Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,937 results · page 185 of 819
Mar 13, 2026Studio99 WP Monitor: Missing AuthorizationCVE-2026-32404 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Studio99 Studio99 WP Monitor studio99-wp-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Studio99 WP Monitor: from n/a through <= 1.0.3.
- Product
- Studio99 WP Monitor
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Studio99 WP Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Toocheke Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32403 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Toocheke Companion toocheke-companion allows DOM-Based XSS.This issue affects Toocheke Companion: from n/a through <= 1.194.
- Product
- Toocheke Companion
- Affected
- up to 1.194
- What to do
- Affects up to 1.194. Update Toocheke Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Image Slider by Ays: Missing AuthorizationCVE-2026-32402 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1.
- Product
- Image Slider by Ays
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Image Slider by Ays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Client Invoicing by Sprout Invoices: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32401 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows PHP Local File Inclusion.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.9.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.9
- What to do
- Affects up to 20.8.9. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Boldman: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32400 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion.This issue affects Boldman: from n/a through <= 7.7.
- Product
- Boldman
- Affected
- up to 7.7
- What to do
- Affects up to 7.7. Update Boldman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Media LIbrary Assistant: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32399 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.
- Product
- Media LIbrary Assistant
- Affected
- up to 3.32
- What to do
- Affects up to 3.32. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026TeraWallet – For WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-32398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-wallet allows Leveraging Race Conditions.This issue affects TeraWallet – For WooCommerce: from n/a through <= 1.5.15.
- Product
- TeraWallet – For WooCommerce
- Affected
- up to 1.5.15
- What to do
- Affects up to 1.5.15. Update TeraWallet – For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Filter & Grids: Missing AuthorizationCVE-2026-32397 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter & Grids: from n/a through <= 3.5.1.
- Product
- Filter & Grids
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Team: Missing AuthorizationCVE-2026-32396 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.13.
- Product
- Team
- Affected
- up to 5.0.13
- What to do
- Affects up to 5.0.13. Update Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Xpro Addons For Beaver Builder – Lite: Missing AuthorizationCVE-2026-32395 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-beaver-builder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Addons For Beaver Builder – Lite: from n/a through <= 1.5.6.
- Product
- Xpro Addons For Beaver Builder – Lite
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Xpro Addons For Beaver Builder – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026PublishPress Capabilities: Missing AuthorizationCVE-2026-32394 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through <= 2.31.0.
- Product
- PublishPress Capabilities
- Affected
- up to 2.31.0
- What to do
- Affects up to 2.31.0. Update PublishPress Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Greenly Theme Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32393 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Greenly Theme Addons greenly-addons allows PHP Local File Inclusion.This issue affects Greenly Theme Addons: from n/a through < 8.2.
- Product
- Greenly Theme Addons
- What to do
- Update Greenly Theme Addons to the newest version.
Mar 13, 2026Greenly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32392 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Greenly greenly allows PHP Local File Inclusion.This issue affects Greenly: from n/a through <= 8.1.
- Product
- Greenly
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update Greenly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026SmartFix: Missing AuthorizationCVE-2026-32391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in linethemes SmartFix smartfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartFix: from n/a through < 1.2.4.
- Product
- SmartFix
- What to do
- Update SmartFix to the newest version.
Mar 13, 2026Nanosoft: Missing AuthorizationCVE-2026-32390 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in linethemes Nanosoft nanosoft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nanosoft: from n/a through < 1.3.2.
- Product
- Nanosoft
- What to do
- Update Nanosoft to the newest version.
Mar 13, 2026GLB: Missing AuthorizationCVE-2026-32388 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in linethemes GLB glb allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GLB: from n/a through <= 1.2.2.
- Product
- GLB
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update GLB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Checkout for PayPal: Missing AuthorizationCVE-2026-32387 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout for PayPal: from n/a through <= 1.0.46.
- Product
- Checkout for PayPal
- Affected
- up to 1.0.46
- What to do
- Affects up to 1.0.46. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Envo Extra: Missing AuthorizationCVE-2026-32386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.13.
- Product
- Envo Extra
- Affected
- up to 1.9.13
- What to do
- Affects up to 1.9.13. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026RegistrationMagic: Missing AuthorizationCVE-2026-32385 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.6
- What to do
- Affects up to 6.0.7.6. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WpBookingly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32384 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.
- Product
- WpBookingly
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update WpBookingly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Ridhi: Missing AuthorizationCVE-2026-32383 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Ridhi ridhi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ridhi: from n/a through <= 1.1.2.
- Product
- Ridhi
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ridhi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Digital Download: Missing AuthorizationCVE-2026-32382 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Digital Download digital-download allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Digital Download: from n/a through <= 1.1.4.
- Product
- Digital Download
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Digital Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026App Landing Page: Missing AuthorizationCVE-2026-32381 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through <= 1.2.2.
- Product
- App Landing Page
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update App Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Numinous: Missing AuthorizationCVE-2026-32380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Numinous numinous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Numinous: from n/a through <= 1.3.0.
