Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

11,265 results · page 18 of 226

Aug 20, 2026Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.
Product
Form Maker by 10Web
Affected
up to 1.15.49
What to do
Affects up to 1.15.49. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.CVE-2026-66607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.CVE-2026-66605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
Affected
up to 1.4.13
What to do
Affects up to 1.4.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026rtMedia for WordPress, BuddyPress and bbPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-66592 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.
Product
rtMedia for WordPress, BuddyPress and bbPress
Affected
up to 4.7.11
What to do
Affects up to 4.7.11. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66586 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Kirki: Does not properly validate the files contained in archives uploaded by users with the Editor roleCVE-2026-74992 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
Product
Kirki
Fixed in
6.2.3
What to do
Update Kirki to 6.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Elementor Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-32475 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.
Product
Elementor Pro
Affected
up to 4.2.1
What to do
Affects up to 4.2.1. Update Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 19, 2026Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.CVE-2026-73183 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.
Affected
up to 4.32
What to do
Affects up to 4.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.CVE-2026-73182 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.
Affected
up to 3.9
What to do
Affects up to 3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2026WPS Bidouille: Does not have proper authorisation checks in an AJAX actionCVE-2026-19782 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.
Product
WPS Bidouille
Fixed in
1.33.5
What to do
Update WPS Bidouille to 1.33.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026ProSolution WP Client: Does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pagesCVE-2026-19056 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.
Product
ProSolution WP Client
Fixed in
2.0.11
What to do
Update ProSolution WP Client to 2.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026ProSolution WP Client: Does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pagesCVE-2026-19055 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.
Product
ProSolution WP Client
Fixed in
2.0.11
What to do
Update ProSolution WP Client to 2.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18779 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
Product
TrueBooker
Fixed in
1.2.7
What to do
Update TrueBooker to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18778 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.
Product
TrueBooker
Fixed in
1.2.7
What to do
Update TrueBooker to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18777 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.
Product
TrueBooker
Fixed in
1.2.7
What to do
Update TrueBooker to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18776 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
Product
TrueBooker
Fixed in
1.2.7
What to do
Update TrueBooker to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026W3 Total Cache: Does not properly validate the request path it uses to build cache file namesCVE-2026-18051 · WordPress plugins & themes · reported by WPScanCritical 10
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
Product
W3 Total Cache
Fixed in
2.10.5
What to do
Update W3 Total Cache to 2.10.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Product Shortlist: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-16950 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Product
Product Shortlist
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Product Shortlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Simple File List: Does not properly sanitise and escape a file's description before outputting it on the public file listCVE-2026-16617 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.
Product
Simple File List
Affected
up to 6.3.11
What to do
Affects up to 6.3.11. Update Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Booking calendar, Appointment Booking System: Does not properly sanitize uploaded SVG filesCVE-2026-14334 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.
Product
Booking calendar, Appointment Booking System
Affected
up to 3.2.36
What to do
Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026WCFM Marketplace: Does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deletedCVE-2026-14196 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.
Product
WCFM Marketplace
Fixed in
3.8.1
What to do
Update WCFM Marketplace to 3.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Eventin: Does not properly verify ownership of events before allowing them to be modifiedCVE-2026-13169 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.
Product
Eventin
Fixed in
4.1.21
What to do
Update Eventin to 4.1.21 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2026PPWP: Password Protect Pages, Posts & Full or Partial Content: Unauthorized access of dataCVE-2025-11729 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve a master-password and access any password-protected content.
Product
PPWP: Password Protect Pages, Posts & Full or Partial Content
Affected
up to 1.9.15
What to do
Affects up to 1.9.15. Update PPWP: Password Protect Pages, Posts & Full or Partial Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 18, 2026Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66591 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39.
Product
Media LIbrary Assistant
Affected
up to 3.39
What to do
Affects up to 3.39. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026PublishPress Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27365 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.
Product
PublishPress Series
Affected
up to 2.17.0
What to do
Affects up to 2.17.0. Update PublishPress Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Draft List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66603 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4.
Product
Draft List
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Draft List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Site Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-73382 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.
Product
Site Reviews
Affected
up to 8.2.0
What to do
Affects up to 8.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.CVE-2026-73360 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
Affected
up to 3.5.8
What to do
Affects up to 3.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026WPDM – Premium Packages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-73190 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.
Product
WPDM – Premium Packages
Affected
up to 7.0.5
What to do
Affects up to 7.0.5. Update WPDM – Premium Packages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.CVE-2026-73181 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026EasyTest – Simplify A/B Testing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-68567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.
Product
EasyTest – Simplify A/B Testing
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update EasyTest – Simplify A/B Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Wise Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66636 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.
Product
Wise Chat
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Wise Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.CVE-2026-66633 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Ultimate Dashboard Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66621 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.
Product
Ultimate Dashboard Pro
Affected
up to 3.11.2
What to do
Affects up to 3.11.2. Update Ultimate Dashboard Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.CVE-2026-28192 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
Affected
up to 7.1.67
What to do
Affects up to 7.1.67. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2026Extra Product Options Builder for WooCommerce: Does not verify that the requester is entitled to a customer-uploaded file before serving itCVE-2026-19728 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.
