Vendor CVEs

WordPress

All CVEs

39,919 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2025-69091	WordPress Demo Importer Plus	Med	0.28	4.3	0.00	Dec 30, 2025	Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.
CVE-2025-69026	WordPress PopupKit	Med	0.28	4.3	0.00	Dec 30, 2025	Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue affects PopupKit: from n/a through <= 2.1.5.
CVE-2025-69025	Aethonic Poptics poptics	Med	0.28	4.3	0.00	Dec 30, 2025	Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.
CVE-2025-69023	WordPress Discussion Board	Med	0.28	4.3	0.00	Dec 30, 2025	Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.
CVE-2025-69016	WordPress Shortcodes And Extra Features For Phlox	Med	0.28	4.3	0.00	Dec 30, 2025	Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.
CVE-2025-69013	WordPress Stratum	Med	0.28	4.3	0.00	Dec 30, 2025	Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.
CVE-2025-69012	WordPress Event Organiser	Med	0.28	4.3	0.00	Dec 30, 2025	Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.
CVE-2025-68995	WordPress Mystickyelements	Med	0.28	4.3	0.00	Dec 30, 2025	Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.
CVE-2025-68989	WordPress Contact Form 7 Mailchimp Extension	Med	0.28	4.3	0.00	Dec 30, 2025	Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-extension: from n/a through <= 0.9.68.
CVE-2025-68975	WordPress Eagle Booking	Med	0.28	4.3	0.00	Dec 30, 2025	Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.
CVE-2025-68502	Crocoblock JetPopup	Med	0.28	4.3	0.00	Dec 29, 2025	Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through <= 2.0.20.1.
CVE-2025-68592	WordPress WP Adminify	Med	0.28	4.3	0.00	Dec 24, 2025	Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
CVE-2025-68588	WordPress Ts Poll	Med	0.28	4.3	0.00	Dec 24, 2025	Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Poll: from n/a through <= 2.5.5.
CVE-2025-68587	WordPress Watu Quiz	Med	0.28	4.3	0.00	Dec 24, 2025	Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.
CVE-2025-68584	WordPress Vimeotheque	Med	0.28	4.3	0.00	Dec 24, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.
CVE-2025-68583	WordPress Fast User Switching	Med	0.28	4.3	0.00	Dec 24, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affects Fast User Switching: from n/a through <= 1.4.10.
CVE-2025-68580	WordPress Advanced Classifieds And Directory Pro	Med	0.28	4.3	0.00	Dec 24, 2025	Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Request Forgery.This issue affects Advanced Classifieds & Directory Pro: from n/a through <= 3.2.9.
CVE-2025-68577	Virusdie Virusdie	Med	0.28	4.3	0.00	Dec 24, 2025	Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through <= 1.1.6.
CVE-2025-68576	Virusdie Virusdie	Med	0.28	4.3	0.00	Dec 24, 2025	Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6.
CVE-2025-68535	WordPress Sunshine Photo Cart	Med	0.28	4.3	0.00	Dec 24, 2025	Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1.
CVE-2025-68529	WordPress Wp Email Capture	Med	0.28	4.3	0.00	Dec 24, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.
CVE-2025-68523	WordPress Spiffy Calendar	Med	0.28	4.3	0.00	Dec 24, 2025	Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.
CVE-2025-68522	WordPress Wpstream	Med	0.28	4.3	0.00	Dec 24, 2025	Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.
CVE-2025-67625	WordPress Traderunner	Med	0.28	4.3	0.00	Dec 24, 2025	Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: from n/a through <= 3.14.
CVE-2025-67621	WordPress Eight Day Week Print Workflow	Med	0.28	4.3	0.00	Dec 24, 2025	Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.
CVE-2023-28619	WordPress Resoto	Med	0.28	4.3	0.00	Dec 24, 2025	Missing Authorization vulnerability in bnayawpguy Resoto allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Resoto: from n/a through 1.0.8.
CVE-2025-68557	WordPress Chakra Test	Med	0.28	4.3	0.00	Dec 23, 2025	Missing Authorization vulnerability in Vikas Ratudi Chakra test chakra-test allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chakra test: from n/a through <= 1.0.1.
