Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,831 results · page 10 of 37

Mar 25, 2026Product Feed for WooCommerce: Deserialization of Untrusted DataCVE-2026-22480 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.
Product
Product Feed for WooCommerce
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update Product Feed for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 23, 2026Woocommerce Custom Product Addons Pro: Remote Code ExecutionCVE-2026-4001 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).
Product
Woocommerce Custom Product Addons Pro
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Woocommerce Custom Product Addons Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record acowebs.com wordfence.com
Mar 23, 2026Smart Custom Fields: Unauthorized access of dataCVE-2026-4066 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to read private and draft post content from other authors via the smart-cf-relational-posts-search AJAX action. The function queries posts with post_status=any and returns full WP_Post objects including post_content, but only checks the generic edit_posts capability instead of verifying whether the requesting user has permission to read each individual post.
Product
Smart Custom Fields
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Smart Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Import and export users and customers: Privilege escalationCVE-2026-3629 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields in profile" setting is enabled and a CSV with a wp_capabilities column header has been previously imported.
Product
Import and export users and customers
Affected
up to 1.29.7
What to do
Affects up to 1.29.7. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Sherk Custom Post Type Displays: Stored Cross-Site ScriptingCVE-2026-3554 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. Specifically, in the sherkcptdisplays_func() function in includes/SherkCPTDisplaysShortcode.php, the 'title' attribute value is extracted from shortcode_atts() on line 19 and directly concatenated into an HTML <h2> tag on line 31 without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sherk Custom Post Type Displays
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Sherk Custom Post Type Displays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2026-2294 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_global_settings' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.09
What to do
Affects up to 3.5.09. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2026Fonts Manager | Custom Fonts: Time-based SQL InjectionCVE-2026-1800 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Fonts Manager | Custom Fonts
Affected
up to 1.2
What to do
Affects up to 1.2. Update Fonts Manager | Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026EmailKit – Email Customizer for WooCommerce & WP: Arbitrary file readCVE-2026-3474 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 1.6.3. This is due to the action() function in the TemplateData class passing user-supplied input from the 'emailkit-editor-template' REST API parameter directly to file_get_contents() without any path validation, sanitization, or restriction to an allowed directory. This makes it possible for authenticated attackers, with Administrator-level access, to read arbitrary files on the server (such as /etc/passwd or wp-config.php) by supplying a traversal path. The file contents are stored as post meta and can subsequently be retrieved via the fetch-data REST API endpoint. Notably, the CheckForm class in the same plugin implements proper path validation using realpath() and directory restriction, demonstrating that the developer was aware of the risk but failed to apply the same protections to the TemplateData endpoint.
Product
EmailKit – Email Customizer for WooCommerce & WP
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update EmailKit – Email Customizer for WooCommerce & WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026TotalContest Lite: Deserialization of Untrusted DataCVE-2026-0677 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Object Injection.This issue affects TotalContest Lite: from n/a through <= 2.9.1.
Product
TotalContest Lite
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update TotalContest Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 20, 2026CM Custom Reports – Flexible reporting to track what matters most: Stored Cross-Site ScriptingCVE-2026-2432 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
CM Custom Reports – Flexible reporting to track what matters most
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update CM Custom Reports – Flexible reporting to track what matters most to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2026WishList Member X: Deserialization of Untrusted DataCVE-2026-25445 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0.
Product
WishList Member X
Affected
up to 3.29.0
What to do
Affects up to 3.29.0. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2026Finag: Deserialization of Untrusted DataCVE-2025-60237 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.
Product
Finag
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Finag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2026Zuut: Deserialization of Untrusted DataCVE-2025-60233 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.
Product
Zuut
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Zuut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2026Add Custom Fields to Media: Cross-Site Request ForgeryCVE-2026-4068 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonce validation on the field deletion functionality in the admin display template. The plugin properly validates a nonce for the 'add field' operation (line 24-36), but the 'delete field' operation (lines 38-49) processes the $_GET['delete'] parameter and calls update_option() without any nonce verification. This makes it possible for unauthenticated attackers to delete arbitrary custom media fields via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Add Custom Fields to Media
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Add Custom Fields to Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2026ColorFolio - Freelance Designer: Deserialization of Untrusted DataCVE-2026-27096 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.
Product
ColorFolio - Freelance Designer
Affected
up to 1.3
What to do
Affects up to 1.3. Update ColorFolio - Freelance Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 18, 2026Traveler: Deserialization of Untrusted DataCVE-2026-25449 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
Product
Traveler
What to do
Update Traveler to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 16, 2026Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types: Insecure Direct Object ReferenceCVE-2026-1883 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the delete_folders() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders created by other users.
Product
Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2026JetEngine: Deserialization of Untrusted DataCVE-2026-32355 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
Product
JetEngine
What to do
Update JetEngine to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026the customCss field that: WpDiscuz before 7.6.47 contains a cross-site scriptingCVE-2026-22209 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like </style><script>alert(1)</script> in the custom CSS setting to execute arbitrary JavaScript in user browsers.
Product
the customCss field that
Fixed in
7.6.47
What to do
Update the customCss field that to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 6, 2026CM Custom Reports: Reflected Cross-Site ScriptingCVE-2026-2431 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date_from' and 'date_to' parameters in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CM Custom Reports
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update CM Custom Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2026B2BKing Premium: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-28106 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a before 5.4.20.
