Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,150entries in the database

40,869 results · page 152 of 818

May 27, 2026Tainacan: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42740 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.
Product
Tainacan
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Advanced IP Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42739 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IniLerm Advanced IP Blocker advanced-ip-blocker allows DOM-Based XSS.This issue affects Advanced IP Blocker: from n/a through <= 8.10.7.
Product
Advanced IP Blocker
Affected
up to 8.10.7
What to do
Affects up to 8.10.7. Update Advanced IP Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Smart Online Order for Clover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42738 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.
Product
Smart Online Order for Clover
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026VikBooking Hotel Booking Engine & PMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42737 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Path Traversal.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.9
What to do
Affects up to 1.8.9. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026BP Better Messages: Authorization Bypass Through User-Controlled KeyCVE-2026-42736 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-better-messages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Better Messages: from n/a through <= 2.14.16.
Product
BP Better Messages
Affected
up to 2.14.16
What to do
Affects up to 2.14.16. Update BP Better Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026KiviCare: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-42735 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exploitation.This issue affects KiviCare: from n/a through <= 4.3.0.
Product
KiviCare
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through <= 1.13.19.
Product
Geo Mashup
Affected
up to 1.13.19
What to do
Affects up to 1.13.19. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026WPCS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42733 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 WPCS currency-switcher allows DOM-Based XSS.This issue affects WPCS: from n/a through <= 1.3.1.
Product
WPCS
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WPCS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Ads by WPQuads: Improper Validation of Specified Quantity in InputCVE-2026-42732 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Input Data Manipulation.This issue affects Ads by WPQuads: from n/a through <= 3.0.2.
Product
Ads by WPQuads
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Ads by WPQuads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026miniorange otp verification: Incorrect Privilege AssignmentCVE-2026-42731 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.
Product
miniorange otp verification
Affected
up to 5.4.9
What to do
Affects up to 5.4.9. Update miniorange otp verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026MasterStudy LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42730 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.
Product
MasterStudy LMS
Affected
up to 3.7.29
What to do
Affects up to 3.7.29. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026PropertyHive: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42729 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows DOM-Based XSS.This issue affects PropertyHive: from n/a through <= 2.2.2.
Product
PropertyHive
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update PropertyHive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026HT Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42728 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through <= 2.8.2.
Product
HT Contact Form 7
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update HT Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Active Products Tables for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42727 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.8.
Product
Active Products Tables for WooCommerce
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026AWP Classifieds: Missing AuthorizationCVE-2026-42726 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AWP Classifieds: from n/a through <= 4.4.5.
Product
AWP Classifieds
Affected
up to 4.4.5
What to do
Affects up to 4.4.5. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Checkout Files Upload for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2026-42725 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Files Upload for WooCommerce: from n/a through <= 2.2.5.
Product
Checkout Files Upload for WooCommerce
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update Checkout Files Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026MinhNhut Link Gateway: Reflected Cross-Site ScriptingCVE-2026-3349 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MinhNhut Link Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter on the redirect page in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MinhNhut Link Gateway
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update MinhNhut Link Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026MinhNhut Link Gateway: Stored Cross-Site ScriptingCVE-2026-3348 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings (Description, Title, and other fields) in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the redirect page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
MinhNhut Link Gateway
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update MinhNhut Link Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026myLinksDump: Stored Cross-Site ScriptingCVE-2026-2288 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The myLinksDump plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_title' parameter in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
myLinksDump
Affected
up to 1.6
What to do
Affects up to 1.6. Update myLinksDump to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026rexCrawler: Stored Cross-Site ScriptingCVE-2026-2280 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The rexCrawler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
rexCrawler
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update rexCrawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Xpro Elementor Addons - Pro: Arbitrary File ReadingCVE-2025-0898 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Xpro Elementor Addons - Pro
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Xpro Elementor Addons - Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record elementor.wpxpro.com wordfence.com
May 27, 2026Master Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48968 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows DOM-Based XSS. This issue affects Master Slider: from n/a through 3.10.8.
Product
Master Slider
Affected
up to 3.10.8
What to do
Affects up to 3.10.8. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026GenerateBlocks: Insertion of Sensitive Information Into Sent DataCVE-2026-48877 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data. This issue affects GenerateBlocks: from n/a through 2.1.0.
Product
GenerateBlocks
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update GenerateBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Themebox - Digital Products Ecommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52747 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Themebox - Digital Products Ecommerce allows Reflected XSS. This issue affects Themebox - Digital Products Ecommerce: from n/a through 1.4.2.
Product
Themebox - Digital Products Ecommerce
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Themebox - Digital Products Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Felan Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22741 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RiceTheme Felan Framework allows Reflected XSS. This issue affects Felan Framework: from n/a through 1.1.3.