- Product
- Numinous
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Numinous to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Rara Academic: Missing AuthorizationCVE-2026-32379 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Rara Academic rara-academic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rara Academic: from n/a through <= 1.2.2.
- Product
- Rara Academic
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Rara Academic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Book Landing Page: Missing AuthorizationCVE-2026-32378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Book Landing Page book-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Landing Page: from n/a through <= 1.2.7.
- Product
- Book Landing Page
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Book Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Pranayama Yoga: Missing AuthorizationCVE-2026-32377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Pranayama Yoga pranayama-yoga allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pranayama Yoga: from n/a through <= 1.2.2.
- Product
- Pranayama Yoga
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Pranayama Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Kalon: Missing AuthorizationCVE-2026-32376 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Kalon kalon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalon: from n/a through <= 1.2.9.
- Product
- Kalon
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Kalon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Travel Diaries: Missing AuthorizationCVE-2026-32375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Travel Diaries travel-diaries allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Diaries: from n/a through <= 1.2.4.
- Product
- Travel Diaries
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Travel Diaries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026The Minimal: Missing AuthorizationCVE-2026-32374 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme The Minimal the-minimal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Minimal: from n/a through <= 1.2.9.
- Product
- The Minimal
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update The Minimal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026SMS Alert Order Notifications: Missing AuthorizationCVE-2026-32373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.9.0.
- Product
- SMS Alert Order Notifications
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-32372 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Retrieve Embedded Sensitive Data.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 3.2.4.
- Product
- ShopBuilder – Elementor WooCommerce Builder Addons
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Elegant Pink: Missing AuthorizationCVE-2026-32371 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Elegant Pink elegant-pink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elegant Pink: from n/a through <= 1.3.3.
- Product
- Elegant Pink
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Elegant Pink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Influencer: Missing AuthorizationCVE-2026-32370 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Influencer influencer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Influencer: from n/a through <= 1.1.7.
- Product
- Influencer
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Influencer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Medilink-Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32369 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Medilink-Core medilink-core allows PHP Local File Inclusion.This issue affects Medilink-Core: from n/a through < 2.0.7.
- Product
- Medilink-Core
- What to do
- Update Medilink-Core to the newest version.
Mar 13, 2026Geo to Lat: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32368 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through <= 1.0.19.
- Product
- Geo to Lat
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Geo to Lat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Modal Dialog: Improper Control of Generation of Code ('Code Injection')CVE-2026-32367 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue affects Modal Dialog: from n/a through <= 3.5.16.
- Product
- Modal Dialog
- Affected
- up to 3.5.16
- What to do
- Affects up to 3.5.16. Update Modal Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Collapsing Categories: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32366 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through <= 3.0.9.
- Product
- Collapsing Categories
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update Collapsing Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Collapsing Archives: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32365 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through <= 3.0.7.
- Product
- Collapsing Archives
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Collapsing Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Turbo Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32364 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in redqteam Turbo Manager turbo-manager allows PHP Local File Inclusion.This issue affects Turbo Manager: from n/a through < 4.0.8.
- Product
- Turbo Manager
- What to do
- Update Turbo Manager to the newest version.
Mar 13, 2026WPLifeCycle: Missing AuthorizationCVE-2026-32363 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Funlus Oy WPLifeCycle free-php-version-info allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLifeCycle: from n/a through <= 3.3.1.
- Product
- WPLifeCycle
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update WPLifeCycle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WP Sessions Time Monitoring Full Automatic: Missing AuthorizationCVE-2026-32362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.3.
- Product
- WP Sessions Time Monitoring Full Automatic
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Editorial Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows DOM-Based XSS.This issue affects Editorial Calendar: from n/a through <= 3.9.0.
- Product
- Editorial Calendar
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Rich Showcase for Google Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32360 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richplugins Rich Showcase for Google Reviews widget-google-reviews allows Stored XSS.This issue affects Rich Showcase for Google Reviews: from n/a through <= 6.9.4.3.
- Product
- Rich Showcase for Google Reviews
- Affected
- up to 6.9.4.3
- What to do
- Affects up to 6.9.4.3. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Icon List Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32359 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.2.3.
- Product
- Icon List Block
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Icon List Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32358 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through <= 10.14.15.
- Product
- Booking Calendar
- Affected
- up to 10.14.15
- What to do
- Affects up to 10.14.15. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Simple Blog Card: Server-Side Request Forgery (SSRF)CVE-2026-32357 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37.
- Product
- Simple Blog Card
- Affected
- up to 2.37
- What to do
- Affects up to 2.37. Update Simple Blog Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Robo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32356 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows DOM-Based XSS.This issue affects Robo Gallery: from n/a through <= 5.1.2.
- Product
- Robo Gallery
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026JetEngine: Deserialization of Untrusted DataCVE-2026-32355 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
- Product
- JetEngine
- What to do
- Update JetEngine to the newest version.
Mar 13, 2026WpEvently: Insertion of Sensitive Information Into Sent DataCVE-2026-32354 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through < 5.1.9.
- Product
- WpEvently
- What to do
- Update WpEvently to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.