Product
B2BKing Premium
Fixed in
5.4.20
What to do
Update B2BKing Premium to 5.4.20 or newer.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Royal Elementor Addons: Inclusion of Functionality from Untrusted Control SphereCVE-2026-28135 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1052.
Product
Royal Elementor Addons
Affected
up to 1.7.1052
What to do
Affects up to 1.7.1052. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Good Energy: Deserialization of Untrusted DataCVE-2026-28105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.
Product
Good Energy
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Good Energy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Pizza House: Deserialization of Untrusted DataCVE-2026-28074 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.
Product
Pizza House
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Pizza House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Justitia: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27995 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Justitia justitia allows PHP Local File Inclusion.This issue affects Justitia: from n/a through <= 1.1.0.
Product
Justitia
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Justitia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Dentario: Deserialization of Untrusted DataCVE-2026-27439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.
Product
Dentario
Affected
up to 1.5
What to do
Affects up to 1.5. Update Dentario to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Kingler: Deserialization of Untrusted DataCVE-2026-27438 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.
Product
Kingler
Affected
up to 1.7
What to do
Affects up to 1.7. Update Kingler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Tennis Club: Deserialization of Untrusted DataCVE-2026-27437 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.
Product
Tennis Club
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Tennis Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Sweet Date: Deserialization of Untrusted DataCVE-2026-27417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.
Product
Sweet Date
What to do
Update Sweet Date to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026NextScripts: Deserialization of Untrusted DataCVE-2026-27379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.
Product
NextScripts
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update NextScripts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Celeste: Deserialization of Untrusted DataCVE-2026-27369 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.
Product
Celeste
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Celeste to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Car Zone: Deserialization of Untrusted DataCVE-2026-27338 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
Product
Car Zone
Affected
up to 3.7
What to do
Affects up to 3.7. Update Car Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Au Pair Agency - Babysitting & Nanny: Deserialization of Untrusted DataCVE-2026-27098 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.
Product
Au Pair Agency - Babysitting & Nanny
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Au Pair Agency - Babysitting & Nanny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Podlove Web Player: Deserialization of Untrusted DataCVE-2026-24385 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in gerritvanaaken Podlove Web Player podlove-web-player allows Object Injection.This issue affects Podlove Web Player: from n/a through <= 5.9.1.
Product
Podlove Web Player
Affected
up to 5.9.1
What to do
Affects up to 5.9.1. Update Podlove Web Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026PowerPress Podcasting: Deserialization of Untrusted DataCVE-2026-23798 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: from n/a through <= 11.15.10.
Product
PowerPress Podcasting
Affected
up to 11.15.10
What to do
Affects up to 11.15.10. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Mounthood: Deserialization of Untrusted DataCVE-2026-22501 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1.3.2.
Product
Mounthood
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Mounthood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Jardi: Deserialization of Untrusted DataCVE-2026-22497 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2.
Product
Jardi
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Jardi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Estate: Deserialization of Untrusted DataCVE-2026-22475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.
Product
Estate
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Equestrian Centre: Deserialization of Untrusted DataCVE-2026-22474 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.
Product
Equestrian Centre
Affected
up to 1.5
What to do
Affects up to 1.5. Update Equestrian Centre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Dental Clinic: Deserialization of Untrusted DataCVE-2026-22473 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.
Product
Dental Clinic
Affected
up to 3.7
What to do
Affects up to 3.7. Update Dental Clinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Secudeal Payments for Ecommerce: Deserialization of Untrusted DataCVE-2026-22471 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This issue affects Secudeal Payments for Ecommerce: from n/a through <= 1.1.
Product
Secudeal Payments for Ecommerce
Affected
up to 1.1
What to do
Affects up to 1.1. Update Secudeal Payments for Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Solaris: Deserialization of Untrusted DataCVE-2026-22454 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
Product
Solaris
Affected
up to 2.5
What to do
Affects up to 2.5. Update Solaris to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Pets Club: Deserialization of Untrusted DataCVE-2026-22453 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
Product
Pets Club
Affected
up to 2.3
What to do
Affects up to 2.3. Update Pets Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Handyman: Deserialization of Untrusted DataCVE-2026-22451 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.
Product
Handyman
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Grand Wedding: Deserialization of Untrusted DataCVE-2026-22417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.
Product
Grand Wedding
What to do
Update Grand Wedding to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Justicia: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22408 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Justicia justicia allows PHP Local File Inclusion.This issue affects Justicia: from n/a through <= 1.2.
Product
Justicia
Affected
up to 1.2
What to do
Affects up to 1.2. Update Justicia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Classter: Deserialization of Untrusted DataCVE-2025-54001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.
Product
Classter
Affected
up to 2.5
What to do
Affects up to 2.5. Update Classter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 4, 2026Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder: Unauthorized modification of dataCVE-2026-1674 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the save_gutena_forms_schema() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to update option values to a structured array value on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values, that would, for example enable site user registration when it is explicitly disabled.
Product
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 3, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2026-1492 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 26, 2026uListing: Deserialization of Untrusted DataCVE-2026-28138 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0.
Product
uListing
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.