Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

534new WordPress flaws this week

391,528entries in the database

5,932 results · page 18 of 119

Jul 29, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Insecure Direct Object ReferenceCVE-2026-5060 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Affected
up to 3.7.14
What to do
Affects up to 3.7.14. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 29, 2026Database for CF7: Stored Cross-Site ScriptingCVE-2026-13425 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because Contact Form 7 accepts array-structured input for ordinary text fields (e.g., your-name[]) via the public REST API endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback, and the plugin stores submitted data using $wpdb INSERT with serialize() into a custom wp_cf7db table, bypassing WordPress save-time filtering via wp_insert_post/wp_kses.
Product
Database for CF7
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Database for CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 29, 2026miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn): Does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued forCVE-2026-14300 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
Product
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
Fixed in
7.8.0
What to do
Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) to 7.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026Easy Appointments: Does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their ownCVE-2026-14224 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin before 3.12.28 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.
Product
Easy Appointments
Fixed in
3.12.28
What to do
Update Easy Appointments to 3.12.28 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …: Authentication BypassCVE-2026-18072 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.
Product
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …
What to do
Update Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 29, 2026Easy Digital Downloads: Arbitrary File UploadCVE-2026-12476 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient file type validation in the edd_do_ajax_import_file_upload() function , which only checks the client-supplied $_FILES['edd-import-file']['type'] Content-Type header against an allow-list of CSV mime types, then uses raw move_uploaded_file() (bypassing wp_handle_upload()'s core MIME enforcement) to write the file under its original extension into the web-accessible wp-content/uploads/edd/exports/ directory. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Easy Digital Downloads
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar: Authorization bypassCVE-2026-17166 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings — including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses — that govern how all event bookings are processed.
Product
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
Affected
up to 5.3.7
What to do
Affects up to 5.3.7. Update Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026WP Password Policy: Privilege EscalationCVE-2026-15992 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `WP_User::set_role()` with the attacker-supplied `role` parameter on any account resolved via `$_POST['user_login']`, without confirming the requesting user holds the capability to assign roles. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their own privileges to Administrator by submitting a crafted POST request — with `action` set to `createuser` and `role` set to `administrator` — to the password-reset form endpoint. The vulnerable code path is reachable via the `password_hint` filter hooked during the WordPress password-reset form render, meaning an attacker need only possess a valid password-reset cookie to reach the sink.
Product
WP Password Policy
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update WP Password Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart: Authorization bypassCVE-2026-15411 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary attacker-controlled data. The 'ajd_protected' nonce used as the sole gate is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp_localize_script call, rendering it ineffective as an authorization barrier.
Product
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Missing AuthorizationCVE-2026-15025 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce verification in the corresponding handlers (ajax_fetch_labels, segments_fetch, tags_fetch, and render_contact_fields). This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions retrieved via integration credentials configured by an administrator, and to consume third-party API quota.
Product
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
Affected
up to 7.3.2
What to do
Affects up to 7.3.2. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: SQL InjectionCVE-2026-15267 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query — the value is re-read at line 144 using only sanitize_text_field() (overwriting the earlier absint() result), then concatenated into the SQL WHERE clause as an unquoted numeric operand using only esc_sql(), which does not protect against injection in that context, and finally string-interpolated into the $wpdb->prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Taskbuilder – Project Management & Task Management Tool With Kanban Board
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Online Scheduling and Appointment Booking System – Bookly: Time-based SQL InjectionCVE-2026-14516 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a two-request chain: an attacker first calls the unauthenticated bookly_get_form_id action to seed a booking session carrying malicious staff_ids values, then triggers bookly_render_time to cause the tainted array to reach the vulnerable query; CSRF/nonce validation is absent on both endpoints, meaning this chain can be initiated cross-site.
Product
Online Scheduling and Appointment Booking System – Bookly
Affected
up to 27.5
What to do
Affects up to 27.5. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery: Time-based SQL InjectionCVE-2026-15670 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
Affected
up to 3.9.7
What to do
Affects up to 3.9.7. Update SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery: Authentication Bypass leading to Account TakeoverCVE-2026-15014 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.
Product
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
Affected
up to 3.9.7
What to do
Affects up to 3.9.7. Update SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026WP Fast Total Search – The Power of Indexed Search: Generic SQL InjectionCVE-2026-12741 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Fast Total Search – The Power of Indexed Search
Affected
up to 1.80.280
What to do
Affects up to 1.80.280. Update WP Fast Total Search – The Power of Indexed Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Chaty Pro: Authenticated Time-Based Blind SQL InjectionCVE-2026-6251 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating the value into a raw SQL query in a numeric context without using $wpdb->prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data.
Product
Chaty Pro
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Chaty Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026ShopLentor – All-in-One WooCommerce Growth & Store Enhancement: Time-based SQL InjectionCVE-2026-16811 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement
