Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

4,135 results · page 11 of 83

Aug 28, 2026WCFM Marketplace: Does not correctly verify that the person requesting a refund owns the orderCVE-2026-77701 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.
Product
WCFM Marketplace
Fixed in
3.8.2
What to do
Update WCFM Marketplace to 3.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026shared-files-pro: Does not validate the file path suppliedCVE-2026-19084 · WordPress plugins & themes · reported by WPScanHigh 7.5
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.
Product
shared-files-pro
Fixed in
1.7.70
What to do
Update shared-files-pro to 1.7.70 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not perform a capability check in their file-upload handlerCVE-2026-12514 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
Product
Shared Files WordPress plugin before 1.7.67, shared-files-pro
Fixed in
1.7.67
What to do
Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassableCVE-2026-12513 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
Product
Shared Files WordPress plugin before 1.7.67, shared-files-pro
Fixed in
1.7.67
What to do
Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.CVE-2026-78292 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2026Notifima: Does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up toCVE-2026-78139 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.
Product
Notifima
Affected
up to 3.1.3
Fixed in
3.1.4
What to do
Update Notifima to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Finale Lite: Does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post IDCVE-2026-78138 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.
Product
Finale Lite
Fixed in
2.21.0
What to do
Update Finale Lite to 2.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026UpdraftPlus: WP Backup & Migration: Does not have CSRF checks in one of its backup management actionsCVE-2026-76549 · WordPress plugins & themes · reported by WPScanMedium 5.9
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.
Product
UpdraftPlus: WP Backup & Migration
Fixed in
1.26.7
What to do
Update UpdraftPlus: WP Backup & Migration to 1.26.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce: Does not verify that the requesting user owns the customer profile being queried through one of its REST endpointsCVE-2026-16568 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.
Product
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
Affected
up to 0.4.62
What to do
Affects up to 0.4.62. Update Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026CMP: Does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others)CVE-2026-13414 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.
Product
CMP
Fixed in
4.1.18
What to do
Update CMP to 4.1.18 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Formidable Charts: Directory TraversalCVE-2026-15990 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active and requires the wp-content/uploads/frm-charts/ directory to exist, normally after an image-format chart is rendered.
Product
Formidable Charts
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Formidable Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record formidableforms.com wordfence.com
Aug 26, 2026Simple Newsletter: Does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored detailsCVE-2026-78146 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises changes to their record.
Product
Simple Newsletter
Fixed in
4.3.3
What to do
Update Simple Newsletter to 4.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Stripe Payment Forms by WP Full Pay: Does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on itCVE-2026-77789 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.
Product
Stripe Payment Forms by WP Full Pay
Fixed in
8.5.1
What to do
Update Stripe Payment Forms by WP Full Pay to 8.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Stripe Payment Forms by WP Full Pay: Does not properly verify that a customer portal session has completed its confirmation step before returning dataCVE-2026-77758 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.
Product
Stripe Payment Forms by WP Full Pay
Fixed in
8.5.1
What to do
Update Stripe Payment Forms by WP Full Pay to 8.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Return Refund and Exchange For WooCommerce: Does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated usersCVE-2026-77695 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
Product
Return Refund and Exchange For WooCommerce
Fixed in
4.6.4
What to do
Update Return Refund and Exchange For WooCommerce to 4.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Project Manager: Does not check that the user whose activity is being requested is the one making the request in one of its REST API routesCVE-2026-74930 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
Product
Project Manager
Fixed in
4.0.7
What to do
Update Project Manager to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Project Manager: Does not have any authorisation check on its import routesCVE-2026-74928 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
Product
Project Manager
Fixed in
4.0.7
What to do
Update Project Manager to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Forminator Forms: Does not verify that site registration is enabled on the network before creating a site signupCVE-2026-19220 · WordPress plugins & themes · reported by WPScanLow 3.7
The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.
Product
Forminator Forms
Fixed in
1.57.1
What to do
Update Forminator Forms to 1.57.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates: Does not include an authorization check on a REST route that returns stored account dataCVE-2026-16984 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secret and account details, which can then be used to disconnect the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1's integration.
Product
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates
Fixed in
3.7.1
What to do
Update Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) owns the provider account being updatedCVE-2026-14212 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
Product
Booking for Appointments and Events Calendar
Fixed in
9.8
What to do
Update Booking for Appointments and Events Calendar to 9.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026CM Map Locations – Visualize and share your locations in a few clicks: Limited Arbitrary File UploadCVE-2026-16601 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.
Product
CM Map Locations – Visualize and share your locations in a few clicks
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update CM Map Locations – Visualize and share your locations in a few clicks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.CVE-2026-78268 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.CVE-2026-32560 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.CVE-2026-78280 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.CVE-2026-78269 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.
Affected
up to 1.7.69
What to do
Affects up to 1.7.69. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.CVE-2026-66623 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
Affected
up to 2.9.9
What to do
Affects up to 2.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2026Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5.CVE-2026-77116 · WordPress plugins & themes · reported by WPScanMedium 4.3
Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.
Affected
up to 0.8.5
What to do
Affects up to 0.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 22, 2026Security Hardener: Missing AuthorizationCVE-2026-16149 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest_endpoints filter via secure_user_endpoints() and overwrites every registered handler's permission_callback on both the /wp/v2/users and /wp/v2/users/(?P<id>[\d]+) routes — including POST, PUT, PATCH, and DELETE handlers — with a bare closure that returns only is_user_logged_in(), completely stripping WordPress Core's original capability checks such as create_users, promote_user, edit_users, and delete_users that WP_REST_Users_Controller normally enforces. This makes it possible for authenticated attackers with Subscriber-level access and above to create new Administrator accounts by sending POST request to /wp/v2/users with administrator role, or to reset an existing Administrator's password by issuing a PUT/POST request to /wp/v2/users/<id>. Because the block_user_enum option defaults to enabled, no special plugin configuration is required — the overwrite is active on every request as soon as the plugin is installed.
