Vulnerability database

9,239 results · page 18 of 185

• Apr 15, 2026Mini Ajax Cart for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-6370 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.

  Product

  Mini Ajax Cart for WooCommerce

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Mini Ajax Cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2026WCFM Marketplace: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-63029 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.

  Product

  WCFM Marketplace

  Affected

  up to 3.7.1

  What to do

  Affects up to 3.7.1. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2026YouTube Showcase: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-15636 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Stored XSS.This issue affects YouTube Showcase: from n/a through <= 3.5.1.

  Product

  YouTube Showcase

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update YouTube Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2026Element Pack Elementor Addons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-40745 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: from n/a through <= 8.4.2.

  Product

  Element Pack Elementor Addons

  Affected

  up to 8.4.2

  What to do

  Affects up to 8.4.2. Update Element Pack Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2026Beaver Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-40744 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through <= 2.10.1.2.

  Product

  Beaver Builder

  Affected

  up to 2.10.1.2

  What to do

  Affects up to 2.10.1.2. Update Beaver Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2026Categories Images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-40734 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-images allows DOM-Based XSS.This issue affects Categories Images: from n/a through <= 3.3.1.

  Product

  Categories Images

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update Categories Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2026ThemeGrill Demo Importer: Missing AuthorizationCVE-2026-40730 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.

  Product

  ThemeGrill Demo Importer

  Affected

  up to 2.0.0.6

  What to do

  Affects up to 2.0.0.6. Update ThemeGrill Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 15, 2026MetForm Pro: Improper Input ValidationCVE-2026-1782 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal) trusting a user-submitted calculation field value without recomputing or validating it against the configured form price. This makes it possible for unauthenticated attackers to manipulate the payment amount via the 'mf-calculation' field in the form submission REST request granted there exists a specific form with this particular configuration.

  Product

  MetForm Pro

  Affected

  up to 3.9.7

  What to do

  Affects up to 3.9.7. Update MetForm Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpmet.comwordfence.com

• Apr 10, 2026Case Theme User: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-5804 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User case-theme-user allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a through < 1.0.4.

  Product

  Case Theme User

  What to do

  Update Case Theme User to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2026Cerato: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58920 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zootemplate Cerato cerato allows Reflected XSS.This issue affects Cerato: from n/a through <= 2.2.18.

  Product

  Cerato

  Affected

  up to 2.2.18

  What to do

  Affects up to 2.2.18. Update Cerato to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 10, 2026VideoPro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58913 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CactusThemes VideoPro videopro allows PHP Local File Inclusion.This issue affects VideoPro: from n/a through <= 2.3.8.1.

  Product

  VideoPro

  Affected

  up to 2.3.8.1

  What to do

  Affects up to 2.3.8.1. Update VideoPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 9, 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory: Improper Access ControlCVE-2026-4977 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.

  Product

  UsersWP – Front-end login form, User Registration, User Profile & Members Directory

  Affected

  up to 1.2.58

  What to do

  Affects up to 1.2.58. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 8, 2026tagDiv Composer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39712 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in tagDiv tagDiv Composer td-composer allows Code Injection.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

  Product

  tagDiv Composer

  Affected

  up to 5.4.3

  What to do

  Affects up to 5.4.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026UiCore Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39708 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through 1.3.17.

  Product

  UiCore Elements

  Affected

  up to 1.3.17

  What to do

  Affects up to 1.3.17. Update UiCore Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026WPBITS Addons For Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39703 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.8.1.

  Product

  WPBITS Addons For Elementor Page Builder

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update WPBITS Addons For Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Animation Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39702 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows DOM-Based XSS.This issue affects Animation Addons for Elementor: from n/a through <= 2.6.1.

  Product

  Animation Addons for Elementor

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update Animation Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Elfsight WhatsApp Chat CC: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39696 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elfsight Elfsight WhatsApp Chat CC elfsight-whatsapp-chat allows DOM-Based XSS.This issue affects Elfsight WhatsApp Chat CC: from n/a through <= 1.2.0.

  Product

  Elfsight WhatsApp Chat CC

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Elfsight WhatsApp Chat CC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2026-39694 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.

  Product

  Simply Schedule Appointments

  Affected

  up to 1.6.10.2

  What to do

  Affects up to 1.6.10.2. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026FSM Custom Featured Image Caption: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39693 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.

  Product

  FSM Custom Featured Image Caption

  Affected

  up to 1.25.1

  What to do

  Affects up to 1.25.1. Update FSM Custom Featured Image Caption to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39692 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Stored XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

  Product

  tagDiv Composer

  Affected

  up to 5.4.3

  What to do

  Affects up to 5.4.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026OrganicFood: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39684 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnTheme OrganicFood organicfood allows PHP Local File Inclusion.This issue affects OrganicFood: from n/a through <= 3.6.4.

  Product

  OrganicFood

  Affected

  up to 3.6.4

  What to do

  Affects up to 3.6.4. Update OrganicFood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Garden Gnome Package: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39683 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chief Gnome Garden Gnome Package garden-gnome-package allows DOM-Based XSS.This issue affects Garden Gnome Package: from n/a through <= 2.4.1.

  Product

  Garden Gnome Package

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Garden Gnome Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Homeo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39681 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local File Inclusion.This issue affects Homeo: from n/a through <= 1.2.59.