Product
Felan Framework
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Felan Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026MetaMagic SEO: Cross-Site Request ForgeryCVE-2026-8942 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MetaMagic SEO Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the metamagic_update_options function. This makes it possible for unauthenticated attackers to modify the plugin's SEO settings, including enabling or disabling the plugin and toggling description and keyword meta tag output via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MetaMagic SEO
Affected
up to 1.6
What to do
Affects up to 1.6. Update MetaMagic SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026WP Promoter: Cross-Site Request ForgeryCVE-2026-8906 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Promoter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Promoter
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Promoter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager: Remote Code ExecutionCVE-2026-8832 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability_type or capability restrictions in the wpcode_register_post_type() function, allowing WordPress core to fall back to standard post capabilities for all creation paths including XML-RPC. This makes it possible for authenticated attackers, with author-level access and above, to create and publish executable PHP snippet posts via XML-RPC wp.newPost, which are then executed server-side via eval() in the run_eval() function when the snippet is rendered through the [wpcode] shortcode.
Product
WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026HBook: Stored Cross-Site ScriptingCVE-2026-8143 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hb_country_iso', 'hb_usa_state_iso', and 'hb_canada_province_iso' parameters in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the HBook Customers admin page).
Product
HBook
Affected
up to 2.1.6
What to do
Affects up to 2.1.6. Update HBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
May 27, 2026Github Shortcode: Stored Cross-Site ScriptingCVE-2026-8042 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Github Shortcode
Affected
up to 0.1
What to do
Affects up to 0.1. Update Github Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026EnvíaloSimple: Email Marketing y Newsletters: Time-based blind SQL InjectionCVE-2026-7618 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
EnvíaloSimple: Email Marketing y Newsletters
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update EnvíaloSimple: Email Marketing y Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026affiliate-toolkit: Remote code executionCVE-2026-6169 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.
Product
affiliate-toolkit
Affected
up to 3.8.5
What to do
Affects up to 3.8.5. Update affiliate-toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Livemesh Addons for Beaver Builder: Stored Cross-Site ScriptingCVE-2026-3897 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `labb_admin_ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
Product
Livemesh Addons for Beaver Builder
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update Livemesh Addons for Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Livemesh SiteOrigin Widgets: Stored Cross-Site ScriptingCVE-2026-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lsow_admin_ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
Product
Livemesh SiteOrigin Widgets
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update Livemesh SiteOrigin Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026WPBakery Page Builder Addons by Livemesh: Stored Cross-Site ScriptingCVE-2026-3895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lvca_admin_ajax` AJAX action in all versions up to, and including, 3.9.4 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.
Product
WPBakery Page Builder Addons by Livemesh
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update WPBakery Page Builder Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026LiteSpeed Cache: Stored Cross-Site ScriptingCVE-2026-3375 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the /wp-json/litespeed/v1/notify_ccss and /wp-json/litespeed/v1/notify_ucss REST API endpoints in all versions up to, and including, 7.7. These endpoints accept CSS content from QUIC.cloud callback notifications and store it to disk without sanitization. The stored content is later rendered inline frontend page loads without output escaping. The access control protecting these endpoints is IP-based validation that can potentially be bypassed when the WordPress site is deployed behind a reverse proxy, load balancer, or CDN with certain configurations. This makes it possible for unauthenticated attackers, under certain conditions, to inject arbitrary JavaScript into CCSS/UCSS content.
Product
LiteSpeed Cache
Affected
up to 7.7
What to do
Affects up to 7.7. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Enable jQuery Migrate Helper: Unauthorized modification of dataCVE-2026-3279 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Enable jQuery Migrate Helper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `downgrade_jquery_version()` function in all versions up to, and including, 1.4.1. This is due to the function only verifying a nonce without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to downgrade the site-wide jQuery version from 3.7.1 to the legacy 1.12.4-wp release, which has knowns security vulnerabilities.
Product
Enable jQuery Migrate Helper
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Enable jQuery Migrate Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Gutenverse: Reflected Cross-Site ScriptingCVE-2026-3001 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. Specifically, the `render_content()` method in `class-search-result-title.php` outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()` or any other escaping function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages via a crafted URL that execute if a user clicks the link, provided the `gutenverse/search-result-title` block is present on the site's search results template.