Product
Security Hardener
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Security Hardener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026Social Login & Sharing buttons with Analytics By SoClever: Does not perform any authenticationCVE-2026-77001 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.
Product
Social Login & Sharing buttons with Analytics By SoClever
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Social Login & Sharing buttons with Analytics By SoClever to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 22, 2026WP Social Media Login: Does not verify that a social login was actually completed with the identity provider before authenticating a visitorCVE-2026-77000 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
Product
WP Social Media Login
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WP Social Media Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 22, 2026Slider Hero with Video Background, Animation: Does not have authorisation and nonce checks on two of its request handlersCVE-2026-76789 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the Slider Hero with Video Background, Animation WordPress plugin before 9.1.3's admin area, as well as any visitor of a page embedding a slider.
Product
Slider Hero with Video Background, Animation
Fixed in
9.1.3
What to do
Update Slider Hero with Video Background, Animation to 9.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026WPeMatico RSS Feed Fetcher: Unauthorized modification of data that can lead to privilege escalationCVE-2026-19883 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
Product
WPeMatico RSS Feed Fetcher
Affected
up to 2.8.24
What to do
Affects up to 2.8.24. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 21, 2026Charitable: Does not verify the authenticity of incoming Square payment webhook events in a default configurationCVE-2026-16650 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.
Product
Charitable
Fixed in
1.8.12
What to do
Update Charitable to 1.8.12 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026myCred: Does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant accountCVE-2026-15150 · WordPress plugins & themes · reported by WPScanMedium 5.3
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.
Product
myCred
Fixed in
3.2.5
What to do
Update myCred to 3.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026LitExtension: Does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication tokenCVE-2026-15046 · WordPress plugins & themes · reported by WPScanMedium 4.2
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
Product
LitExtension
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update LitExtension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026AI Engine: Does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operationsCVE-2026-75796 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.
Product
AI Engine
Fixed in
3.6.1
What to do
Update AI Engine to 3.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026Duplicate Post: Does not check that a user may read the content of a post before duplicating itCVE-2026-19085 · WordPress plugins & themes · reported by WPScanLow 2.7
The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.
Product
Duplicate Post
Fixed in
1.5.6
What to do
Update Duplicate Post to 1.5.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026Drag and Drop Multiple File Upload for Contact Form 7: Does not validate the final name of an uploaded file after stripping characters from itCVE-2026-18781 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.
Product
Drag and Drop Multiple File Upload for Contact Form 7
Fixed in
1.3.9.9
What to do
Update Drag and Drop Multiple File Upload for Contact Form 7 to 1.3.9.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 21, 2026Media Library Assistant: Does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlersCVE-2026-16959 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.
Product
Media Library Assistant
Fixed in
3.40
What to do
Update Media Library Assistant to 3.40 or newer.
Full record and what to do →NVD record wpscan.com
Aug 20, 2026Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.CVE-2026-74021 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
Affected
up to 2.6.8
What to do
Affects up to 2.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026JSON Options: Does not have any capability check or nonce verification on one of its actionsCVE-2026-75860 · WordPress plugins & themes · reported by WPScanCritical 9.8
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.
Product
JSON Options
Affected
up to 0.0.4
What to do
Affects up to 0.0.4. Update JSON Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 20, 2026GutenKit: Does not have a sufficient capability check on some of its REST API endpointsCVE-2026-19699 · WordPress plugins & themes · reported by WPScanLow 2.7
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.
Product
GutenKit
Fixed in
2.5.0
What to do
Update GutenKit to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 20, 2026Admin and Site Enhancements (ASE): Does not sanitise uploaded SVG files on every route it accepts them throughCVE-2026-19615 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.
Product
Admin and Site Enhancements (ASE)
Fixed in
9.0.1
What to do
Update Admin and Site Enhancements (ASE) to 9.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 20, 2026Royal Addons for Elementor: Does not correctly sanitise custom widget markup before writing it to a file that is later executedCVE-2026-13405 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
Product
Royal Addons for Elementor
Fixed in
1.7.1066
What to do
Update Royal Addons for Elementor to 1.7.1066 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode.CVE-2026-64851 · WordPress plugins & themes · reported by GitHubHigh 8.5
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
Fixed in
6.2.2
What to do
Update the plugin to 6.2.2 or newer.
Full record and what to do →NVD record github.com github.com
Aug 19, 2026WPS Bidouille: Does not have proper authorisation checks in an AJAX actionCVE-2026-19782 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.
Product
WPS Bidouille
Fixed in
1.33.5
What to do
Update WPS Bidouille to 1.33.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Membership For WooCommerce: Does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a requestCVE-2026-19709 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.
Product
Membership For WooCommerce
Fixed in
3.1.2
What to do
Update Membership For WooCommerce to 3.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026KiviCare: Does not verify that the requesting user is entitled to the media file being servedCVE-2026-19417 · WordPress plugins & themes · reported by WPScanMedium 6.5
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.
Product
KiviCare
Fixed in
4.5.4
What to do
Update KiviCare to 4.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026KiviCare: Does not verify that the requesting user owns the appointment being modifiedCVE-2026-19416 · WordPress plugins & themes · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
Product
KiviCare
Fixed in
4.5.4
What to do
Update KiviCare to 4.5.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18779 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
Product
TrueBooker
Fixed in
1.2.7
What to do
Update TrueBooker to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.