Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,265 results · page 17 of 226
Aug 27, 2026Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.CVE-2026-32564 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
- Affected
- up to 2.0.63
- What to do
- Affects up to 2.0.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.CVE-2026-32479 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.
- Affected
- up to 11.17
- What to do
- Affects up to 11.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026StoreGrowth: Does not validate a browser-supplied product price on two of its unauthenticated actionsCVE-2026-78137 · WordPress plugins & themes · reported by WPScanHigh 7.5
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.
- Product
- StoreGrowth
- Fixed in
- 2.1.2
- What to do
- Update StoreGrowth to 2.1.2 or newer.
Aug 27, 2026Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce: Does not verify that the requesting user owns the customer profile being queried through one of its REST endpointsCVE-2026-16568 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.
- Product
- Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
- Affected
- up to 0.4.62
- What to do
- Affects up to 0.4.62. Update Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 26, 2026Stripe Payment Forms by WP Full Pay: Does not properly verify that a customer portal session has completed its confirmation step before returning dataCVE-2026-77758 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.
- Product
- Stripe Payment Forms by WP Full Pay
- Fixed in
- 8.5.1
- What to do
- Update Stripe Payment Forms by WP Full Pay to 8.5.1 or newer.
Aug 26, 2026Eventin: Does not properly restrictCVE-2026-77694 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
- Product
- Eventin
- Fixed in
- 4.1.19
- What to do
- Update Eventin to 4.1.19 or newer.
Aug 26, 2026Project Manager: Does not check that the user whose activity is being requested is the one making the request in one of its REST API routesCVE-2026-74930 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email address and the details of projects they have no access to.
- Product
- Project Manager
- Fixed in
- 4.0.7
- What to do
- Update Project Manager to 4.0.7 or newer.
Aug 26, 2026Project Manager: Does not restrict several of its REST API routes to the projects a user belongs toCVE-2026-74929 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards.
- Product
- Project Manager
- Fixed in
- 4.0.7
- What to do
- Update Project Manager to 4.0.7 or newer.
Aug 26, 2026Project Manager: Does not have any authorisation check on its import routesCVE-2026-74928 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
- Product
- Project Manager
- Fixed in
- 4.0.7
- What to do
- Update Project Manager to 4.0.7 or newer.
Aug 26, 2026Booking for Appointments and Events Calendar: Does not require authentication before processing its pending notification queueCVE-2026-14216 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.7
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.7 or newer.
Aug 26, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) owns the provider account being updatedCVE-2026-14212 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.8
- What to do
- Update Booking for Appointments and Events Calendar to 9.8 or newer.
Aug 25, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-18547 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the wp_kses 'templates' allowlist permits the id attribute on div elements but does not neutralize unescaped quotes within its value; when pickadate.js concatenates the stored id value into an HTML string via jQuery .html() on profile page load, the smuggled onfocus and autofocus attribute syntax breaks out of attribute context and executes as JavaScript.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.12.1
- What to do
- Affects up to 2.12.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026eCommerce Product Catalog: Stored Cross-Site ScriptingCVE-2026-76128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags; the tainted HTML output is only generated at render time by the shortcode handler.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026WP Project Manager Pro: SQL InjectionCVE-2026-78470 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Project Manager Pro
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update WP Project Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwedevs.comwordfence.com
Aug 25, 2026InfusedWoo Pro: Privilege EscalationCVE-2026-19892 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, which uses `is_admin()` as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover.
- Product
- InfusedWoo Pro
- Affected
- up to 5.1.17
- What to do
- Affects up to 5.1.17. Update InfusedWoo Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.infusedwoo.comwordfence.com
Aug 24, 2026PPWP – Password Protect WordPress | #1 Most-Reviewed Password: Stored Cross-Site ScriptingCVE-2025-9878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- PPWP – Password Protect WordPress | #1 Most-Reviewed Password
- Affected
- up to 1.9.21
- What to do
- Affects up to 1.9.21. Update PPWP – Password Protect WordPress | #1 Most-Reviewed Password to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.CVE-2026-78262 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
- Affected
- up to 4.0.6
- What to do
- Affects up to 4.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.CVE-2026-32563 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
- Affected
- up to 2.0.63
- What to do
- Affects up to 2.0.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.CVE-2026-32554 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.CVE-2026-78279 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-78278 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
- Affected
- up to 2.0.11
- What to do
- Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.CVE-2026-78277 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
- Affected
- up to 3.1.12
- What to do
- Affects up to 3.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.CVE-2026-78272 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.CVE-2026-78270 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.
