Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,149 results · page 14 of 43
Mar 19, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-32223 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
- Product
- Tutor LMS
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Really Simple Security Pro: Authorization Bypass Through User-Controlled KeyCVE-2026-27397 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple Security Pro: from n/a through 9.5.4.0.
- Product
- Really Simple Security Pro
- Affected
- up to 9.5.4.0
- What to do
- Affects up to 9.5.4.0. Update Really Simple Security Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 16, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Unauthorized modification of dataCVE-2026-2233 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the draft_post() function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to modify arbitrary posts (e.g. unpublish published posts and overwrite the contents) via the 'post_id' parameter.
- Product
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
- Affected
- up to 4.2.8
- What to do
- Affects up to 4.2.8. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 13, 2026Formidable Forms: An authorization bypass through user-controlled keyCVE-2026-2888 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.
- Product
- Formidable Forms
- Affected
- up to 6.28
- What to do
- Affects up to 6.28. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploitingCVE-2026-22182 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.
- Fixed in
- 7.6.47
- What to do
- Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 11, 2026Datalogics Ecommerce Delivery: Exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verificationCVE-2026-2631 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.
- Product
- Datalogics Ecommerce Delivery
- Fixed in
- 2.6.60
- What to do
- Update Datalogics Ecommerce Delivery to 2.6.60 or newer.
Mar 6, 2026ProfileGrid – User Profiles, Groups and Communities: Cross-Site Request ForgeryCVE-2026-2494 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.8.2. This is due to missing nonce validation on the membership request management page (approve and decline actions). This makes it possible for unauthenticated attackers to approve or deny group membership requests via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ProfileGrid – User Profiles, Groups and Communities
- Affected
- up to 5.9.8.2
- What to do
- Affects up to 5.9.8.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2026ProfileGrid – User Profiles, Groups and Communities: Unauthorized message deletionCVE-2026-2488 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message deletion due to a missing capability check on the pg_delete_msg() function in all versions up to, and including, 5.9.8.1. This is due to the function not verifying that the requesting user has permission to delete the targeted message. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary messages belonging to any user by sending a direct request with a valid message ID (mid parameter).
- Product
- ProfileGrid – User Profiles, Groups and Communities
- Affected
- up to 5.9.8.1
- What to do
- Affects up to 5.9.8.1. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2026The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a loggedCVE-2026-3589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddeveloper.woocommerce.comwpscan.com
Mar 5, 2026Login with Salesforce: Does not validate that users are allowed to login through SalesforceCVE-2026-2418 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
- Product
- Login with Salesforce
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Login with Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2026-1492 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 28, 2026wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the gCVE-2026-28559 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Feb 28, 2026wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpfoCVE-2026-28557 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Feb 28, 2026Super Stage WP: Unserializes user input via REQUESTCVE-2026-1542 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Super Stage WP WordPress plugin through 1.0.1 unserializes user input via REQUEST, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
- Product
- Super Stage WP
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Super Stage WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 26, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Arbitrary file uploadsCVE-2026-1565 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WPUF_Admin_Settings::check_filetype_and_ext' function and in the 'Admin_Tools::check_filetype_and_ext' function in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
- Affected
- up to 4.2.8
- What to do
- Affects up to 4.2.8. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 25, 2026User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2026-2356 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'register_member' function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that newly registered on the site who has the 'urm_user_just_created' user meta set.
- Product
- User Registration & Membership – Custom Registration Form, Login Form, and User Profile
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 25, 2026User Registration & Membership: Authentication bypassCVE-2026-1779 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthenticated attackers to log in a newly registered user on the site who has the 'urm_user_just_created' user meta set.
- Product
- User Registration & Membership
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update User Registration & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 22, 2026Conditional CAPTCHA: Does not validate a parameter before redirecting the user to its valueCVE-2026-1369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
- Product
- Conditional CAPTCHA
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Conditional CAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Authorsy: Authorization Bypass Through User-Controlled KeyCVE-2026-24950 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in themeplugs Authorsy authorsy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Authorsy: from n/a through <= 1.0.6.
- Product
- Authorsy
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Authorsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026PawFriends - Pet Shop and Veterinary: Authorization Bypass Through User-Controlled KeyCVE-2026-22383 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through <= 1.3.
