Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

495new WordPress flaws this week

393,009entries in the database

24,280 results · page 122 of 486

Mar 25, 2026Product Slider for WooCommerce: Missing AuthorizationCVE-2026-25455 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.61.
Product
Product Slider for WooCommerce
Affected
up to 1.13.61
What to do
Affects up to 1.13.61. Update Product Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026The League: Missing AuthorizationCVE-2026-25454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through <= 4.4.1.
Product
The League
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update The League to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Remoji: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25452 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDO Remoji remoji allows Stored XSS.This issue affects Remoji: from n/a through <= 2.2.
Product
Remoji
Affected
up to 2.2
What to do
Affects up to 2.2. Update Remoji to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Widget Wrangler: Improper Control of Generation of Code ('Code Injection')CVE-2026-25447 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through <= 2.3.9.
Product
Widget Wrangler
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update Widget Wrangler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026GZSEO: Missing AuthorizationCVE-2026-25437 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in سید محمدامین هاشمی GZSEO gzseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GZSEO: from n/a through <= 2.0.14.
Product
GZSEO
Affected
up to 2.0.14
What to do
Affects up to 2.0.14. Update GZSEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Booking calendar, Appointment Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.
Product
Booking calendar, Appointment Booking System
Affected
up to 3.2.36
What to do
Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: Missing AuthorizationCVE-2026-25430 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.2.2.
Product
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Nexa Blocks: Deserialization of Untrusted DataCVE-2026-25429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
Product
Nexa Blocks
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Nexa Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026ProfileGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25417 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.
Product
ProfileGrid
Affected
up to 5.9.8.1
What to do
Affects up to 5.9.8.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Tutor LMS Pro: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25406 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.
Product
Tutor LMS Pro
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WPCargo Track & Trace: Missing AuthorizationCVE-2026-25401 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
Product
WPCargo Track & Trace
Affected
up to 8.0.2
What to do
Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Apicona: Deserialization of Untrusted DataCVE-2026-25400 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
Product
Apicona
Affected
up to 24.1.0
What to do
Affects up to 24.1.0. Update Apicona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Vertex Addons for Elementor: Missing AuthorizationCVE-2026-25398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.
Product
Vertex Addons for Elementor
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Vertex Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Commerce Coinbase For WooCommerce: Missing AuthorizationCVE-2026-25396 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.
Product
Commerce Coinbase For WooCommerce
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Commerce Coinbase For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026New User Approve: Missing AuthorizationCVE-2026-25390 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.3.
Product
New User Approve
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026KiviCare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25383 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.
Product
KiviCare
Affected
up to 3.6.16
What to do
Affects up to 3.6.16. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026IdealAuto: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25382 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes IdealAuto idealauto allows PHP Local File Inclusion.This issue affects IdealAuto: from n/a through < 3.8.6.
Product
IdealAuto
What to do
Update IdealAuto to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026LoveDate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25381 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes LoveDate lovedate allows PHP Local File Inclusion.This issue affects LoveDate: from n/a through < 3.8.6.
Product
LoveDate
What to do
Update LoveDate to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Feedy: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25380 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Feedy feedy allows PHP Local File Inclusion.This issue affects Feedy: from n/a through < 2.1.5.
Product
Feedy
What to do
Update Feedy to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026StreamVid: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25379 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes StreamVid streamvid allows PHP Local File Inclusion.This issue affects StreamVid: from n/a through < 6.8.6.
Product
StreamVid
What to do
Update StreamVid to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Addon Jobsearch Chat: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25377 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows SQL Injection.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.
Product
Addon Jobsearch Chat
Affected
up to 3.0
What to do
Affects up to 3.0. Update Addon Jobsearch Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Addon Jobsearch Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows Reflected XSS.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.
Product
Addon Jobsearch Chat
Affected
up to 3.0
What to do
Affects up to 3.0. Update Addon Jobsearch Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Vayvo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25373 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProgressionStudios Vayvo vayvo-progression allows Reflected XSS.This issue affects Vayvo: from n/a through < 6.8.
Product
Vayvo
What to do
Update Vayvo to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Lumise Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25371 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.
