Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

24,297 results · page 146 of 486

Feb 3, 2026Atarim: Missing AuthorizationCVE-2026-25019 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.1.
Product
Atarim
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Nelio Popups: Missing AuthorizationCVE-2026-25016 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Popups: from n/a through <= 1.3.5.
Product
Nelio Popups
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Nelio Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026WP Bannerize Pro: Missing AuthorizationCVE-2026-25012 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bannerize Pro: from n/a through <= 1.11.0.
Product
WP Bannerize Pro
Affected
up to 1.11.0
What to do
Affects up to 1.11.0. Update WP Bannerize Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026WP Custom Admin Interface: Missing AuthorizationCVE-2026-25011 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.41.
Product
WP Custom Admin Interface
Affected
up to 7.41
What to do
Affects up to 7.41. Update WP Custom Admin Interface to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Share This Image: Missing AuthorizationCVE-2026-25010 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through <= 2.09.
Product
Share This Image
Affected
up to 2.09
What to do
Affects up to 2.09. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Hustle: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24998 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popup allows Retrieve Embedded Sensitive Data.This issue affects Hustle: from n/a through <= 7.8.9.2.
Product
Hustle
Affected
up to 7.8.9.2
What to do
Affects up to 7.8.9.2. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Wired Impact Volunteer Management: Missing AuthorizationCVE-2026-24997 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.8.
Product
Wired Impact Volunteer Management
Affected
up to 2.8
What to do
Affects up to 2.8. Update Wired Impact Volunteer Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026WPElemento Importer: Missing AuthorizationCVE-2026-24996 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpelemento WPElemento Importer wpelemento-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPElemento Importer: from n/a through <= 0.6.4.
Product
WPElemento Importer
Affected
up to 0.6.4
What to do
Affects up to 0.6.4. Update WPElemento Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Latest Post Shortcode: Missing AuthorizationCVE-2026-24995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through <= 14.2.0.
Product
Latest Post Shortcode
Affected
up to 14.2.0
What to do
Affects up to 14.2.0. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-24994 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.
Product
Sunshine Photo Cart
Affected
up to 3.5.7.2
What to do
Affects up to 3.5.7.2. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Advanced WooCommerce Product Sales Reporting: Insertion of Sensitive Information Into Sent DataCVE-2026-24992 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Retrieve Embedded Sensitive Data.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.2.
Product
Advanced WooCommerce Product Sales Reporting
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update Advanced WooCommerce Product Sales Reporting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Extensions For CF7: Authorization Bypass Through User-Controlled KeyCVE-2026-24991 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.
Product
Extensions For CF7
Affected
up to 3.4.0
What to do
Affects up to 3.4.0. Update Extensions For CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026WP Docs: Missing AuthorizationCVE-2026-24990 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through <= 2.2.8.
Product
WP Docs
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update WP Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026The Events Calendar Shortcode & Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Hogg The Events Calendar Shortcode & Block the-events-calendar-shortcode allows Stored XSS.This issue affects The Events Calendar Shortcode & Block: from n/a through <= 3.1.1.
Product
The Events Calendar Shortcode & Block
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update The Events Calendar Shortcode & Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026WP Forms Signature Contract Add-On: Missing AuthorizationCVE-2026-24985 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Forms Signature Contract Add-On: from n/a through <= 1.8.2.
Product
WP Forms Signature Contract Add-On
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update WP Forms Signature Contract Add-On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Visual Link Preview: Missing AuthorizationCVE-2026-24984 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Brecht Visual Link Preview visual-link-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Link Preview: from n/a through <= 2.2.9.
Product
Visual Link Preview
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update Visual Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Spectra: Missing AuthorizationCVE-2026-24982 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.17.
Product
Spectra
Affected
up to 2.19.17
What to do
Affects up to 2.19.17. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Amelia: Missing AuthorizationCVE-2026-24967 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.38.
Product
Amelia
Affected
up to 1.2.38
What to do
Affects up to 1.2.38. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Contest Gallery: Missing AuthorizationCVE-2026-24965 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contest Gallery: from n/a through <= 28.1.1.
Product
Contest Gallery
Affected
up to 28.1.1
What to do
Affects up to 28.1.1. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24958 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12.2.
Product
JetElements For Elementor
Affected
up to 2.7.12.2
What to do
Affects up to 2.7.12.2. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Strong Testimonials: Missing AuthorizationCVE-2026-24957 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through <= 3.2.20.
Product
Strong Testimonials
Affected
up to 3.2.20
What to do
Affects up to 3.2.20. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026WpEvently: Deserialization of Untrusted DataCVE-2026-24954 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.
Product
WpEvently
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Seriously Simple Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24952 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.1.
Product
Seriously Simple Podcasting
Affected
up to 3.14.1
What to do
Affects up to 3.14.1. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026myCred: Missing AuthorizationCVE-2026-24951 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.7.3.
Product
myCred
Affected
up to 2.9.7.3
What to do
Affects up to 2.9.7.3. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2026-24947 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through < 1.5.6.3.
Product
LA-Studio Element Kit for Elementor
What to do
Update LA-Studio Element Kit for Elementor to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Ultimate Addons for Contact Form 7: Missing AuthorizationCVE-2026-24945 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.5.34.
Product
Ultimate Addons for Contact Form 7
Affected
up to 3.5.34
What to do
Affects up to 3.5.34. Update Ultimate Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Travelfic Toolkit: Missing AuthorizationCVE-2026-24940 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelfic Toolkit: from n/a through <= 1.3.3.
Product
Travelfic Toolkit
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Travelfic Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Modula Image Gallery: Missing AuthorizationCVE-2026-24939 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modula Image Gallery: from n/a through <= 2.13.6.
