Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,183 results · page 11 of 64
Aug 3, 2026Classified Listing: Does not perform a capability check on an AJAX action that returns aggregated store revenue totalsCVE-2026-16276 · WordPress plugins & themes · reported by WPScanLow 2.7
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.
- Product
- Classified Listing
- Fixed in
- 5.4.4
- What to do
- Update Classified Listing to 5.4.4 or newer.
Aug 3, 2026Classified Listing: Does not perform a capability or ownership check on an AJAX action that returns a post's contentCVE-2026-16274 · WordPress plugins & themes · reported by WPScanLow 2.7
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.
- Product
- Classified Listing
- Fixed in
- 5.4.4
- What to do
- Update Classified Listing to 5.4.4 or newer.
Aug 3, 2026Contest Gallery: Does not perform per-object capability or nonce checks in one of its post-deletion handlersCVE-2026-16057 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
- Product
- Contest Gallery
- Fixed in
- 30.0.7
- What to do
- Update Contest Gallery to 30.0.7 or newer.
Aug 3, 2026Blog Floating Button: Does not sanitize or escape the visitor User-Agent headerCVE-2026-15383 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a malicious script that executes in the session of any administrator who views the access report, leading to site takeover.
- Product
- Blog Floating Button
- Affected
- up to 1.4.20
- What to do
- Affects up to 1.4.20. Update Blog Floating Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026GEO my WP: Does not perform any ownership or capability check on two of its logged-in AJAX actionsCVE-2026-15260 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
- Product
- GEO my WP
- Fixed in
- 4.5.5.3
- What to do
- Update GEO my WP to 4.5.5.3 or newer.
Aug 3, 2026Simply Schedule Appointments: Does not perform a capability check on an administrative appointment-listing shortcodeCVE-2026-15254 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
- Product
- Simply Schedule Appointments
- Fixed in
- 1.6.12.11
- What to do
- Update Simply Schedule Appointments to 1.6.12.11 or newer.
Aug 2, 2026Narrative Publisher: Does not restrict write access to a REST-exposed post meta field or escape itCVE-2026-16273 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any higher-privileged user who views the affected post.
- Product
- Narrative Publisher
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Narrative Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026POUCO Import Users: Does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accountsCVE-2026-16256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
- Product
- POUCO Import Users
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update POUCO Import Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026Event Booking Manager for WooCommerce: Does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event pageCVE-2026-16063 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.3.7
- What to do
- Update Event Booking Manager for WooCommerce to 5.3.7 or newer.
Aug 2, 2026LWS Optimize: Does not perform a capability check on its cache-clearing actionsCVE-2026-16042 · WordPress plugins & themes · reported by WPScanMedium 4.3
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds.
- Product
- LWS Optimize
- Fixed in
- 3.4
- What to do
- Update LWS Optimize to 3.4 or newer.
Aug 2, 2026RT Mega Menu: Does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin pageCVE-2026-15385 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.
- Product
- RT Mega Menu
- Fixed in
- 1.5.2
- What to do
- Update RT Mega Menu to 1.5.2 or newer.
Aug 2, 2026Five Star Restaurant Reservations: Does not perform a capability check on one of its AJAX actionsCVE-2026-15151 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.7.23
- What to do
- Update Five Star Restaurant Reservations to 2.7.23 or newer.
Aug 2, 2026JetEngine: Does not escape a post meta value before outputting it through one of its shortcodesCVE-2026-14864 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.
- Product
- JetEngine
- Fixed in
- 3.8.12
- What to do
- Update JetEngine to 3.8.12 or newer.
Aug 2, 2026King Addons for Elementor: Does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX responseCVE-2026-14841 · WordPress plugins & themes · reported by WPScanMedium 6.1
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.
- Product
- King Addons for Elementor
- Fixed in
- 51.1.76
- What to do
- Update King Addons for Elementor to 51.1.76 or newer.
Aug 2, 2026Clever Mega Menu for Visual Composer: Does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadataCVE-2026-11872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
- Product
- Clever Mega Menu for Visual Composer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Clever Mega Menu for Visual Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026Charitable: Does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attributeCVE-2025-15675 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end campaign page.
- Product
- Charitable
- Fixed in
- 1.8.5.3
- What to do
- Update Charitable to 1.8.5.3 or newer.
Aug 1, 2026Admin Columns for ACF Fields: Does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columnsCVE-2026-15262 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.
- Product
- Admin Columns for ACF Fields
- Affected
- up to 0.3.2
- What to do
- Affects up to 0.3.2. Update Admin Columns for ACF Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026Download Manager: Does not properly escape a package's title before outputting it in the front-end package templatesCVE-2026-14292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.