  Product

  Homeo

  Affected

  up to 1.2.59

  What to do

  Affects up to 1.2.59. Update Homeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Freeio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39679 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.

  Product

  Freeio

  Affected

  up to 1.3.21

  What to do

  Affects up to 1.3.21. Update Freeio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Emphires: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39677 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires allows PHP Local File Inclusion.This issue affects Emphires: from n/a through <= 3.9.

  Product

  Emphires

  Affected

  up to 3.9

  What to do

  Affects up to 3.9. Update Emphires to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026MK Google Directions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39674 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manoj Kumar MK Google Directions google-distance-calculator allows DOM-Based XSS.This issue affects MK Google Directions: from n/a through <= 3.1.1.

  Product

  MK Google Directions

  Affected

  up to 3.1.1

  What to do

  Affects up to 3.1.1. Update MK Google Directions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Korea SNS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39667 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jongmyoung Kim Korea SNS korea-sns allows DOM-Based XSS.This issue affects Korea SNS: from n/a through <= 1.7.0.

  Product

  Korea SNS

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Korea SNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Hello Bar Popup Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39666 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1.

  Product

  Hello Bar Popup Builder

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Hello Bar Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026SEO Friendly Images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39665 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac SEO Friendly Images seo-image allows DOM-Based XSS.This issue affects SEO Friendly Images: from n/a through <= 3.0.5.

  Product

  SEO Friendly Images

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update SEO Friendly Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026WP Simple HTML Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39654 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.

  Product

  WP Simple HTML Sitemap

  Affected

  up to 3.8

  What to do

  Affects up to 3.8. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39646 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bozdoz Leaflet Map leaflet-map allows Stored XSS.This issue affects Leaflet Map: from n/a through <= 3.4.4.

  Product

  Leaflet Map

  Affected

  up to 3.4.4

  What to do

  Affects up to 3.4.4. Update Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Qubely: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39638 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14.

  Product

  Qubely

  Affected

  up to 1.8.14

  What to do

  Affects up to 1.8.14. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Livemesh Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39636 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through <= 9.0.

  Product

  Livemesh Addons for Elementor

  Affected

  up to 9.0

  What to do

  Affects up to 9.0. Update Livemesh Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Uminex: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39629 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affects Uminex: from n/a through <= 1.0.9.

  Product

  Uminex

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Uminex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026DukaMarket: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39628 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issue affects DukaMarket: from n/a through <= 1.3.0.

  Product

  DukaMarket

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update DukaMarket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Armania: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39626 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affects Armania: from n/a through <= 1.4.8.

  Product

  Armania

  Affected

  up to 1.4.8

  What to do

  Affects up to 1.4.8. Update Armania to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026TechOne: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39625 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affects TechOne: from n/a through <= 3.0.3.

  Product

  TechOne

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update TechOne to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Biolife: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39623 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP Local File Inclusion.This issue affects Biolife: from n/a through <= 3.2.3.

  Product

  Biolife

  Affected

  up to 3.2.3

  What to do

  Affects up to 3.2.3. Update Biolife to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Download Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39615 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53.

  Product

  Download Manager

  Affected

  up to 3.3.53

  What to do

  Affects up to 3.3.53. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Boutique: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39613 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allows PHP Local File Inclusion.This issue affects Boutique: from n/a through <= 2.3.3.

  Product

  Boutique

  Affected

  up to 2.3.3

  What to do

  Affects up to 2.3.3. Update Boutique to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026KuteShop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39611 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes KuteShop kuteshop allows PHP Local File Inclusion.This issue affects KuteShop: from n/a through <= 4.2.9.

  Product

  KuteShop

  Affected

  up to 4.2.9

  What to do

  Affects up to 4.2.9. Update KuteShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026MyBookTable Bookstore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39604 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable allows Stored XSS.This issue affects MyBookTable Bookstore: from n/a through <= 3.6.0.

  Product

  MyBookTable Bookstore

  Affected

  up to 3.6.0

  What to do

  Affects up to 3.6.0. Update MyBookTable Bookstore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Custom Query Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39575 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.5.0.

  Product

  Custom Query Blocks

  Affected

  up to 5.5.0

  What to do

  Affects up to 5.5.0. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026LabtechCO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39544 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows PHP Local File Inclusion.This issue affects LabtechCO: from n/a through <= 8.3.

  Product

  LabtechCO

  Affected

  up to 8.3

  What to do

  Affects up to 8.3. Update LabtechCO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Hydra Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39541 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.38.

  Product

  Hydra Booking

  Affected

  up to 1.1.38

  What to do

  Affects up to 1.1.38. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Mikado Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39538 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Core: from n/a through <= 1.6.

  Product

  Mikado Core

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Mikado Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Blog Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39517 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.6.

  Product

  Blog Filter

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update Blog Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Advanced Coupons for WooCommerce Coupons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39508 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows DOM-Based XSS.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.1.

  Product

  Advanced Coupons for WooCommerce Coupons

  Affected

  up to 4.7.1.1

  What to do

  Affects up to 4.7.1.1. Update Advanced Coupons for WooCommerce Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Seriously Simple Podcasting: Missing AuthorizationCVE-2026-39505 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.

  Product

  Seriously Simple Podcasting

  Affected

  up to 3.14.2

  What to do

  Affects up to 3.14.2. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39500 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.2.

  Product

  themesflat-addons-for-elementor

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.