Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

277new WordPress flaws this week

393,915entries in the database

40,937 results · page 184 of 819

Mar 13, 2026Admin Menu Editor: Cross-Site Request Forgery (CSRF)CVE-2026-32456 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor admin-menu-editor allows Cross Site Request Forgery.This issue affects Admin Menu Editor: from n/a through <= 1.14.1.
Product
Admin Menu Editor
Affected
up to 1.14.1
What to do
Affects up to 1.14.1. Update Admin Menu Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026MDTF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32455 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows DOM-Based XSS.This issue affects MDTF: from n/a through <= 1.3.5.
Product
MDTF
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update MDTF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Avada Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Avada Core fusion-core allows DOM-Based XSS.This issue affects Avada Core: from n/a through < 5.15.0.
Product
Avada Core
What to do
Update Avada Core to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Avada Core: Missing AuthorizationCVE-2026-32453 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through < 5.15.0.
Product
Avada Core
What to do
Update Avada Core to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Fusion Builder: Missing AuthorizationCVE-2026-32452 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
Product
Fusion Builder
What to do
Update Fusion Builder to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Fusion Builder: Missing AuthorizationCVE-2026-32451 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through < 3.15.0.
Product
Fusion Builder
What to do
Update Fusion Builder to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Active Products Tables for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32450 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.7.
Product
Active Products Tables for WooCommerce
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Themify Event Post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32449 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows Stored XSS.This issue affects Themify Event Post: from n/a through <= 1.3.4.
Product
Themify Event Post
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Themify Event Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Podlove Podcast Publisher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32448 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through <= 4.3.3.
Product
Podlove Podcast Publisher
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update Podlove Podcast Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Atarim: Missing AuthorizationCVE-2026-32447 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.2.
Product
Atarim
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update Atarim to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Contact Form by WPForms: Missing AuthorizationCVE-2026-32446 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by WPForms: from n/a through <= 1.9.9.3.
Product
Contact Form by WPForms
Affected
up to 1.9.9.3
What to do
Affects up to 1.9.9.3. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Elementor Website Builder: Missing AuthorizationCVE-2026-32445 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.
Product
Elementor Website Builder
Affected
up to 3.35.5
What to do
Affects up to 3.35.5. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Product Feed PRO for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2026-32443 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.
Product
Product Feed PRO for WooCommerce
Affected
up to 13.5.2
What to do
Affects up to 13.5.2. Update Product Feed PRO for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026e2pdf: Missing AuthorizationCVE-2026-32442 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.
Product
e2pdf
Affected
up to 1.28.15
What to do
Affects up to 1.28.15. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WP Food: Missing AuthorizationCVE-2026-32440 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.
Product
WP Food
What to do
Update WP Food to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026BigHearts: Missing AuthorizationCVE-2026-32439 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BigHearts: from n/a through <= 3.1.14.
Product
BigHearts
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update BigHearts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026VW School Education: Missing AuthorizationCVE-2026-32438 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.
Product
VW School Education
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update VW School Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026VW Portfolio: Missing AuthorizationCVE-2026-32437 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.
Product
VW Portfolio
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update VW Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026VW Photography: Missing AuthorizationCVE-2026-32436 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.
Product
VW Photography
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update VW Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026VW Pet Shop: Missing AuthorizationCVE-2026-32435 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.
Product
VW Pet Shop
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update VW Pet Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026VW Fitness: Missing AuthorizationCVE-2026-32434 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.
Product
VW Fitness
Affected
up to 4.3.4
What to do
Affects up to 4.3.4. Update VW Fitness to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026CP Contact Form with Paypal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32433 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: from n/a through <= 1.3.61.
Product
CP Contact Form with Paypal
Affected
up to 1.3.61
What to do
Affects up to 1.3.61. Update CP Contact Form with Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WP Time Slots Booking Form: Missing AuthorizationCVE-2026-32432 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.42.
Product
WP Time Slots Booking Form
Affected
up to 1.2.42
What to do
Affects up to 1.2.42. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Astra Bulk Edit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32431 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.
Product
Astra Bulk Edit
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Astra Bulk Edit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026PowerPack Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32430 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through <= 2.9.9.
Product
PowerPack Addons for Elementor
Affected
up to 2.9.9
What to do
Affects up to 2.9.9. Update PowerPack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Magical Addons For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32429 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through <= 1.4.1.
Product
Magical Addons For Elementor
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Magical Addons For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Popup Like box: Missing AuthorizationCVE-2026-32428 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Like box: from n/a through <= 3.7.7.
Product
Popup Like box
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update Popup Like box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026VW Education Lite: Missing AuthorizationCVE-2026-32427 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Education Lite: from n/a through <= 2.2.0.