- Affected
- up to 3.1.12
- What to do
- Affects up to 3.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66587 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
- What to do
- Update the plugin to the newest version.
Aug 24, 2026Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.CVE-2026-66585 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
- What to do
- Update the plugin to the newest version.
Aug 24, 2026Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.CVE-2026-32558 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
- Affected
- up to 8.9.1
- What to do
- Affects up to 8.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Woo Essential: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32551 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.
- Product
- Woo Essential
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update Woo Essential to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.CVE-2026-32478 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.CVE-2026-32477 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.CVE-2026-32476 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
- Affected
- up to 0.8.6
- What to do
- Affects up to 0.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.CVE-2026-32471 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.CVE-2026-28190 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.CVE-2026-28171 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
- Affected
- up to 10.7
- What to do
- Affects up to 10.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Super Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-28167 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.
- Product
- Super Forms
- Affected
- up to 6.3.316
- What to do
- Affects up to 6.3.316. Update Super Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2026PPWP – Password Protect Pages: PHP Object InjectionCVE-2026-0551 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- PPWP – Password Protect Pages
- Affected
- up to 1.9.18
- What to do
- Affects up to 1.9.18. Update PPWP – Password Protect Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026Advanced Product Fields (Product Addons) for WooCommerce: Improper Input ValidationCVE-2026-2996 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing products by paying a fraction of the intended total. The vulnerability was partially patched in version 1.6.19.
- Product
- Advanced Product Fields (Product Addons) for WooCommerce
- Affected
- up to 1.6.21
- What to do
- Affects up to 1.6.21. Update Advanced Product Fields (Product Addons) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 22, 2026WP Social Media Login: Does not verify that a social login was actually completed with the identity provider before authenticating a visitorCVE-2026-77000 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, including administrators, by supplying that user's email address.
- Product
- WP Social Media Login
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP Social Media Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2026FiboSearch: Does not consistently exclude password-protected products from its unauthenticated AJAX endpointsCVE-2026-16612 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
- Product
- FiboSearch
- Fixed in
- 1.34.1
- What to do
- Update FiboSearch to 1.34.1 or newer.
Aug 21, 2026ProfilePress: Does not strip shortcodes from two of its profile fields before rendering them on public pagesCVE-2026-19848 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.
- Product
- ProfilePress
- Fixed in
- 4.17.1
- What to do
- Update ProfilePress to 4.17.1 or newer.
Aug 21, 2026Link Whisper Free: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-14601 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.
- Product
- Link Whisper Free
- Fixed in
- 0.9.7
- What to do
- Update Link Whisper Free to 0.9.7 or newer.
Aug 21, 2026WPForms Pro: Stored Cross-Site ScriptingCVE-2026-18409 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.
- Product
- WPForms Pro
- Affected
- up to 2.0.0.2
- What to do
- Affects up to 2.0.0.2. Update WPForms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpforms.comwordfence.com
Aug 20, 2026InfiniteWP Client: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-74011 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.
- Product
- InfiniteWP Client
- Affected
- up to 1.13.9
- What to do
- Affects up to 1.13.9. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026New User Approve: Missing AuthorizationCVE-2026-28163 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.
- Product
- New User Approve
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.CVE-2026-74019 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.CVE-2026-74001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
- Affected
- up to 5.4.5
- What to do
- Affects up to 5.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.CVE-2026-68566 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
- Affected
- up to 6.0.2
- What to do
- Affects up to 6.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.CVE-2026-68564 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
- Affected
- up to 10.4.0
- What to do
- Affects up to 10.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.CVE-2026-66649 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
- Affected
- up to 2.5.8
- What to do
- Affects up to 2.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.