Vulnerability database

7,718 results · page 19 of 155

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.CVE-2026-66700 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.CVE-2026-66698 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

  Affected

  up to 1.10.1

  What to do

  Affects up to 1.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.CVE-2026-66697 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.

  Affected

  up to 2.10.0

  What to do

  Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.CVE-2026-66687 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.CVE-2026-66655 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.

  Affected

  up to 1.30.36

  What to do

  Affects up to 1.30.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.CVE-2026-66471 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.

  Affected

  up to 3.0.6

  What to do

  Affects up to 3.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.CVE-2026-66468 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.CVE-2026-66467 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

  Affected

  up to 2.7.5

  What to do

  Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.CVE-2026-66463 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

  Affected

  up to 2.9

  What to do

  Affects up to 2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.CVE-2026-66462 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.

  Affected

  up to 5.3.8

  What to do

  Affects up to 5.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.CVE-2026-66460 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

  Affected

  up to 1.18.1

  What to do

  Affects up to 1.18.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.CVE-2026-66456 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.CVE-2026-66449 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

  Affected

  up to 1.13.18

  What to do

  Affects up to 1.13.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.CVE-2026-66444 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.

  Affected

  up to 4.0.5

  What to do

  Affects up to 4.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.CVE-2026-66443 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.CVE-2026-66441 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

  Affected

  up to 5.0.10

  What to do

  Affects up to 5.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.CVE-2026-66432 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.

  Affected

  up to 7.0.2.1

  What to do

  Affects up to 7.0.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-66429 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

  Affected

  up to 11.10

  What to do

  Affects up to 11.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.CVE-2026-66426 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

  Affected

  up to 2.56

  What to do

  Affects up to 2.56. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.CVE-2026-65580 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.CVE-2026-61974 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.CVE-2026-61965 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.CVE-2026-61962 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

  Affected

  up to 6.3.0

  What to do

  Affects up to 6.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.CVE-2026-61960 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

  Affected

  up to 8.5.0

  What to do

  Affects up to 8.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.CVE-2026-28187 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

  Affected

  up to 17.211.0

  What to do

  Affects up to 17.211.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.CVE-2026-28182 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

  Affected

  up to 10.11.1

  What to do

  Affects up to 10.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.CVE-2026-28175 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

  Affected

  up to 8.11

  What to do

  Affects up to 8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.CVE-2026-28174 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.

  Affected

  up to 4.1.18

  What to do

  Affects up to 4.1.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.CVE-2026-28170 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

  Affected

  up to 1.4.20

  What to do

  Affects up to 1.4.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.CVE-2026-28158 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

  Affected

  up to 358

  What to do

  Affects up to 358. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.CVE-2026-28004 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

  Affected

  up to 6.4.25

  What to do

  Affects up to 6.4.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.CVE-2026-28003 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

  Affected

  up to 2.9.1

  What to do

  Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.CVE-2026-27544 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

  Affected

  up to 5.2.0.0

  What to do

  Affects up to 5.2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.CVE-2026-27539 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

  Affected

  up to 2.11.31

  What to do

  Affects up to 2.11.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.CVE-2026-27537 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

  Affected

  up to 1.11.2

  What to do

  Affects up to 1.11.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.CVE-2026-27536 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

  Affected

  up to 4.3.3

  What to do

  Affects up to 4.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.CVE-2026-27535 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 13, 2026Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.CVE-2026-27345 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 12, 2026Kirki: Does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode executionCVE-2026-16747 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.

  Product

  Kirki

  Fixed in

  6.2.1

  What to do

  Update Kirki to 6.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026ProSolution WP Client: Does not perform capability checks on two administrative AJAX actionsCVE-2026-19052 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.

  Product

  ProSolution WP Client

  Fixed in

  2.0.9

  What to do

  Update ProSolution WP Client to 2.0.9 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026WPC Admin Columns: Does not have authorisation checks in one of its AJAX actionsCVE-2026-18943 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.

  Product

  WPC Admin Columns

  Fixed in

  2.3.4

  What to do

  Update WPC Admin Columns to 2.3.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Ezoic: Does not properly restrict access to some of its content export functionalityCVE-2026-18789 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.

  Product

  Ezoic

  Fixed in

  2.23.1

  What to do

  Update Ezoic to 2.23.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-18230 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

  Product

  WP Directory Kit

  Fixed in

  1.5.6

  What to do

  Update WP Directory Kit to 1.5.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Total Upkeep: Does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated usersCVE-2026-16253 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin.

  Product

  Total Upkeep

  Fixed in

  1.17.3

  What to do

  Update Total Upkeep to 1.17.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026Import WP: Does not perform any authorization check on one of its export-file download handlersCVE-2026-14925 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.

  Product

  Import WP

  Fixed in

  2.14.23

  What to do

  Update Import WP to 2.14.23 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 12, 2026WP Crowdfunding: Does not check the campaign-submission capability in one of its AJAX actionsCVE-2026-14859 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.

  Product

  WP Crowdfunding

  Fixed in

  2.2.1

  What to do

  Update WP Crowdfunding to 2.2.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 11, 2026InstaWP Connect – 1-click WP Staging & Migration: Remote Code ExecutionCVE-2026-13457 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.

  Product

  InstaWP Connect – 1-click WP Staging & Migration

  Affected

  up to 0.1.3.6

  What to do

  Affects up to 0.1.3.6. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 11, 2026Ray Enterprise Translation: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-14549 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.

  Product

  Ray Enterprise Translation

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 11, 2026Ray Enterprise Translation: Does not perform any capability or nonce checks on one of its AJAX actionsCVE-2026-14548 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.

  Product

  Ray Enterprise Translation

  Affected

  up to 1.7.3

  What to do

  Affects up to 1.7.3. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 10, 2026FoodBoxBooker: Does not verify that the user account being updated belongs to the user making the requestCVE-2026-18200 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.

  Product

  FoodBoxBooker

  Fixed in

  1.0.8

  What to do

  Update FoodBoxBooker to 1.0.8 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.