Product
VW Education Lite
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update VW Education Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Medilazar Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32426 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion.This issue affects Medilazar Core: from n/a through < 1.4.7.
Product
Medilazar Core
What to do
Update Medilazar Core to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Payment Gateway Pix For GiveWP: Missing AuthorizationCVE-2026-32425 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in linknacional Payment Gateway Pix For GiveWP payment-gateway-pix-for-givewp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Pix For GiveWP: from n/a through <= 2.2.3.
Product
Payment Gateway Pix For GiveWP
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update Payment Gateway Pix For GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Sprout Clients: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS.This issue affects Sprout Clients: from n/a through <= 3.2.2.
Product
Sprout Clients
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Sprout Clients to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Admin and Site Enhancements (ASE): Missing AuthorizationCVE-2026-32423 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.4.0.
Product
Admin and Site Enhancements (ASE)
Affected
up to 8.4.0
What to do
Affects up to 8.4.0. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WP EasyCart: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32422 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through <= 5.8.13.
Product
WP EasyCart
Affected
up to 5.8.13
What to do
Affects up to 5.8.13. Update WP EasyCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Post Timeline: Missing AuthorizationCVE-2026-32421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Agile Logix Post Timeline post-timeline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Timeline: from n/a through <= 2.4.1.
Product
Post Timeline
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Post Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026GamiPress: Cross-Site Request Forgery (CSRF)CVE-2026-32420 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6.
Product
GamiPress
Affected
up to 7.6.6
What to do
Affects up to 7.6.6. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026List category posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32419 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Briano List category posts list-category-posts allows DOM-Based XSS.This issue affects List category posts: from n/a through <= 0.93.1.
Product
List category posts
Affected
up to 0.93.1
What to do
Affects up to 0.93.1. Update List category posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Meow Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32418 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Blind SQL Injection.This issue affects Meow Gallery: from n/a through <= 5.4.4.
Product
Meow Gallery
Affected
up to 5.4.4
What to do
Affects up to 5.4.4. Update Meow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Pochipp: Missing AuthorizationCVE-2026-32417 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through < 1.18.9.
Product
Pochipp
What to do
Update Pochipp to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026PDF Poster: Missing AuthorizationCVE-2026-32416 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Poster: from n/a through <= 2.4.0.
Product
PDF Poster
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update PDF Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Squeeze: Path Traversal: '.../...//'CVE-2026-32415 · WordPress plugins & themes · reported by PatchstackMedium 5
Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.This issue affects Squeeze: from n/a through <= 1.7.7.
Product
Squeeze
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Squeeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Advanced Woo Labels: Improper Control of Generation of Code ('Code Injection')CVE-2026-32414 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Control of Generation of Code ('Code Injection') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Remote Code Inclusion.This issue affects Advanced Woo Labels: from n/a through <= 2.36.
Product
Advanced Woo Labels
Affected
up to 2.36
What to do
Affects up to 2.36. Update Advanced Woo Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Permalink Manager Lite: Missing AuthorizationCVE-2026-32413 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Permalink Manager Lite: from n/a through < 2.5.3.
Product
Permalink Manager Lite
What to do
Update Permalink Manager Lite to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Gift Up Gift Cards for WordPress and WooCommerce: Server-Side Request Forgery (SSRF)CVE-2026-32412 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in Gift Up! Gift Up Gift Cards for WordPress and WooCommerce gift-up allows Server Side Request Forgery.This issue affects Gift Up Gift Cards for WordPress and WooCommerce: from n/a through <= 3.1.7.
Product
Gift Up Gift Cards for WordPress and WooCommerce
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update Gift Up Gift Cards for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Embed Calendly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32411 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simpma Embed Calendly embed-calendly-scheduling allows Stored XSS.This issue affects Embed Calendly: from n/a through <= 4.4.
Product
Embed Calendly
Affected
up to 4.4
What to do
Affects up to 4.4. Update Embed Calendly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WBW Currency Switcher for WooCommerce: Missing AuthorizationCVE-2026-32410 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WBW Currency Switcher for WooCommerce: from n/a through <= 2.2.5.
Product
WBW Currency Switcher for WooCommerce
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WBW Currency Switcher for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Forminator: Missing AuthorizationCVE-2026-32409 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through <= 1.50.2.
Product
Forminator
Affected
up to 1.50.2
What to do
Affects up to 1.50.2. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Brizy: Missing AuthorizationCVE-2026-32408 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.23.
Product
Brizy
Affected
up to 2.7.23
What to do
Affects up to 2.7.23. Update Brizy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WPC Smart Wishlist for WooCommerce: Missing AuthorizationCVE-2026-32407 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Smart Wishlist for WooCommerce: from n/a through <= 5.0.8.
Product
WPC Smart Wishlist for WooCommerce
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update WPC Smart Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WPC Product Bundles for WooCommerce: Missing AuthorizationCVE-2026-32406 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Product Bundles for WooCommerce: from n/a through <= 8.4.5.
Product
WPC Product Bundles for WooCommerce
Affected
up to 8.4.5
What to do
Affects up to 8.4.5. Update WPC Product Bundles for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WoodMart: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-32405 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in xtemos WoodMart woodmart allows Retrieve Embedded Sensitive Data.This issue affects WoodMart: from n/a through <= 8.3.9.
Product
WoodMart
Affected
up to 8.3.9
What to do
Affects up to 8.3.9. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.