CVE-2025-14155	WordPress Premium Addons For Elementor	Med	0.28	5.3	0.01	Dec 23, 2025	The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it…
CVE-2025-62880	WordPress Custom 404 Pro	Med	0.28	4.3	0.00	Dec 22, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Kunal Custom 404 Pro custom-404-pro allows Cross Site Request Forgery.This issue affects Custom 404 Pro: from n/a through <= 3.12.0.
CVE-2025-62107	WordPress Feather Login Page	Med	0.28	4.3	0.00	Dec 22, 2025	Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather Login Page: from n/a through <= 1.1.7.
CVE-2025-62955	HappyDevs TempTool	Med	0.28	4.3	0.00	Dec 21, 2025	Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-name allows Retrieve Embedded Sensitive Data.This issue affects TempTool [Show Current Template Info]: from n/a through…
CVE-2025-13361	WordPress Web To Sugarcrm Lead	Med	0.28	4.3	0.00	Dec 21, 2025	The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to…
CVE-2023-47232	WordPress Wp Affiliate Disclosure	Med	0.28	4.3	0.00	Dec 21, 2025	Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6.
CVE-2023-25068	WordPress Magazine Edge	Med	0.28	4.3	0.00	Dec 21, 2025	Missing Authorization vulnerability in Mapro Collins Magazine Edge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Edge: from n/a through 1.13.
CVE-2025-7733	WordPress Wp Jobhunt	Med	0.28	4.3	0.00	Dec 20, 2025	The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'cs_update_application_status_callback' due to missing validation on a user controlled key. This makes it…
CVE-2025-14168	WordPress Wp Db Booster	Med	0.28	4.3	0.00	Dec 20, 2025	The WP DB Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validation on the cleanup_all AJAX action. This makes it possible for unauthenticated attackers to delete database records…
CVE-2025-14164	WordPress Quran Gateway	Med	0.28	4.3	0.00	Dec 20, 2025	The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation in the quran_gateway_options function. This makes it possible for unauthenticated attackers to modify the…
CVE-2025-14455	WordPress Image Photo Gallery Final Tiles Grid	Med	0.28	5.4	0.00	Dec 19, 2025	The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This…
CVE-2025-64282	WordPress Radius Blocks	Med	0.28	4.3	0.00	Dec 18, 2025	Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Blocks: from n/a through <= 2.2.1.
CVE-2025-11369	WordPress Essential Blocks	Med	0.28	4.3	0.00	Dec 17, 2025	The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and…
CVE-2025-67948	WordPress Sendpulse Email Marketing Newsletter	Med	0.28	4.3	0.00	Dec 16, 2025	Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from…
CVE-2025-64248	WordPress Request A Quote	Med	0.28	4.3	0.00	Dec 16, 2025	Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.
CVE-2025-64247	WordPress Read More & Accordion	Med	0.28	4.3	0.00	Dec 16, 2025	Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through <= 3.5.5.1.
CVE-2025-64246	WordPress Accessibility By Audioeye	Med	0.28	4.3	0.00	Dec 16, 2025	Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through <= 1.0.49.
CVE-2025-64245	WordPress Import External Attachments	Med	0.28	4.3	0.00	Dec 16, 2025	Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through <= 1.5.12.
CVE-2025-64244	Codexpert Restrict Elementor Widgets, Columns and Sections	Med	0.28	4.3	0.00	Dec 16, 2025	Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Elementor Widgets, Columns and Sections: from n/a…
CVE-2025-64243	WordPress Directory Pro	Med	0.28	4.3	0.00	Dec 16, 2025	Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.
CVE-2025-64242	WordPress Easy Property Listings	Med	0.28	4.3	0.00	Dec 16, 2025	Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.22.
CVE-2025-64241	WordPress WP Coupons and Deals	Med	0.28	4.3	0.00	Dec 16, 2025	Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Coupons and Deals: from n/a through <= 3.2.4.
CVE-2025-64240	WordPress Freshchat	Med	0.28	4.3	0.00	Dec 16, 2025	Cross-Site Request Forgery (CSRF) vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a through <= 2.3.4.