Product
Extra Product Options Builder for WooCommerce
Fixed in
1.2.176
What to do
Update Extra Product Options Builder for WooCommerce to 1.2.176 or newer.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026Visualizer: Does not properly authorise access to the configuration of its chartsCVE-2026-19726 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from.
Product
Visualizer
Fixed in
4.0.7
What to do
Update Visualizer to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors: Generic SQL InjectionCVE-2026-15351 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field callback strips HTML but leaves SQL metacharacters intact, and wp_magic_quotes slash protection does not apply because WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before the sanitize callback executes.
Product
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Divi: Does not properly escape some of its Social Media Follow module settings before outputting them in link attributesCVE-2026-13712 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
Product
Divi
Fixed in
5.9.0
What to do
Update Divi to 5.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerableCVE-2026-18385 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The partial mitigation introduced via strip_shortcodes() on [profile-first-name] and [profile-last-name] can be bypassed through the [profile-display-name format="first_last_names"] render path, the [profile-bio] render path (which re-fetches the raw description meta), and the double-bracket escape sequence [[tag]], all of which allow attacker-controlled shortcode text to reach the outer do_shortcode() call.
Affected
up to 4.16.19
What to do
Affects up to 4.16.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026ProSolution WP Client: Arbitrary File UploadCVE-2026-16098 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the allow-listed multipart filename before the file is saved, and a post-save extension check that fails to delete the already-written file. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce required to reach the upload handler is publicly exposed via wp_localize_script on any front-end page rendering the job portal shortcode, allowing unauthenticated visitors to obtain a valid nonce and bypass that gating check entirely.
Product
ProSolution WP Client
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update ProSolution WP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026WC Product Table Lite: CSS InjectionCVE-2026-15441 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scroll_offset' shortcode attribute exposed through the unauthenticated wcpt_ajax() AJAX handler. The handler is registered for wp_ajax_nopriv_wcpt_ajax, JSON-decodes attacker-supplied attributes, only allowlists key names (not values), applies a preg_replace that strips only [ ] < >, and passes the value through do_shortcode into wcpt_style__sticky_sidebar(), where it is interpolated verbatim into inline CSS ('top: {$top}px;' and 'max-height: calc(100vh - {$top}px);') with no numeric casting or CSS escaping. This makes it possible for unauthenticated attackers to inject arbitrary CSS declarations and rules on pages rendering a product table with sticky sidebar enabled, which can be leveraged for data exfiltration (via attribute-selector + background-image URLs), UI redressing, and phishing that bypasses CSPs permitting inline styles.
Product
WC Product Table Lite
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update WC Product Table Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026ProSolution WP Client: Arbitrary file deletionCVE-2026-14524 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the proSol_fileDeleteProcess function in all versions up to, and including, 2.0.8. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker must first call the proSol_fileUploadModalProcess handler to poison their own session with a path-traversal key, then call proSol_fileDeleteProcess with that key as the filename parameter; both steps require only the publicly exposed frontend nonce.
Product
ProSolution WP Client
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update ProSolution WP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026PPWP – Password Protect WordPress | #1 Most-Reviewed Password: Insecure Direct Object ReferenceCVE-2025-10005 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content.
Product
PPWP – Password Protect WordPress | #1 Most-Reviewed Password
Affected
up to 1.9.20
What to do
Affects up to 1.9.20. Update PPWP – Password Protect WordPress | #1 Most-Reviewed Password to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Aug 15, 2026Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!: Remote Code ExecutionCVE-2026-18438 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately's entire REST API — including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) — is authorized only by a current_user_can('delete_posts') check, with no administrator or manage_options capabili
Product
Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Real Estate Manager Pro: Privilege EscalationCVE-2026-15142 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.
Product
Real Estate Manager Pro
Affected
up to 12.8.6
What to do
Affects up to 12.8.6. Update Real Estate Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wp-rem.com wordfence.com
Aug 15, 2026User Profile Builder: Authentication BypassCVE-2026-15826 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
Product
User Profile Builder
Affected
up to 3.16.4
What to do
Affects up to 3.16.4. Update User Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Backup Migration: Does not properly restrict a post-restore automatic login mechanismCVE-2026-18216 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
Product
Backup Migration
Fixed in
2.1.7
What to do
Update Backup Migration to 2.1.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 15, 2026Product Feed PRO for WooCommerce by AdTribes: Does not perform an authorization check on one of its REST read routesCVE-2026-16611 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.
Product
Product Feed PRO for WooCommerce by AdTribes
Fixed in
13.5.7
What to do
Update Product Feed PRO for WooCommerce by AdTribes to 13.5.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 14, 2026Propovoice: All-in-One Client Management System: Privilege EscalationCVE-2026-15312 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.
Product
Propovoice: All-in-One Client Management System
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.