Product
Modula Image Gallery
Affected
up to 2.13.6
What to do
Affects up to 2.13.6. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Better Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24938 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows Stored XSS.This issue affects Better Search: from n/a through <= 4.2.1.
Product
Better Search
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 3, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object References (IDOR)CVE-2026-1375 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026Tutor LMS – eLearning and online course solution: Sensitive Information ExposureCVE-2026-1371 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 3, 2026Spectra Gutenberg Blocks – Website Builder for the Block Editor: Information DisclosureCVE-2026-0950 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check `post_password_required()` before rendering post excerpts in the `render_excerpt()` function and the `uagb_get_excerpt()` helper function. This makes it possible for unauthenticated attackers to read excerpts of password-protected posts by simply viewing any page that contains a Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline block.
Product
Spectra Gutenberg Blocks – Website Builder for the Block Editor
Affected
up to 2.19.17
What to do
Affects up to 2.19.17. Update Spectra Gutenberg Blocks – Website Builder for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 2, 2026Spirit Framework: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54263 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Local File Inclusion.This issue affects Spirit Framework: from n/a through 1.2.13.
Product
Spirit Framework
Affected
up to 1.2.13
What to do
Affects up to 1.2.13. Update Spirit Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 2, 2026Five Star Restaurant Reservations: Does not have CSRF checks in some bulk actionsCVE-2026-0658 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting bookings via CSRF attacks.
Product
Five Star Restaurant Reservations
Fixed in
2.7.9
What to do
Update Five Star Restaurant Reservations to 2.7.9 or newer.
Full record and what to do →NVD record wpscan.com
Jan 31, 2026SupportCandy – Helpdesk & Customer Support Ticket System: SQL InjectionCVE-2026-0683 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This is due to insufficient escaping on the user-supplied operand value when using the equals operator and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above (customers), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
SupportCandy – Helpdesk & Customer Support Ticket System
Affected
up to 3.4.4
What to do
Affects up to 3.4.4. Update SupportCandy – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026WP Adminify: Sensitive Information ExposureCVE-2026-1060 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs.
Product
WP Adminify
Affected
up to 4.0.7.7
What to do
Affects up to 4.0.7.7. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Snow Monkey Forms: Arbitrary file deletionCVE-2026-1056 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Product
Snow Monkey Forms
Affected
up to 12.0.3
What to do
Affects up to 12.0.3. Update Snow Monkey Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Simple User Registration: Privilege escalationCVE-2026-0844 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
Product
Simple User Registration
Affected
up to 6.7
What to do
Affects up to 6.7. Update Simple User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Rupantorpay: Unauthorized modification of dataCVE-2025-15511 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to modify WooCommerce order statuses by sending crafted requests to the WooCommerce API endpoint.
Product
Rupantorpay
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Rupantorpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 28, 2026Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization: Authentication bypassCVE-2025-14386 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the 'generate_sso_url' and 'validate_sso_token' functions in versions 2.4.4 to 2.5.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the 'nonce_token' authentication value to log in to the first Administrator's account.
Product
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization
Affected
2.4.4 to 2.5.12
What to do
Affects 2.4.4 to 2.5.12. Update Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library: Stored Cross-Site ScriptingCVE-2025-14283 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BlockArt Counter in all versions up to, and including, 2.2.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library
Affected
up to 2.2.14
What to do
Affects up to 2.2.14. Update BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026VidShop – Shoppable Videos for WooCommerce: Time-based SQL InjectionCVE-2026-0702 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
VidShop – Shoppable Videos for WooCommerce
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update VidShop – Shoppable Videos for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026RegistrationMagic: Missing AuthorizationCVE-2026-1054 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.
Product
RegistrationMagic
Affected
up to 6.0.7.4
What to do
Affects up to 6.0.7.4. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Simple calendar for Elementor: Missing AuthorizationCVE-2026-1310 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the `miga_ajax_editor_cal_delete` function that is hooked to the `miga_editor_cal_delete` AJAX action with both authenticated and unauthenticated access enabled. This makes it possible for unauthenticated attackers to delete arbitrary calendar entries by sending a request with a valid nonce and the calendar entry ID.
Product
Simple calendar for Elementor
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Simple calendar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Forms Bridge – Infinite integrations: Stored Cross-Site ScriptingCVE-2026-1244 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Forms Bridge – Infinite integrations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in the 'financoop_campaign' shortcode in all versions up to, and including, 4.2.5. This is due to insufficient input sanitization and output escaping on the user-supplied 'id' parameter in the forms_bridge_financoop_shortcode_error function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Forms Bridge – Infinite integrations
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update Forms Bridge – Infinite integrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026New User Approve: Unauthorized access of data and modification of dataCVE-2026-0832 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to approve or deny user accounts, retrieve sensitive user information including emails and roles, and force logout of privileged users.
Product
New User Approve
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Authorization bypassCVE-2026-0825 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Interactions – Create Interactive Experiences in the Block Editor: Stored Cross-Site ScriptingCVE-2025-12709 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event selectors in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Interactions – Create Interactive Experiences in the Block Editor
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Interactions – Create Interactive Experiences in the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 28, 2026Easy Replace Image: Missing AuthorizationCVE-2026-1298 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `image_replacement_from_url` function that is hooked to the `eri_from_url` AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to replace arbitrary image attachments on the site with images from external URLs, potentially enabling site defacement, phishing attacks, or content manipulation.
Product
Easy Replace Image
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Easy Replace Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2026Link Invoice Payment for WooCommerce: Unauthorized modification of dataCVE-2025-14971 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration.
Product
Link Invoice Payment for WooCommerce
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Link Invoice Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.