Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

563new WordPress flaws this week

392,577entries in the database

40,776 results · page 100 of 816

Aug 4, 2026Simple Google Calendar Outlook Events Widget: Does not validate a user-supplied URL before performing a server-side requestCVE-2026-16536 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.
Product
Simple Google Calendar Outlook Events Widget
Fixed in
3.1.0
What to do
Update Simple Google Calendar Outlook Events Widget to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Clearfy Cache: Does not validate the redirect target in its Cyrlitera old-URL redirect handlerCVE-2026-16296 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.
Product
Clearfy Cache
Fixed in
2.4.3
What to do
Update Clearfy Cache to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Clearfy Cache: Does not perform a capability check in one of its admin-page dispatch pathsCVE-2026-16295 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
Product
Clearfy Cache
Fixed in
2.4.3
What to do
Update Clearfy Cache to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026PowerPress Podcasting plugin by Blubrry: Does not sanitise and escape some of its Podcast Episode settingsCVE-2026-16293 · WordPress plugins & themes · reported by WPScanMedium 6.8
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.16.11
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.16.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Brizy: Does not properly verify authorization on the object being modified before updating a template's type metaCVE-2026-16070 · WordPress plugins & themes · reported by WPScanLow 2.7
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to change the template-type assignment of templates owned by other users.
Product
Brizy
Fixed in
2.8.19
What to do
Update Brizy to 2.8.19 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Brizy: Does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image metaCVE-2026-16069 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
Product
Brizy
Fixed in
2.8.19
What to do
Update Brizy to 2.8.19 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Brizy: Does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting itCVE-2026-16068 · WordPress plugins & themes · reported by WPScanLow 3.5
The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitised on the site's front-end pages and executes in the browser of every visitor, including administrators.
Product
Brizy
Fixed in
2.8.19
What to do
Update Brizy to 2.8.19 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Contest Gallery: Does not perform any capability or nonce check in one of its handlersCVE-2026-16056 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
Product
Contest Gallery
Fixed in
30.0.7
What to do
Update Contest Gallery to 30.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026miniOrange 2FA: Does not restrict who can trigger its second-factor configuration OTP sendCVE-2026-16035 · WordPress plugins & themes · reported by WPScanMedium 4.3
The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.
Product
miniOrange 2FA
Fixed in
6.2.7
What to do
Update miniOrange 2FA to 6.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Easy Integration for Dropbox: Does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated usersCVE-2026-15958 · WordPress plugins & themes · reported by WPScanCritical 9.3
The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.
Product
Easy Integration for Dropbox
Fixed in
2.2.0
What to do
Update Easy Integration for Dropbox to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Nested Pages: Does not properly escape post titles before outputting them into HTML attributes on an administrative listing screenCVE-2026-15233 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.
Product
Nested Pages
Fixed in
3.2.15
What to do
Update Nested Pages to 3.2.15 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Visualizer: Does not restrict a user-supplied URL to safe address ranges before fetching it server-sideCVE-2026-14939 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.
Product
Visualizer
Fixed in
4.0.6
What to do
Update Visualizer to 4.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-14872 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default but can be delegated to lower privileged roles.
Product
Database for Contact Form 7, WPforms, Elementor forms
Fixed in
1.5.5
What to do
Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Paid Membership Subscriptions: Does not verify that the subscription being modified through its change-subscription checkout belongs to the current userCVE-2026-14848 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's subscription and overwrite its plan, status and expiration.
Product
Paid Membership Subscriptions
Fixed in
3.0.8
What to do
Update Paid Membership Subscriptions to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Quiz and Survey Master (QSM): Does not properly escape a question setting before outputting it into an unquoted HTML attributeCVE-2026-14824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz.
Product
Quiz and Survey Master (QSM)
Fixed in
11.2.2
What to do
Update Quiz and Survey Master (QSM) to 11.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026GDPR Framework By Data443: Does not properly verify authorization or the identity of the data subjectCVE-2026-14816 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries.