Product
Lumise Product Designer
What to do
Update Lumise Product Designer to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Woody ad snippets: Improper Control of Generation of Code ('Code Injection')CVE-2026-25366 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.
Product
Woody ad snippets
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Kargo Takip: Missing AuthorizationCVE-2026-25365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.
Product
Kargo Takip
What to do
Update Kargo Takip to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WpEvently: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25361 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.
Product
WpEvently
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Vex: Deserialization of Untrusted DataCVE-2026-25360 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
Product
Vex
What to do
Update Vex to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Pendulum: Deserialization of Untrusted DataCVE-2026-25359 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.
Product
Pendulum
What to do
Update Pendulum to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Meloo: Deserialization of Untrusted DataCVE-2026-25358 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
Product
Meloo
What to do
Update Meloo to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Ultimate Membership Pro: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25357 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro allows Authentication Abuse.This issue affects Ultimate Membership Pro: from n/a through <= 13.7.
Product
Ultimate Membership Pro
Affected
up to 13.7
What to do
Affects up to 13.7. Update Ultimate Membership Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Yobazar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25356 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through < 1.6.7.
Product
Yobazar
What to do
Update Yobazar to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Sanzo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25355 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through < 2.4.3.
Product
Sanzo
What to do
Update Sanzo to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Reebox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25354 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through < 1.4.8.
Product
Reebox
What to do
Update Reebox to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Nooni: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25353 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through < 1.5.1.
Product
Nooni
What to do
Update Nooni to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026MyDecor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through < 1.5.9.
Product
MyDecor
What to do
Update MyDecor to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026MyMedi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyMedi mymedi allows Reflected XSS.This issue affects MyMedi: from n/a through < 1.7.7.
Product
MyMedi
What to do
Update MyMedi to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Miti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25350 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through < 1.5.3.
Product
Miti
What to do
Update Miti to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Loobek: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25349 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Loobek loobek allows Reflected XSS.This issue affects Loobek: from n/a through < 1.5.2.
Product
Loobek
What to do
Update Loobek to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WP REST Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25347 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acato WP REST Cache wp-rest-cache allows Stored XSS.This issue affects WP REST Cache: from n/a through <= 2026.1.0.
Product
WP REST Cache
Affected
up to 2026.1.0
What to do
Affects up to 2026.1.0. Update WP REST Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026FAQ Builder AYS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAQ Builder AYS: from n/a through <= 1.8.2.
Product
FAQ Builder AYS
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update FAQ Builder AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026SimpLy Gallery: Improper Validation of Specified Quantity in InputCVE-2026-25345 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Validation of Specified Quantity in Input vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.
Product
SimpLy Gallery
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update SimpLy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Review Schema: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25344 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.
Product
Review Schema
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update Review Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Boutique: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kutethemes Boutique kute-boutique allows Reflected XSS.This issue affects Boutique: from n/a through < 2.4.6.
Product
Boutique
What to do
Update Boutique to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026RSFirewall!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through <= 1.1.45.
Product
RSFirewall!
Affected
up to 1.1.45
What to do
Affects up to 1.1.45. Update RSFirewall! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Jobmonster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25340 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.
Product
Jobmonster
What to do
Update Jobmonster to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Contact Form by WPForms: Insertion of Sensitive Information Into Sent DataCVE-2026-25339 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.
Product
Contact Form by WPForms
Affected
up to 1.9.8.7
What to do
Affects up to 1.9.8.7. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Product File Upload for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-25328 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: from n/a through <= 2.2.4.
Product
Product File Upload for WooCommerce
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Product File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Five Star Restaurant Reservations: Missing AuthorizationCVE-2026-25327 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.9.
Product
Five Star Restaurant Reservations
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-25317 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.9.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.