CVE-2025-68088

CVE-2025-68088 describes a Missing Authorization (broken access control) vulnerability in the WordPress plugin Huger for Elementor, affecting versions up to 1.1.5. The issue arises from incorrectly configured access control, enabling privilege escalation and unauthorized access through Huger for ...

CVE-2025-67948 WordPress SendPulse Email Marketing Newsletter plugin <= 2.2.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from n/a through = 2.2.1...

CVE-2025-67929 WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through = 2.10.0...

CVE-2025-67948 WordPress SendPulse Email Marketing Newsletter plugin <= 2.2.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from n/a through = 2.2.1...

CVE-2025-66164 WordPress Laser plugin <= 1.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser: from n/a through = 1.1.1...

CVE-2025-66164 WordPress Laser plugin <= 1.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser: from n/a through = 1.1.1...

CVE-2025-66133 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through = 4.0.7...

CVE-2025-66129

CVE-2025-66129 refers to a WordPress plugin issue in the Pochipp plugin (&lt;= 1.18.0) described as a Missing Authorization / Broken Access Control vulnerability. The underlying problem is an improperly configured access control security level that could enable unauthorized actions. Public source...

CVE-2025-66128 WordPress Sendinblue for WooCommerce plugin <= 4.0.49 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendinblue for WooCommerce: from n/a through = 4.0.49...

CVE-2025-66122 WordPress Stylish Price List plugin <= 7.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Design Stylish Price List stylish-price-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stylish Price List: from n/a through = 7.2.2...

CVE-2025-64639 WordPress WP Compress for MainWP plugin <= 6.50.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through = 6.50.17...

CVE-2025-64638

CVE-2025-64638 is a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin OnPay.io for WooCommerce (versions up to and including 1.0.47). The root cause is "Incorrectly Configured Access Control Security Levels" (lacking proper authorization). Impact details are not ...

CVE-2025-64248

Technical details for CVE-2025-64248 are not provided in the supplied documents; no affected products, root cause, or remediation are disclosed here. Monitor for updates from official advisories.

CVE-2025-64249 WordPress Protect WP Admin plugin <= 4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protect WP Admin: from n/a through = 4.1...

CVE-2025-64247 WordPress Read More & Accordion plugin <= 3.5.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Read More & Accordion: from n/a through = 3.5.5.1...

CVE-2025-64246 WordPress Accessibility by AudioEye plugin <= 1.0.49 - Broken Access Control vulnerability

Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through = 1.0.49...

CVE-2025-11991 JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the runcallback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate form...

CVE-2025-13956

The connected Wordfence vulnerability entry confirms CVE-2025-13956 for LearnPress – WordPress LMS Plugin, affecting all versions up to 4.3.1. It permits unauthenticated actors to view orders statistics (e.g., total revenue summaries and order status counts) due to a missing capability check in t...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

CVE-2025-24071 This is a python PoC...

CVE-2025-66402

Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permission to view favorites or clips can can export the posts and view the contents. Version 2025.12.0 fixes the issue...