Product
GDPR Framework By Data443
Fixed in
2.4.0
What to do
Update GDPR Framework By Data443 to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026wpForo Forum: Does not restrictCVE-2026-12698 · WordPress plugins & themes · reported by WPScanMedium 4.3
The wpForo Forum WordPress plugin before 3.1.3 does not restrict which profile fields a member may set when editing their own account, allowing users with a subscriber-level account to write administrator-controlled account-state and reputation fields on their own profile, including self-activating a pending or banned account and forging their forum reputation score.
Product
wpForo Forum
Fixed in
3.1.3
What to do
Update wpForo Forum to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026MonsterInsights: Does not correctly validate the signature on one of its unauthenticated AJAX actions:CVE-2026-11366 · WordPress plugins & themes · reported by WPScanLow 3.7
The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.
Product
MonsterInsights
Fixed in
11.1.0
What to do
Update MonsterInsights to 11.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026EmbedPress: Does not validate user-supplied URLs before making server-side requests through unauthenticated endpointsCVE-2026-10526 · WordPress plugins & themes · reported by WPScanMedium 5.8
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).
Product
EmbedPress
Fixed in
4.6.1
What to do
Update EmbedPress to 4.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2026-28147 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.15.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 3, 2026LogMyTrip: Does not sanitize and escape a value taken from a cookie before using it in a SQL queryCVE-2026-16572 · WordPress plugins & themes · reported by WPScanHigh 8.6
The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.
Product
LogMyTrip
Affected
up to 1.9
What to do
Affects up to 1.9. Update LogMyTrip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify product ownership on its product-attribute REST write endpointsCVE-2026-16565 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor's products on the marketplace.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Fixed in
5.0.9
What to do
Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify order ownership on a REST endpoint that performs bulk order-status changesCVE-2026-16564 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any WooCommerce order on the marketplace, including orders belonging to other vendors and the store's own customers.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Fixed in
5.0.9
What to do
Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Academy LMS: Does not verify course enrollment or lesson publication statusCVE-2026-16563 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of arbitrary lessons, including lessons of paid courses they are not enrolled in and unpublished (draft, pending, private) lessons.
Product
Academy LMS
Fixed in
3.8.3
What to do
Update Academy LMS to 3.8.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026sm page duplicator: Does not sanitise and escape a stored value before using it in a SQL statementCVE-2026-16539 · WordPress plugins & themes · reported by WPScanHigh 8.1
The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.
Product
sm page duplicator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update sm page duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
Product
Import and export users and customers
Fixed in
2.4.2
What to do
Update Import and export users and customers to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Link Library: Does not properly sanitise and escape a user-supplied value before using it in a SQL queryCVE-2026-16532 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Product
Link Library
Fixed in
7.9.3
What to do
Update Link Library to 7.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026ChamaWP: Does not properly validate a password reset requestCVE-2026-16300 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
Product
ChamaWP
Fixed in
1.0.13
What to do
Update ChamaWP to 1.0.13 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Clearfy Cache: Does not restrict the classes allowedCVE-2026-16297 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.
Product
Clearfy Cache
Fixed in
2.4.3
What to do
Update Clearfy Cache to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026ProfileGrid: Does not perform authorization checksCVE-2026-16289 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.
Product
ProfileGrid
Fixed in
6.0.0.0
What to do
Update ProfileGrid to 6.0.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Classified Listing: Does not perform a capability check on an AJAX action that returns aggregated store revenue totalsCVE-2026-16276 · WordPress plugins & themes · reported by WPScanLow 2.7
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.
Product
Classified Listing
Fixed in
5.4.4
What to do
Update Classified Listing to 5.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Classified Listing: Does not perform a capability or ownership check on an AJAX action that returns a post's contentCVE-2026-16274 · WordPress plugins & themes · reported by WPScanLow 2.7
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.
Product
Classified Listing
Fixed in
5.4.4
What to do
Update Classified Listing to 5.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Personal QR Message: Does not restrict the file types that can be uploaded through an unauthenticated handlerCVE-2026-16250 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.
Product
Personal QR Message
Affected
up to 1.0
What to do
Affects up to 1.0. Update Personal QR Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Insert or Embed Articulate Content into: Does not correctly validate the contents of an uploaded archiveCVE-2026-16060 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.
