WordPress Secure Passkeys plugin <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Passkey Exposure and Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Secure Passkeys versions = 1.2.1...

WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Certus Cybersecurity in WordPress Plugin Accessibility Checker by Equalize Digital versions = 1.31.0...

PT-2025-36114

Name of the Vulnerable Software and Affected Versions OceanWP WordPress theme versions prior to 4.1.2 Description The OceanWP WordPress theme is susceptible to unauthorized option updates due to a missing capability check within an AJAX request handler. This allows any authenticated user, even...

WordPress SoftMe Theme <= 1.1.24 is vulnerable to Broken Access Control

Software SoftMe Type Theme Vulnerable versions = 1.1.24 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58817 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 73da99fa2c92 Credits Martino Spagnuolo r3verii Required...

WordPress Mobile Contact Line Plugin <= 2.4.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by 0xbeven in WordPress Plugin Mobile Contact Line versions = 2.4.0...

WordPress F4 Media Taxonomies Plugin <= 1.1.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin F4 Media Taxonomies versions = 1.1.4...

WordPress Uxper Booking Plugin <= 1.3.3 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Bonds in WordPress Plugin Uxper Booking versions = 1.3.3...

WordPress Tourfic plugin <= 2.14.5 - Missing Authorization in Multiple Functions vulnerability

Missing Authorization in Multiple Functions vulnerability discovered by WordFence in WordPress Plugin Tourfic versions = 2.14.5...

WordPress WPPizza Plugin <= 3.19.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin WPPizza versions = 3.19.8...

WordPress AutoWP plugin <= 2.2.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Denver Jackson in WordPress Plugin AutoWP versions = 2.2.4...

WordPress Real Spaces Theme <= 3.5 is vulnerable to Privilege Escalation

Software Real Spaces Type Theme Vulnerable versions = 3.5 Fixed in 3.6 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-8218 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID dbcfbeba0421 Credits Alyudin Nafiie...

WordPress WP Membership Plugin <= 1.6.3 - Settings Change Vulnerability

Settings Change Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin WP Membership versions = 1.6.3...

WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin WP Statistics versions = 14.15...

WordPress Infility Global <= 2.14.51 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Infility Global versions = 2.14.51...

WordPress JobSearch Plugin < 3.0.8 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin JobSearch versions 3.0.8...

WordPress Modernize Theme <= 3.4.0 is vulnerable to Broken Access Control

Software Modernize Type Theme Vulnerable versions = 3.4.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-53343 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b7dbe31498eb Credits Ananda Dhakal Patchstack Required...

WordPress Stratus Theme <= 4.2.5 is vulnerable to Broken Access Control

Software Stratus Type Theme Vulnerable versions = 4.2.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-53341 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 90d8bfd3ac75 Credits Ananda Dhakal Patchstack Required...

WordPress ZoloBlocks Plugin <= 2.3.2 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by h0j3n in WordPress Plugin ZoloBlocks versions = 2.3.2...

WordPress Beyot Framework plugin <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin Beyot Framework versions = 6.0.6...

WordPress Realty Portal – Agent plugin <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function vulnerability

Missing Authorization to Authenticated Subscriber+ Privilege Escalation via rpuserprofile Function vulnerability discovered by theviper17y in WordPress Plugin Realty Portal – Agent versions = 0.3.9...