- Product
- PawFriends - Pet Shop and Veterinary
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update PawFriends - Pet Shop and Veterinary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Cnvrse: Authorization Bypass Through User-Controlled KeyCVE-2025-69394 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in cnvrse Cnvrse cnvrse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cnvrse: from n/a through < 026.02.10.20.
- Product
- Cnvrse
- What to do
- Update Cnvrse to the newest version.
Feb 20, 2026User Extra Fields: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69377 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- Product
- User Extra Fields
- Affected
- up to 17.0
- What to do
- Affects up to 17.0. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026User Extra Fields: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69376 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Path Traversal.This issue affects User Extra Fields: from n/a through <= 17.0.
- Product
- User Extra Fields
- Affected
- up to 17.0
- What to do
- Affects up to 17.0. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026New User Approve: Missing AuthorizationCVE-2025-69063 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.0.
- Product
- New User Approve
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Paid Member Subscriptions: Authorization Bypass Through User-Controlled KeyCVE-2025-68514 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.16.8.
- Product
- Paid Member Subscriptions
- Affected
- up to 2.16.8
- What to do
- Affects up to 2.16.8. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Shiprocket: Authorization Bypass Through User-Controlled KeyCVE-2025-68051 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through <= 2.0.8.
- Product
- Shiprocket
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Shiprocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026Open User Map: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-68002 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.This issue affects Open User Map: from n/a through <= 1.4.16.
- Product
- Open User Map
- Affected
- up to 1.4.16
- What to do
- Affects up to 1.4.16. Update Open User Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 20, 2026User Extra Fields: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67991 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Reflected XSS.This issue affects User Extra Fields: from n/a through <= 16.8.
- Product
- User Extra Fields
- Affected
- up to 16.8
- What to do
- Affects up to 16.8. Update User Extra Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Quiz And Survey Master: Authorization Bypass Through User-Controlled KeyCVE-2026-25324 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.
- Product
- Quiz And Survey Master
- Affected
- up to 10.3.4
- What to do
- Affects up to 10.3.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Frontend File Manager: Authorization Bypass Through User-Controlled KeyCVE-2026-25005 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.5.
- Product
- Frontend File Manager
- Affected
- up to 23.5
- What to do
- Affects up to 23.5. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches: Unauthorized modification of dataCVE-2025-14427 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `MfaEmailDisable` action in all versions up to, and including, 21.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the global Email 2FA setting for the entire site.
- Product
- Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches
- Affected
- up to 21.0.9
- What to do
- Affects up to 21.0.9. Update Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 19, 2026The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and inCVE-2025-13851 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role during registration via the REST API endpoint. This makes it possible for unauthenticated attackers to register accounts with arbitrary roles, including administrator, by manipulating the _buyent_classified_user_type parameter during the registration process, granting them complete control over the WordPress site.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 19, 2026Breadcrumb NavXT: Authorization bypass through user-controlled keyCVE-2025-13842 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $_REQUEST['post_id'] parameter without verification in the includes/blocks/build/breadcrumb-trail/render.php file. This makes it possible for unauthenticated attackers to enumerate and view breadcrumb trails for draft or private posts by manipulating the post_id parameter, revealing post titles and hierarchy that should remain hidden.
- Product
- Breadcrumb NavXT
- Affected
- up to 7.5.0
- What to do
- Affects up to 7.5.0. Update Breadcrumb NavXT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Reflected Cross-Site ScriptingCVE-2026-1404 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter parameters (e.g., 'filter_first_name') in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.11.1
- What to do
- Affects up to 2.11.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Payment bypassCVE-2025-14444 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the payment actually went through PayPal. This makes it possible for unauthenticated attackers to bypass paid registration by manipulating payment status and activating their account without completing a real PayPal payment.
- Product
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- Affected
- up to 6.0.6.9
- What to do
- Affects up to 6.0.6.9. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026User Submitted Posts – Enable Users to Submit Posts from the Front End: Incorrect AuthorizationCVE-2026-2126 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the `usp_get_submitted_category()` function accepting user-submitted category IDs from the POST body without validating them against the admin-configured allowed categories stored in `usp_options['categories']`. This makes it possible for unauthenticated attackers to assign submitted posts to arbitrary categories, including restricted ones, by crafting a direct POST request with manipulated `user-submitted-category[]` values, bypassing the frontend category restrictions.