Product
Insert or Embed Articulate Content into
Affected
up to 4.3000000027
What to do
Affects up to 4.3000000027. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Contest Gallery: Does not perform per-object capability or nonce checks in one of its post-deletion handlersCVE-2026-16057 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
Product
Contest Gallery
Fixed in
30.0.7
What to do
Update Contest Gallery to 30.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Simple Membership: Does not sanitise a subscriber name value received from an unauthenticated payment approval requestCVE-2026-15931 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
Product
Simple Membership
Fixed in
4.7.8
What to do
Update Simple Membership to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Simple Membership: Does not verify whether user creation failed during registration before using the returned valueCVE-2026-15930 · WordPress plugins & themes · reported by WPScanCritical 9.4
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
Product
Simple Membership
Fixed in
4.7.8
What to do
Update Simple Membership to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Blog Floating Button: Does not sanitize or escape the visitor User-Agent headerCVE-2026-15383 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.
Product
Blog Floating Button
Affected
up to 1.4.20
What to do
Affects up to 1.4.20. Update Blog Floating Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026GEO my WP: Does not perform any ownership or capability check on two of its logged-in AJAX actionsCVE-2026-15260 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
Product
GEO my WP
Fixed in
4.5.5.3
What to do
Update GEO my WP to 4.5.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Simply Schedule Appointments: Does not perform a capability check on an administrative appointment-listing shortcodeCVE-2026-15254 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
Product
Simply Schedule Appointments
Fixed in
1.6.12.11
What to do
Update Simply Schedule Appointments to 1.6.12.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Tag, Category, and Taxonomy Manager: Does not verify that a user is authorized to access a referenced post before processing it and returning derived dataCVE-2026-15231 · WordPress plugins & themes · reported by WPScanLow 2.7
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from private or draft posts they do not own.
Product
Tag, Category, and Taxonomy Manager
Fixed in
3.51.0
What to do
Update Tag, Category, and Taxonomy Manager to 3.51.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026SoftMarket — Digital Marketplace: Does not properly validate an authentication token in one branch of its email-verification flowCVE-2026-14557 · WordPress plugins & themes · reported by WPScanCritical 9.1
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.
Product
SoftMarket — Digital Marketplace
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update SoftMarket — Digital Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026SVG Support: Does not apply its SVG sanitisation to uploaded files using theCVE-2026-13340 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload access) to store a script-bearing file that executes in the browser of anyone who later views it, including an administrator.
Product
SVG Support
Fixed in
2.5.17
What to do
Update SVG Support to 2.5.17 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Super Store Finder: Does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL queryCVE-2026-12965 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
Product
Super Store Finder
Fixed in
7.11
What to do
Update Super Store Finder to 7.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Webinfos: Does not validate the type or name of uploaded filesCVE-2026-12872 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.
Product
Webinfos
Affected
up to 1.2
What to do
Affects up to 1.2. Update Webinfos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Import and export users and customers: Does not restrict the path of a file it reads and displays during a CSV importCVE-2025-15673 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Product
Import and export users and customers
Fixed in
2.4.3
What to do
Update Import and export users and customers to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026ChamaWP: Does not properly validate user input before passing it to a PHP deserialization functionCVE-2025-15672 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.
Product
ChamaWP
Fixed in
1.0.13
What to do
Update ChamaWP to 1.0.13 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Exclusive Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-12231 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exad_infobox_image’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Exclusive Addons for Elementor
Affected
up to 2.7.9.8
What to do
Affects up to 2.7.9.8. Update Exclusive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 2, 2026Simply Schedule Appointments: Does not correctly restrict a bulk appointment operation to the requester's own recordsCVE-2026-16540 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.
Product
Simply Schedule Appointments
Fixed in
1.6.12.6
What to do
Update Simply Schedule Appointments to 1.6.12.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Frontend File Manager: Does not perform nonce validation on one of its file-metadata update actionsCVE-2026-16292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.
Product
Frontend File Manager
Affected
up to 23.6
What to do
Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.