CVE-2025-69091MedDec 30, 2025
WordPress
Demo Importer Plus
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.
CVE-2025-69026MedDec 30, 2025
WordPress
PopupKit
risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue affects PopupKit: from n/a through <= 2.1.5.
CVE-2025-69025MedDec 30, 2025
Aethonic Poptics
poptics
risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.
CVE-2025-69023MedDec 30, 2025
WordPress
Discussion Board
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.
CVE-2025-69016MedDec 30, 2025
WordPress
Shortcodes And Extra Features For Phlox
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.
CVE-2025-69013MedDec 30, 2025
WordPress
Stratum
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.
CVE-2025-69012MedDec 30, 2025
WordPress
Event Organiser
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.
CVE-2025-68995MedDec 30, 2025
WordPress
Mystickyelements
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.
CVE-2025-68989MedDec 30, 2025
WordPress
Contact Form 7 Mailchimp Extension
risk 0.28cvss 4.3epss 0.00
Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-extension: from n/a through <= 0.9.68.
CVE-2025-68975MedDec 30, 2025
WordPress
Eagle Booking
risk 0.28cvss 4.3epss 0.00
Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.
CVE-2025-68502MedDec 29, 2025
Crocoblock
JetPopup
risk 0.28cvss 4.3epss 0.00
Authorization Bypass Through User-Controlled Key vulnerability in Crocoblock JetPopup jet-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetPopup: from n/a through <= 2.0.20.1.
CVE-2025-68592MedDec 24, 2025
WordPress
WP Adminify
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.
CVE-2025-68588MedDec 24, 2025
WordPress
Ts Poll
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Poll: from n/a through <= 2.5.5.
CVE-2025-68587MedDec 24, 2025
WordPress
Watu Quiz
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.
CVE-2025-68584MedDec 24, 2025
WordPress
Vimeotheque
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.
CVE-2025-68583MedDec 24, 2025
WordPress
Fast User Switching
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affects Fast User Switching: from n/a through <= 1.4.10.
CVE-2025-68580MedDec 24, 2025
WordPress
Advanced Classifieds And Directory Pro
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Request Forgery.This issue affects Advanced Classifieds & Directory Pro: from n/a through <= 3.2.9.
CVE-2025-68577MedDec 24, 2025
Virusdie
Virusdie
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through <= 1.1.6.
CVE-2025-68576MedDec 24, 2025
Virusdie
Virusdie
risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6.
CVE-2025-68535MedDec 24, 2025
WordPress
Sunshine Photo Cart
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1.
CVE-2025-68529MedDec 24, 2025
WordPress
Wp Email Capture
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.
CVE-2025-68523MedDec 24, 2025
WordPress
Spiffy Calendar
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.
CVE-2025-68522MedDec 24, 2025
WordPress
Wpstream
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.
CVE-2025-67625MedDec 24, 2025
WordPress
Traderunner
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: from n/a through <= 3.14.
CVE-2025-67621MedDec 24, 2025
WordPress
Eight Day Week Print Workflow
risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a through <= 1.2.5.
CVE-2023-28619MedDec 24, 2025
WordPress
Resoto
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in bnayawpguy Resoto allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Resoto: from n/a through 1.0.8.
CVE-2025-68557MedDec 23, 2025
WordPress
Chakra Test
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Vikas Ratudi Chakra test chakra-test allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chakra test: from n/a through <= 1.0.1.
CVE-2025-14155MedDec 23, 2025
WordPress
Premium Addons For Elementor
risk 0.28cvss 5.3epss 0.01
The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_template_content' function in all versions up to, and including, 4.11.53. This makes it…
CVE-2025-62880MedDec 22, 2025
WordPress
Custom 404 Pro
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Kunal Custom 404 Pro custom-404-pro allows Cross Site Request Forgery.This issue affects Custom 404 Pro: from n/a through <= 3.12.0.
CVE-2025-62107MedDec 22, 2025
WordPress
Feather Login Page
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather Login Page: from n/a through <= 1.1.7.
CVE-2025-62955MedDec 21, 2025
HappyDevs
TempTool
risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-name allows Retrieve Embedded Sensitive Data.This issue affects TempTool [Show Current Template Info]: from n/a through…
CVE-2025-13361MedDec 21, 2025
WordPress
Web To Sugarcrm Lead
risk 0.28cvss 4.3epss 0.00
The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the custom field deletion functionality. This makes it possible for unauthenticated attackers to…
CVE-2023-47232MedDec 21, 2025
WordPress
Wp Affiliate Disclosure
risk 0.28cvss 4.3epss 0.00
Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6.
CVE-2023-25068MedDec 21, 2025
WordPress
Magazine Edge
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Mapro Collins Magazine Edge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Edge: from n/a through 1.13.
CVE-2025-7733MedDec 20, 2025
WordPress
Wp Jobhunt
risk 0.28cvss 4.3epss 0.00
The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'cs_update_application_status_callback' due to missing validation on a user controlled key. This makes it…
CVE-2025-14168MedDec 20, 2025
WordPress
Wp Db Booster
risk 0.28cvss 4.3epss 0.00
The WP DB Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validation on the cleanup_all AJAX action. This makes it possible for unauthenticated attackers to delete database records…
CVE-2025-14164MedDec 20, 2025
WordPress
Quran Gateway
risk 0.28cvss 4.3epss 0.00
The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce validation in the quran_gateway_options function. This makes it possible for unauthenticated attackers to modify the…
CVE-2025-14455MedDec 19, 2025
WordPress
Image Photo Gallery Final Tiles Grid
risk 0.28cvss 5.4epss 0.00
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This…
CVE-2025-64282MedDec 18, 2025
WordPress
Radius Blocks
risk 0.28cvss 4.3epss 0.00
Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Blocks: from n/a through <= 2.2.1.
CVE-2025-11369MedDec 17, 2025
WordPress
Essential Blocks
risk 0.28cvss 4.3epss 0.00
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and…
CVE-2025-67948MedDec 16, 2025
WordPress
Sendpulse Email Marketing Newsletter
risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from…
CVE-2025-64248MedDec 16, 2025
WordPress
Request A Quote
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.
CVE-2025-64247MedDec 16, 2025
WordPress
Read More & Accordion
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through <= 3.5.5.1.
CVE-2025-64246MedDec 16, 2025
WordPress
Accessibility By Audioeye
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through <= 1.0.49.
CVE-2025-64245MedDec 16, 2025
WordPress
Import External Attachments
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import external attachments: from n/a through <= 1.5.12.
CVE-2025-64244MedDec 16, 2025
Codexpert
Restrict Elementor Widgets, Columns and Sections
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Elementor Widgets, Columns and Sections: from n/a…
CVE-2025-64243MedDec 16, 2025
WordPress
Directory Pro
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.
CVE-2025-64242MedDec 16, 2025
WordPress
Easy Property Listings
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.22.
CVE-2025-64241MedDec 16, 2025
WordPress
WP Coupons and Deals
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Coupons and Deals: from n/a through <= 3.2.4.
CVE-2025-64240MedDec 16, 2025
WordPress
Freshchat
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a through <= 2.3.4.

Page 660 of 799