- Product
- User Submitted Posts – Enable Users to Submit Posts from the Front End
- Affected
- up to 20260113
- What to do
- Affects up to 20260113. Update User Submitted Posts – Enable Users to Submit Posts from the Front End to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026Frontend User Notes: Insecure Direct Object ReferenceCVE-2025-12071 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funp_ajax_modify_notes' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary notes that do not belong to them.
- Product
- Frontend User Notes
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Frontend User Notes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 17, 2026Frontend File Manager: Allows unauthenticated users to send emails through the site without any security checksCVE-2026-0829 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing emails to anyone. Attackers can also guess file IDs to access and share uploaded files without permission, exposing sensitive information.
- Product
- Frontend File Manager
- Affected
- up to 23.5
- What to do
- Affects up to 23.5. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2026User Language Switch: Server-Side Request ForgeryCVE-2026-0745 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the 'download_language()' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- User Language Switch
- Affected
- up to 1.6.10
- What to do
- Affects up to 1.6.10. Update User Language Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2026User Language Switch: Stored Cross-Site ScriptingCVE-2026-0735 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The User Language Switch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_color_picker_language_switch' parameter in all versions up to, and including, 1.6.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- User Language Switch
- Affected
- up to 1.6.10
- What to do
- Affects up to 1.6.10. Update User Language Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2026One to one user Chat by WPGuppy: Unauthorized access of dataCVE-2025-6792 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppylite/v2/channel-authorize rest endpoint in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to intercept and view private chat messages between users.
- Product
- One to one user Chat by WPGuppy
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update One to one user Chat by WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Feb 11, 2026WP eCommerce: Unserializes user input via ajax actionsCVE-2026-1235 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
- Product
- WP eCommerce
- Affected
- up to 3.15.1
- What to do
- Affects up to 3.15.1. Update WP eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2026OpenPix for WooCommerce: Allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checksCVE-2025-15400 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality.
- Product
- OpenPix for WooCommerce
- Affected
- up to 2.13.3
- What to do
- Affects up to 2.13.3. Update OpenPix for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 5, 2026ProfileGrid – User Profiles, Groups and Communities: Insecure Direct Object ReferenceCVE-2026-1271 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the 'pm_upload_image' and 'pm_upload_cover_image' AJAX actions. This is due to the update_user_meta() function being called outside of the user authorization check in public/partials/crop.php and public/partials/coverimg_crop.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change any user's profile picture or cover image, including administrators.
- Product
- ProfileGrid – User Profiles, Groups and Communities
- Affected
- up to 5.9.7.2
- What to do
- Affects up to 5.9.7.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 5, 2026ProfileGrid – User Profiles, Groups and Communities: Unauthorized user suspensionCVE-2025-13416 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing capability check on the pm_deactivate_user_from_group() function in all versions up to, and including, 5.9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to suspend arbitrary users from groups, including administrators, via the pm_deactivate_user_from_group AJAX action.
- Product
- ProfileGrid – User Profiles, Groups and Communities
- Affected
- up to 5.9.7.2
- What to do
- Affects up to 5.9.7.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026UsersWP: Cross-Site Request Forgery (CSRF)CVE-2026-25015 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.53.
- Product
- UsersWP
- Affected
- up to 1.2.53
- What to do
- Affects up to 1.2.53. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Extensions For CF7: Authorization Bypass Through User-Controlled KeyCVE-2026-24991 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.
- Product
- Extensions For CF7
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Extensions For CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2026Simple Membership WP user Import: Cross-Site Request Forgery (CSRF)CVE-2026-24986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wp.insider Simple Membership WP user Import simple-membership-wp-user-import allows Cross Site Request Forgery.This issue affects Simple Membership WP user Import: from n/a through <= 1.9.1.
- Product
- Simple Membership WP user Import
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Simple Membership WP user Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 2, 2026User Profile Builder: Does not have a proper password reset processCVE-2025-15030 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
- Product
- User Profile Builder
- Fixed in
- 3.15.2
- What to do
- Update User Profile Builder to 3.15.2 or newer.
Jan 28, 2026Simple User Registration: Privilege escalationCVE-2026-0844 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
- Product
- Simple User Registration
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.