WordPress
    Quiz And Survey Master
    risk 0.28cvss 4.3epss 0.00

    The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for…

  • CVE-2025-13766MedJan 6, 2026
    WordPress
    MasterStudy LMS WordPress Plugin
    risk 0.28cvss 5.4epss 0.00

    The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability checks on multiple REST API endpoints in all versions up to, and including, 3.7.6. This…

  • CVE-2025-14371MedJan 6, 2026
    WordPress
    Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
    risk 0.28cvss 4.3epss 0.00

    The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up to, and including, 3.41.0. This makes it…

  • CVE-2025-14441MedJan 6, 2026
    WordPress
    PopupKit
    risk 0.28cvss 4.3epss 0.00

    The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoint in all versions up to, and including, 2.2.0. This is due to the `permission_callback` only validating wp_rest nonce…

  • CVE-2025-53344MedJan 5, 2026
    WordPress
    Thim Core
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3.

  • CVE-2023-52212MedJan 5, 2026
    WordPress
    Wp Job Manager
    risk 0.28cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager allows Cross Site Request Forgery.This issue affects WP Job Manager: from n/a through 2.0.0.

  • CVE-2025-31046MedJan 5, 2026
    WordPress
    AnyWhere Elementor Pro
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.

  • CVE-2025-63038MedDec 31, 2025
    WordPress
    Wp Custom Admin Interface
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.40.

  • CVE-2025-62874MedDec 31, 2025
    WordPress
    Anycomment
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Alexander AnyComment anycomment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyComment: from n/a through <= 0.3.6.

  • CVE-2025-62123MedDec 31, 2025
    WordPress
    Wp Gmail SMTP
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.

  • CVE-2025-62115MedDec 31, 2025
    WordPress
    Hide Plugins
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in ThemeBoy Hide Plugins hide-plugins allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide Plugins: from n/a through <= 1.0.4.

  • CVE-2025-62113MedDec 31, 2025
    WordPress
    Co Marquage Service Public
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in emendo_seb Co-marquage service-public.fr co-marquage-service-public allows Cross Site Request Forgery.This issue affects Co-marquage service-public.fr: from n/a through <= 0.5.77.

  • CVE-2025-62101MedDec 31, 2025
    WordPress
    Pardakht Delkhah
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Omid Shamloo Pardakht Delkhah pardakht-delkhah allows Cross Site Request Forgery.This issue affects Pardakht Delkhah: from n/a through <= 3.0.0.

  • CVE-2025-62099MedDec 31, 2025
    WordPress
    Gravity Signature Forms Add On
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in approveme Signature Add-On for Gravity Forms gravity-signature-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Signature Add-On for Gravity Forms: from n/a through <= 1.8.6.

  • CVE-2025-62083MedDec 31, 2025
    WordPress
    Coming Soon by BoomDevs
    risk 0.28cvss 4.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs allows Retrieve Embedded Sensitive Data.This issue affects BoomDevs WordPress Coming Soon: from n/a through <= 1.0.4.

  • CVE-2025-62078MedDec 31, 2025
    WordPress
    Easy Upload Files During Checkout
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Fahad Mahmood Easy Upload Files During Checkout easy-upload-files-during-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Upload Files During Checkout: from n/a through <= 3.0.0.

  • CVE-2025-49352MedDec 31, 2025
    WordPress
    Order Cancellation & Returns for WooCommerce
    risk 0.28cvss 4.3epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for…

  • CVE-2025-49340MedDec 31, 2025
    WordPress
    Direct Payments Wp
    risk 0.28cvss 4.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2.

  • CVE-2025-49339MedDec 31, 2025
    WordPress
    Direct Payments Wp
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Digages Direct Payments WP direct-payments-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Direct Payments WP: from n/a through <= 1.3.2.

  • CVE-2025-63040MedDec 31, 2025
    WordPress
    Post Snippets
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Post Snippets post-snippets allows Cross Site Request Forgery.This issue affects Post Snippets: from n/a through <= 4.0.11.

