Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,807 results · page 12 of 77
Jun 26, 2026Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.CVE-2026-56066 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.CVE-2026-56059 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.CVE-2026-56058 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.CVE-2026-56027 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.CVE-2025-68064 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.CVE-2025-68063 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.
- Affected
- up to 4.4.3
- What to do
- Affects up to 4.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-1869 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 26, 2026Frontend File Manager: Does not properly verify ownership of every targeted post before permanent deletionCVE-2026-8380 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026OMGF Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-57700 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6.
- Product
- OMGF Pro
- Affected
- up to 5.2.6
- What to do
- Affects up to 5.2.6. Update OMGF Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.CVE-2026-56054 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.CVE-2026-54845 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 23, 2026ProfileGrid – User Profiles, Groups and Communities: Stored Cross-Site ScriptingCVE-2026-4610 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.
- Product
- ProfileGrid – User Profiles, Groups and Communities
- Affected
- up to 5.9.9.2
- What to do
- Affects up to 5.9.9.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 23, 2026Frontend File Manager: Does not properly enforce its nonce check on the file download handlerCVE-2026-8379 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 23, 2026Frontend File Manager: Does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing itCVE-2026-8378 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2026Simple File List: Unauthorized file operationsCVE-2026-12119 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that bypass the intended authorization checks in includes/ee-list-ops-bar-process.php.
- Product
- Simple File List
- Affected
- up to 6.3.7
- What to do
- Affects up to 6.3.7. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2026Simple File List: Arbitrary file modificationCVE-2026-11912 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated.
- Product
- Simple File List
- Affected
- up to 6.3.7
- What to do
- Affects up to 6.3.7. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 20, 2026Simple File List: Arbitrary file deletionCVE-2026-11911 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns true for requests to the admin-ajax.php endpoint.
- Product
- Simple File List
- Affected
- up to 6.3.7
- What to do
- Affects up to 6.3.7. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2026Database for Contact Form 7, WPforms, Elementor forms: Arbitrary file deletionCVE-2026-9843 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.
- Product
- Database for Contact Form 7, WPforms, Elementor forms
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2026Avada (Fusion) Builder: Arbitrary file deletionCVE-2026-8713 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The attack requires a published Avada form configured to save entries to the database; an unauthenticated attacker submits a path-traversal payload via the wp_ajax_nopriv_fusion_form_submit_ajax handler while also controlling the fusion_privacy_expiration_interval and privacy_expiration_action fields to force an immediate 'delete' cleanup, causing the planted entry to be automatically processed by the Fusion_Form_DB_Privacy shutdown-hook routine without any administrator interaction.
- Product
- Avada (Fusion) Builder
- Affected
- up to 3.15.3
- What to do
- Affects up to 3.15.3. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 19, 2026Royal Addons for Elementor – Addons and Templates Kit for Elementor: Arbitrary File ReadCVE-2026-8118 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through 1.7.1059. This is due to the wpr_get_csv_handle() helper (introduced in version 1.7.1058 as part of the patch for CVE-2026-6229) falling back to is_readable() and fopen($source, 'r') on the attacker-controlled settings.table_upload_csv.url value when it does not parse as an HTTP URL, with no allow-list, traversal block, or extension check. This makes it possible for authenticated attackers, with Contributor-level access and above, to save a crafted wpr-data-table widget through Elementor's save_builder endpoint and have the rendered preview return the line-by-line contents of any file readable by the PHP process, including wp-config.php.
- Product
- Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Affected
- up to 1.7.1059
- What to do
- Affects up to 1.7.1059. Update Royal Addons for Elementor – Addons and Templates Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 19, 2026Woosa – Marktplaats for WooCommerce: Arbitrary File ReadCVE-2026-7547 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Woosa – Marktplaats for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in versions up to and including 2.0.4. This is due to insufficient path sanitization in the render_logs_ui() function, which accepts a base64-encoded file name from the 'log_file' GET parameter and concatenates it directly with the plugin's log directory path without validating that the resolved path remains within the intended directory. This makes it possible for authenticated attackers, with Administrator-level access, to read the contents of arbitrary files on the server, including wp-config.
- Product
- Woosa – Marktplaats for WooCommerce
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Woosa – Marktplaats for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2026BetterDocs Pro: Local File InclusionCVE-2026-7515 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- Product
- BetterDocs Pro
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update BetterDocs Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbetterdocs.cobetterdocs.co
Jun 18, 2026MagicForm: Does not properly validate the type of files uploaded through an unauthenticated AJAX actionCVE-2026-9815 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.
- Product
- MagicForm
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update MagicForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: Insecure Direct Object ReferenceCVE-2026-12102 · WordPress plugins & themes · reported by WordfenceLow 2.7
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with editor-level access and above, to reset and permanently delete the avatar or banner image of any arbitrary user, including administrators, by clearing their avatar_thumb or banner_thumb metadata in the uwp_usermeta table.
- Product
- UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
- Affected
- up to 1.2.63
- What to do
- Affects up to 1.2.63. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jun 17, 2026Motors: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-54814 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.
- Product
- Motors
- Affected
- up to 1.4.109
- What to do
- Affects up to 1.4.109. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.CVE-2026-54193 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.
- Affected
- up to 3.15.4
- What to do
- Affects up to 3.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.CVE-2026-52716 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.
- Affected
- up to 1.7.11
- What to do
- Affects up to 1.7.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.CVE-2026-52707 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.CVE-2026-39590 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.
- Affected
- up to 2.4.5
- What to do
- Affects up to 2.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.CVE-2026-39559 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.CVE-2026-39523 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.CVE-2025-69175 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Etude <= 1.6 versions.CVE-2025-69174 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Etude <= 1.6 versions.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.CVE-2025-69170 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.CVE-2025-69166 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.CVE-2025-69164 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
- Affected
- up to 1.10
- What to do
- Affects up to 1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Granola <= 1.13 versions.CVE-2025-69158 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Granola <= 1.13 versions.
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.CVE-2025-69157 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.
- Affected
- up to 1.15
- What to do
- Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.CVE-2025-69144 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.
- Affected
- up to 1.10
- What to do
- Affects up to 1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.CVE-2025-69126 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.CVE-2025-69123 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.CVE-2025-69120 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.CVE-2025-69115 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.CVE-2025-69106 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.CVE-2026-9690 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.CVE-2026-52705 · WordPress plugins & themes · reported by PatchstackCritical 9
Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.CVE-2026-42385 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.
- Affected
- up to 3.15.0
- What to do
- Affects up to 3.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.CVE-2026-40749 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.CVE-2026-40748 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.
- Affected
- up to 0.5.4
- What to do
- Affects up to 0.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.CVE-2026-40747 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.