- Product
- Download Manager
- Fixed in
- 3.3.66
- What to do
- Update Download Manager to 3.3.66 or newer.
Aug 1, 2026Dynamic Pricing With Discount Rules for WooCommerce: Does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the responseCVE-2026-13725 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
- Product
- Dynamic Pricing With Discount Rules for WooCommerce
- Fixed in
- 5.0.0
- What to do
- Update Dynamic Pricing With Discount Rules for WooCommerce to 5.0.0 or newer.
Aug 1, 2026Participants Database: Does not properly sanitize and escape a user-supplied parameter before using it in a SQL queryCVE-2026-13596 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Participants Database
- Fixed in
- 2.7.8.4
- What to do
- Update Participants Database to 2.7.8.4 or newer.
Aug 1, 2026Buckaroo Woocommerce Payments: Does not perform any capability check or nonce validation on an AJAX action that processes payment capture refundsCVE-2026-13329 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.
- Product
- Buckaroo Woocommerce Payments
- Fixed in
- 4.9.0
- What to do
- Update Buckaroo Woocommerce Payments to 4.9.0 or newer.
Aug 1, 2026wpForo Forum: Does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile pageCVE-2026-12696 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.
- Product
- wpForo Forum
- Fixed in
- 3.1.2
- What to do
- Update wpForo Forum to 3.1.2 or newer.
Aug 1, 2026Spectra Legacy: Does not validate or escape several block style attributes before using them to build the CSS it outputs on the front endCVE-2026-10827 · WordPress plugins & themes · reported by WPScanLow 3.5
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.
- Product
- Spectra Legacy
- Fixed in
- 2.20.0
- What to do
- Update Spectra Legacy to 2.20.0 or newer.
Jul 31, 2026WP Go Maps: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-15381 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- WP Go Maps
- Fixed in
- 10.1.04
- What to do
- Update WP Go Maps to 10.1.04 or newer.
Jul 31, 2026Product Feed Manager For WooCommerce: Does not properly sanitise and escape product-feed custom filter rules before using them in a SQL queryCVE-2026-15258 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.
- Product
- Product Feed Manager For WooCommerce
- Fixed in
- 7.6.1
- What to do
- Update Product Feed Manager For WooCommerce to 7.6.1 or newer.
Jul 31, 2026JS Help Desk: Grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handlerCVE-2026-14931 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
- Product
- JS Help Desk
- Fixed in
- 3.1.4
- What to do
- Update JS Help Desk to 3.1.4 or newer.
Jul 31, 2026Paid Membership Subscriptions: Does not perform capability or nonce checks on one of its payment-related AJAX actionsCVE-2026-14847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.
- Product
- Paid Membership Subscriptions
- Fixed in
- 3.0.7
- What to do
- Update Paid Membership Subscriptions to 3.0.7 or newer.
Jul 31, 2026NewStatPress: Does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgetsCVE-2026-14845 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget.
- Product
- NewStatPress
- Fixed in
- 1.4.5
- What to do
- Update NewStatPress to 1.4.5 or newer.
Jul 31, 2026Mailgun for: Does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing listsCVE-2026-14834 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.
- Product
- Mailgun for
- Fixed in
- 2.2.1
- What to do
- Update Mailgun for to 2.2.1 or newer.
Jul 31, 2026Lightbox with PhotoSwipe: Does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browserCVE-2026-14833 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or administrator opens the lightbox.
- Product
- Lightbox with PhotoSwipe
- Fixed in
- 5.9.0
- What to do
- Update Lightbox with PhotoSwipe to 5.9.0 or newer.
Jul 31, 2026Check & Log Email: Does not properly sanitize and escape parameters before using them in SQL queriesCVE-2026-14554 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
- Product
- Check & Log Email
- Fixed in
- 2.0.15
- What to do
- Update Check & Log Email to 2.0.15 or newer.
Jul 31, 2026ElementsKit Elementor Addons: Does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front endCVE-2026-13393 · WordPress plugins & themes · reported by WPScanLow 3.5
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.
- Product
- ElementsKit Elementor Addons
- Fixed in
- 3.10.01
- What to do
- Update ElementsKit Elementor Addons to 3.10.01 or newer.
Jul 31, 2026ElementsKit Elementor Addons: Does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPCVE-2026-13392 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.
- Product
- ElementsKit Elementor Addons
- Fixed in
- 3.10.01
- What to do
- Update ElementsKit Elementor Addons to 3.10.01 or newer.
Jul 31, 2026Kirki: Does not properly sanitise and escape a value taken from the request before using it in a SQL statementCVE-2026-12721 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Kirki
- Fixed in
- 6.0.13
- What to do
- Update Kirki to 6.0.13 or newer.