Product
Gutenverse
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Gutenverse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026WPBakery Page Builder Addons by Livemesh: Stored Cross-Site ScriptingCVE-2026-2030 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[lvca_carousel]` and `[lvca_posts_carousel]` shortcode attributes in all versions up to, and including, 3.9.4 due to insufficient input sanitization and output escaping. Specifically, shortcode attributes are encoded with `wp_json_encode()` and output into single-quoted `data-settings` HTML attributes without using `esc_attr()`, allowing attackers to break out of the attribute by injecting single quotes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPBakery Page Builder Addons by Livemesh
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update WPBakery Page Builder Addons by Livemesh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Query Shortcode: Local File InclusionCVE-2026-9200 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
Query Shortcode
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Query Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026WP Promoter: Unauthorized modification of dataCVE-2026-9014 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Promoter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_stats() function in versions up to, and including, 1.3. The function is hooked to both the wp_ajax_wpp-reset_stats and wp_ajax_nopriv_wpp-reset_stats actions and contains no authentication, authorization, or nonce validation. This makes it possible for unauthenticated attackers to reset the plugin's bar and popup statistics by deleting the wpp_bar and wpp_popup options.
Product
WP Promoter
Affected
up to 1.3
What to do
Affects up to 1.3. Update WP Promoter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Login with NEAR: Authentication BypassCVE-2026-8994 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Login with NEAR plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.3.3. The `ajaxLoginWithNear()` function — registered as a `wp_ajax_nopriv` action and therefore reachable by unauthenticated users — accepts an attacker-supplied `account` POST parameter and issues a valid WordPress authentication cookie based solely on a substring check for `.near`, with no nonce verification, cryptographic signature validation, challenge-response exchange, or any proof that the requester controls the corresponding NEAR wallet. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, whose email address matches the deterministic `<account>@near.org` pattern derived from the supplied `account` value. If no matching user exists, the handler automatically creates and authenticates a new WordPress account for the attacker-controlled identifier, providing a further avenue for unauthorized account creation.
Product
Login with NEAR
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update Login with NEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026GoStats for: Cross-Site Request ForgeryCVE-2026-8943 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GoStats for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the gostats_manage() function. This makes it possible for unauthenticated attackers to update the plugin's settings (gostats_siteid and gostats_server options) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
GoStats for
Affected
up to 1.4
What to do
Affects up to 1.4. Update GoStats for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026CDN Linker lite: Cross-Site Request ForgeryCVE-2026-8941 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CDN Linker lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the ossdl_off_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings — including the CDN URL used to rewrite all static asset references on the site — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CDN Linker lite
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update CDN Linker lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Search Simple Fields: Cross-Site Request ForgeryCVE-2026-8939 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Search Simple Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the search_simple_fields_options() function in functions_admin.php. This makes it possible for unauthenticated attackers to modify the plugin's settings — including post types to search in, custom fields, media fields and the custom media function name — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Search Simple Fields
Affected
up to 0.2
What to do
Affects up to 0.2. Update Search Simple Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026auto making JSON-LD: Cross-Site Request ForgeryCVE-2026-8938 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The auto making JSON-LD plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the amJL_certification function. This makes it possible for unauthenticated attackers to update the plugin's license key option, and subsequently trigger license validation and pro feature installation on the victim site without the administrator's consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation can trigger downstream calls to amJL_is_license_valid() and amJL_download_and_install_pro_features(), meaning the impact extends beyond a simple settings change to unauthorized installation of plugin components.
Product
auto making JSON-LD
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update auto making JSON-LD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026WP AutoBuzz: Cross-Site Request ForgeryCVE-2026-8911 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This vulnerability bypasses WordPress's DISALLOW_UNFILTERED_HTML protection because the unsanitized value is written directly via update_option at the plugin level, entirely outside of WordPress post content handling.
Product
WP AutoBuzz
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP AutoBuzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Two-factor authentication (formerly IP Vault): Cross-Site Request ForgeryCVE-2026-8903 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Two-factor authentication (formerly IP Vault) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the ipv_save_changes function. This makes it possible for unauthenticated attackers to modify the plugin's firewall and two-factor authentication settings — including the operating mode, request include/exclude rules, authentication slug, and log retention period — potentially disabling protection entirely via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Two-factor authentication (formerly IP Vault)
Affected
up to 2.1
What to do
Affects up to 2.1. Update Two-factor authentication (formerly IP Vault) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Auto Thumbnail: Stored Cross-Site ScriptingCVE-2026-8899 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'thumbnails' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on the shortcode's 'width' and 'height' attributes in the athn_thumbnails() function, which are concatenated directly into an HTML <img> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Auto Thumbnail
Affected
up to 1.0
What to do
Affects up to 1.0. Update Auto Thumbnail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Events In City: Stored Cross-Site ScriptingCVE-2026-8898 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'org-events' shortcode in versions up to, and including, 3.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (such as 'organizer_id', 'width', 'height', 'transparency', 'header', 'border', and 'layout') in the org_event_scode() function. The attribute values are concatenated directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Events In City
Affected
up to 3.0
What to do
Affects up to 3.0. Update Events In City to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.