  • CVE-2025-63014MedDec 31, 2025
    WordPress
    Gmedia Photo Gallery
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Cross Site Request Forgery.This issue affects Gmedia Photo Gallery: from n/a through <= 1.25.0.

  • CVE-2025-63004MedDec 31, 2025
    Skynet Technologies USA LLC
    All in One Accessibility
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Skynet Technologies USA LLC All in One Accessibility all-in-one-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All in One Accessibility: from n/a through <= 1.15.

  • CVE-2025-62751MedDec 31, 2025
    Extendthemes
    Vireo
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in extendthemes Vireo vireo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vireo: from n/a through <= 1.0.24.

  • CVE-2025-62154MedDec 31, 2025
    WordPress
    AI Content Writing Assistant
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in recorp AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One ai-content-writing-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Content Writing Assistant…

  • CVE-2025-62150MedDec 31, 2025
    WordPress
    History Timeline
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in themesawesome History Timeline timeline-awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects History Timeline: from n/a through <= 1.0.6.

  • CVE-2025-62148MedDec 31, 2025
    WordPress
    Robotstxt Rewrite
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Eugen Bobrowski Robots.txt rewrite robotstxt-rewrite allows Cross Site Request Forgery.This issue affects Robots.txt rewrite: from n/a through <= 1.6.1.

  • CVE-2025-62143MedDec 31, 2025
    WordPress
    Post Video Players
    risk 0.28cvss 4.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Retrieve Embedded Sensitive Data.This issue affects Post Video Players: from n/a through <= 1.163.

  • CVE-2025-62133MedDec 31, 2025
    WordPress
    Formfacade
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in manidoraisamy FormFacade formfacade allows Cross Site Request Forgery.This issue affects FormFacade: from n/a through <= 1.4.1.

  • CVE-2025-62132MedDec 31, 2025
    WordPress
    Tasty Recipes Lite
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.

  • CVE-2025-62131MedDec 31, 2025
    WordPress
    Tasty Recipes Lite
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.

  • CVE-2025-62130MedDec 31, 2025
    WordPress
    Accordion Slider Gallery
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in wpdiscover Accordion Slider Gallery accordion-slider-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion Slider Gallery: from n/a through <= 2.7.

  • CVE-2025-62089MedDec 31, 2025
    WordPress
    Mergado Pack
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in MERGADO Mergado Pack mergado-marketing-pack allows Cross Site Request Forgery.This issue affects Mergado Pack: from n/a through <= 4.2.1.

  • CVE-2025-62087MedDec 31, 2025
    WordPress
    Sticky Notes for WP Dashboard
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Web Builder 143 Sticky Notes for WP Dashboard wb-sticky-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sticky Notes for WP Dashboard: from n/a through <= 1.2.4.

  • CVE-2025-62084MedDec 31, 2025
    WordPress
    Inext Woo Pincode Checker
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Imdad Next Web iNext Woo Pincode Checker inext-woo-pincode-checker allows Cross Site Request Forgery.This issue affects iNext Woo Pincode Checker: from n/a through <= 2.3.1.

  • CVE-2025-62080MedDec 31, 2025
    WordPress
    Live Shopping & Shoppable Videos For WooCommerce
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross Site Request Forgery.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.

  • CVE-2025-59130MedDec 31, 2025
    WordPress
    Appointify
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a through <= 1.0.8.

  • CVE-2025-49356MedDec 31, 2025
    WordPress
    Orders Chat For Woocommerce
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Mykola Lukin Orders Chat for WooCommerce orders-chat-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orders Chat for WooCommerce: from n/a through <= 1.2.0.

  • CVE-2025-62091MedDec 31, 2025
    WordPress
    Serial Codes Generator and Validator with WooCommerce Support
    risk 0.28cvss 5.4epss 0.00

    Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serial Codes Generator and Validator…

  • CVE-2025-62128MedDec 30, 2025
    WordPress
    SiteLock Security – WP Hardening, Login Security & Malware Scans
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware…

Page 659 of 799