Affected
up to 3.4.5
What to do
Affects up to 3.4.5. Update ShopLentor – All-in-One WooCommerce Growth & Store Enhancement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Advanced Form Integration — Connect Forms to 200+ Apps: Authorization bypassCVE-2026-16587 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.
Product
Advanced Form Integration — Connect Forms to 200+ Apps
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Advanced Form Integration — Connect Forms to 200+ Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before reflecting it back in an admin pageCVE-2026-14870 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Database for Contact Form 7, WPforms, Elementor forms
Fixed in
1.5.3
What to do
Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026Quiz and Survey Master (QSM): Does not perform a capability check before deleting output templatesCVE-2026-14821 · WordPress plugins & themes · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.
Product
Quiz and Survey Master (QSM)
Fixed in
11.1.5
What to do
Update Quiz and Survey Master (QSM) to 11.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.CVE-2026-66476 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.CVE-2026-65434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.CVE-2026-59557 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.CVE-2026-59550 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Quiz and Survey Master (QSM): Does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accountsCVE-2026-14820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.
Product
Quiz and Survey Master (QSM)
Fixed in
11.1.3
What to do
Update Quiz and Survey Master (QSM) to 11.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Masteriyo LMS: Does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessionsCVE-2026-13332 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
Product
Masteriyo LMS
Fixed in
2.3.1
What to do
Update Masteriyo LMS to 2.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Custom Fields Account Registration For Woocommerce: Does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefixCVE-2026-13152 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.
Product
Custom Fields Account Registration For Woocommerce
Fixed in
1.4
What to do
Update Custom Fields Account Registration For Woocommerce to 1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 25, 2026Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Stored Cross-Site ScriptingCVE-2026-15425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
Product
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Affected
up to 28.0
What to do
Affects up to 28.0. Update Yoast SEO – Advanced SEO with real-time guidance and built-in AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Easy Appointments: Unauthorized modification of dataCVE-2026-8789 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.
Product
Easy Appointments
Affected
up to 3.12.27
What to do
Affects up to 3.12.27. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2026EventON Action User: Authorization bypassCVE-2026-10033 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON management capabilities and the upload_files capability to any non-administrator WordPress role or user, escalating their privileges within the site. The administrator role is protected by an early-return guard in update_role_caps(), so only non-administrator roles and individual users can be targeted; however, the same unauthenticated exposure also allows attackers to enumerate all WordPress users with their IDs and display names, disclose role and user capability state along with nonce values, and tamper with event-to-user term assignments.
Product
EventON Action User
Affected
up to 2.5.14
What to do
Affects up to 2.5.14. Update EventON Action User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2026SureDash – Community, Courses & Member Dashboard: Stored Cross-Site ScriptingCVE-2026-15821 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SureDash – Community, Courses & Member Dashboard
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Rich Showcase for Google Reviews: Stored Cross-Site ScriptingCVE-2026-15739 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rich Showcase for Google Reviews
Affected
up to 6.9.9
What to do
Affects up to 6.9.9. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Payment Plugins for Stripe WooCommerce: Authorization bypassCVE-2026-12654 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.
Product
Payment Plugins for Stripe WooCommerce
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update Payment Plugins for Stripe WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Participants Database: Sensitive Information ExposureCVE-2026-11354 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the private_id-bearing record-access link to an attacker-controlled email address, granting full read and edit access to the victim's stored personally identifiable information including names, email addresses, phone numbers, and any other fields collected in the participant database. An attacker can harvest a valid nonce with a plain unauthenticated GET request to any page rendering the public signup or record form, then POST action=update with an arbitrary id value to overwrite any record; chaining a subsequent action=retrieve then delivers the private-access link to the attacker-controlled mailbox.
Product
Participants Database
Affected
up to 2.7.8.3
What to do
Affects up to 2.7.8.3. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026SAML Single Sign On – SSO Login: Authentication BypassCVE-2026-15981 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
Product
SAML Single Sign On – SSO Login
Affected
up to 5.4.4
What to do
Affects up to 5.4.4. Update SAML Single Sign On – SSO Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.CVE-2026-65506 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
Affected
up to 5.12
What to do
Affects up to 5.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.CVE-2026-65501 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65500 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.CVE-2026-65483 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.CVE-2026-65473 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
Affected
up to 4.9.12
What to do
Affects up to 4.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.CVE-2026-65469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
Affected
up to 4.4.7
What to do
Affects up to 4.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.CVE-2026-65463 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.CVE-2026-65457 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.CVE-2026-65454 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
Affected
up to 11.2.0
What to do
Affects up to 11.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.CVE-2026-61947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.CVE-2026-61946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.
Affected
up to 3.12.27
What to do
Affects up to 3.12.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.CVE-2026-59555 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
Affected
up to 2.7.8.3
What to do
Affects up to 2.7.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.CVE-2026-59541 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.