Jul 31, 2026Ultimate Member: Does not filter administrator-level capabilities from the roles it makes selectable on its registration formsCVE-2026-12251 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
- Product
- Ultimate Member
- Fixed in
- 2.12.1
- What to do
- Update Ultimate Member to 2.12.1 or newer.
Jul 30, 2026Ultimate Addons for WPBakery Page Builder: Does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packsCVE-2026-15382 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.
- Product
- Ultimate Addons for WPBakery Page Builder
- Fixed in
- 3.21.4
- What to do
- Update Ultimate Addons for WPBakery Page Builder to 3.21.4 or newer.
Jul 30, 2026Search Atlas SEO: Does not perform a capability or nonce check in one of its AJAX handlersCVE-2026-15252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and consuming its indexing quota.
- Product
- Search Atlas SEO
- Fixed in
- 2.6.12
- What to do
- Update Search Atlas SEO to 2.6.12 or newer.
Jul 30, 2026MotoPress Hotel Booking: Does not perform a capability check before returning a booking's full customer details in one of its AJAX actionsCVE-2026-15235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.
- Product
- MotoPress Hotel Booking
- Fixed in
- 6.0.4
- What to do
- Update MotoPress Hotel Booking to 6.0.4 or newer.
Jul 30, 2026WP Hotel Booking: Does not sanitise and escape a search parameter on an administrative listing before using it in a SQL queryCVE-2026-15153 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
- Product
- WP Hotel Booking
- Fixed in
- 2.3.2
- What to do
- Update WP Hotel Booking to 2.3.2 or newer.
Jul 30, 2026Sync Post With Other Site: Does not correctly enforce the page-editing capability on a REST route that creates and updates postsCVE-2026-14923 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.
- Product
- Sync Post With Other Site
- Fixed in
- 1.9.3
- What to do
- Update Sync Post With Other Site to 1.9.3 or newer.
Jul 30, 2026WP Real IP-based Access Control: Does not perform any capability or nonce checks before storing one of its option valuesCVE-2026-14592 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.
- Product
- WP Real IP-based Access Control
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WP Real IP-based Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2026GiveWP: Does not escape a donation-form template setting before outputting it in an HTML attributeCVE-2026-14318 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.
- Product
- GiveWP
- Fixed in
- 4.16.3
- What to do
- Update GiveWP to 4.16.3 or newer.
Jul 30, 2026LifterLMS: Does not perform a capability check in one of its select2 query AJAX handlersCVE-2026-14231 · WordPress plugins & themes · reported by WPScanMedium 4.3
The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.
- Product
- LifterLMS
- Fixed in
- 10.0.10
- What to do
- Update LifterLMS to 10.0.10 or newer.
Jul 30, 2026Easy Appointments: Does not require a sufficient capability on one of its appointment-listing REST endpointsCVE-2026-14226 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.
- Product
- Easy Appointments
- Fixed in
- 3.12.28
- What to do
- Update Easy Appointments to 3.12.28 or newer.
Jul 30, 2026Easy Appointments: Does not verify ownership or capabilityCVE-2026-14223 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.
- Product
- Easy Appointments
- Fixed in
- 3.12.28
- What to do
- Update Easy Appointments to 3.12.28 or newer.
Jul 30, 2026Easy Appointments: Does not perform any capability or nonce check in one of its connection-deletion actionsCVE-2026-14222 · WordPress plugins & themes · reported by WPScanLow 3.8
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.
- Product
- Easy Appointments
- Fixed in
- 3.12.28
- What to do
- Update Easy Appointments to 3.12.28 or newer.
Jul 30, 2026Easy Appointments: Does not perform capability checks in several of its appointment-management actionsCVE-2026-14221 · WordPress plugins & themes · reported by WPScanLow 3.8
The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.
- Product
- Easy Appointments
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2026Easy Appointments: Does not perform a per-request capability or nonce check on one of its customer-listing handlersCVE-2026-14188 · WordPress plugins & themes · reported by WPScanLow 2.7
The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.
- Product
- Easy Appointments
- Fixed in
- 3.12.28
- What to do
- Update Easy Appointments to 3.12.28 or newer.
Jul 30, 2026WP Travel Engine: Does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6CVE-2026-12500 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).
- Product
- WP Travel Engine
- Fixed in
- 6.8.2
- What to do
- Update WP Travel Engine to 6.8.2 or newer.
Jul 30, 2026Fluent Forms: Does not sanitise and escape one of its form field configuration settings before outputting it inside an inline scriptCVE-2026-11881 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it.
- Product
- Fluent Forms
- Fixed in
- 6.2.6
- What to do
- Update Fluent Forms to 6.2.6 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.