Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

290 results · page 2 of 6

Jul 17, 2026Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit: Privilege EscalationCVE-2026-15982 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.
Product
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record coderevolution.ro wordfence.com
Jul 16, 2026Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Arbitrary file deletionCVE-2026-15008 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function in all versions up to, and including, 7.3.1.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a Forminator form connected to an Uncanny Automator recipe configured for 'Everyone', allowing unauthenticated form submissions to supply the malicious serialized payload; a gadget chain is present within the plugin via the Action_Helpers_Email __destruct() method, meaning no external gadget library is required.
Product
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
Affected
up to 7.3.1.4
What to do
Affects up to 7.3.1.4. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026AI Chatbot & Workflow Automation by AIWU: Authorization bypassCVE-2026-6804 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.
Product
AI Chatbot & Workflow Automation by AIWU
Affected
up to 1.4.12
What to do
Affects up to 1.4.12. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026AI Chatbot & Workflow Automation by AIWU: Missing AuthorizationCVE-2026-6803 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, as the base controller's getPermissions() returns an empty array and neither removeGroup nor clear are added to getNoncedMethods(), causing the authorization gate to unconditionally return true for these actions. This makes it possible for unauthenticated attackers to delete specific records by ID or delete all records from any module's database table by unauthenticated attackers.
Product
AI Chatbot & Workflow Automation by AIWU
Affected
up to 1.4.12
What to do
Affects up to 1.4.12. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Generic SQL InjectionCVE-2026-12918 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to generic SQL Injection via the 'recipients' parameter in all versions up to, and including, 1.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the malicious payload is first stored unsanitized via a POST request to /mrm/v1/campaigns/ (bypassing filter_recipients() validation because an int-cast of a string like '1) OR ...' evaluates to a real numeric ID), and is then triggered by a subsequent GET request to /mrm/v1/campaigns/{id} that deserializes the recipients and passes the raw id string through array_column() into the vulnerable query.
Product
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Affected
up to 1.24.1
What to do
Affects up to 1.24.1. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Time-based SQL InjectionCVE-2026-14342 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Affected
up to 1.24.2
What to do
Affects up to 1.24.2. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Stored Cross-Site ScriptingCVE-2026-12170 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute in all versions up to, and including, 10.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 10.10.2
What to do
Affects up to 10.10.2. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 7, 2026uncanny-automator-pro: Was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7CVE-2026-12375 · WordPress plugins & themes · reported by WPScanCritical 9.8
The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled servers.
Product
uncanny-automator-pro
Fixed in
7.3.0.6
What to do
Update uncanny-automator-pro to 7.3.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Jul 2, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Generic SQL InjectionCVE-2026-14029 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to hold a Groundhogg custom role with the view_contacts capability, which is granted by default to several built-in Groundhogg roles above the base subscriber level.
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
Affected
up to 4.5.8
What to do
Affects up to 4.5.8. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026Slim SEO – A Fast & Automated SEO Plugin For: Unauthorized Private Content DisclosureCVE-2026-12408 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint. This is due to the endpoint's `permission_callback` performing only a top-level `edit_posts` capability check without verifying that the requesting user has read access to the specific post supplied via the `object.ID` parameter, allowing the `generate` function to pass the attacker-controlled post ID to `Data::get_post_content()`, which calls `get_post()` regardless of post status or ownership. This makes it possible for authenticated attackers with Contributor-level access and above to retrieve AI-generated summaries of the raw `post_content` of arbitrary posts they are not authorized to view — including private posts, drafts, pending, future, and password-protected content authored by other users — with the substance of the protected content disclosed via the HTTP response.
Product
Slim SEO – A Fast & Automated SEO Plugin For
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update Slim SEO – A Fast & Automated SEO Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Generic SQL InjectionCVE-2026-13333 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via 'query[select]' Parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Representative-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitized Contact_Query code path can be bypassed by supplying an invalid filter type (e.g., query[filters][0][0][type]=invalid_filter_nonexistent), causing a FilterException to be caught and execution to fall through to the unsanitized Legacy_Contact_Query path.
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Generic SQL InjectionCVE-2026-13331 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with marketer-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
Affected
up to 4.5.5
What to do
Affects up to 4.5.5. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.CVE-2026-57325 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.CVE-2026-56057 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.CVE-2026-56045 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.CVE-2026-56031 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Generic SQL InjectionCVE-2026-13226 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Sales Manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and performs no nonce verification, meaning any authenticated user regardless of role can reach the vulnerable code path.
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update Groundhogg — CRM, Newsletters, and Marketing Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 25, 2026Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.CVE-2026-54844 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 19, 2026Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: Server-Side Request ForgeryCVE-2026-11989 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.7 via the upload_attachment. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires a form integration to be configured with a field mapped to a WooCommerce product image, product gallery, downloadable files, or Google Contacts attachment field, which is a default use case for these integrations.
Product
Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
Affected
up to 2.8.7
What to do
Affects up to 2.8.7. Update Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2026weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce: Does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected CVE-2026-8089 · WordPress plugins & themes · reported by WPScanHigh 7.1
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.
Product
weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce
Fixed in
2.1.3
What to do
Update weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce to 2.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.CVE-2026-52698 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 16, 2026Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.CVE-2026-39581 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.CVE-2026-49776 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.
Affected
up to 2.32.6
What to do
Affects up to 2.32.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.CVE-2026-42775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.
Affected
up to 5.7.2
What to do
Affects up to 5.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions.CVE-2026-42650 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions.
Affected
up to 5.6.7
What to do
Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.CVE-2026-40785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.
Affected
up to 5.6.7
What to do
Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.CVE-2026-39450 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 13, 2026GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites: Stored Cross-Site ScriptingCVE-2026-9109 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The deterministically derived API key (sha256 of the site URL) is printed in the HTML source of every page via the JavaScript variable gptApiKey, meaning any unauthenticated visitor can retrieve the key and submit malicious translation payloads to the /wp-json/gptranslate/v1/request endpoint without any additional precondition.
Product
GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites
Affected
up to 2.31
What to do
Affects up to 2.31. Update GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2026MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Stored Cross-Site ScriptingCVE-2026-8599 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The public-facing campaign preview endpoint (/mp-email/{id}-slug/) is not affected by this vulnerability, as it applies a Content-Security-Policy header blocking all inline scripts; exploitation is limited to the admin dashboard preview.
Product
MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2026RomanCart Ecommerce: Stored Cross-Site ScriptingCVE-2026-8880 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes) of the romancart_button shortcode in versions up to, and including, 2.0.8. This is due to insufficient input sanitization and output escaping on user supplied attributes within the romancart_button_shortcode() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
RomanCart Ecommerce
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update RomanCart Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 7, 2026WordPress Plugin WP24 Domain Check 1.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts byCVE-2021-47984 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Plugin WP24 Domain Check 1.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the fieldnameDomain parameter. Attackers can inject JavaScript payloads through the plugin settings form at options.php that execute in the browsers of administrators viewing the settings page.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 28, 2026Crawlomatic Multipage Scraper Post Generator: Remote Code ExecutionCVE-2026-9009 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.7.2 via the filter_content function. This is due to passing the attacker-supplied 'callback_raw' shortcode attribute directly into call_user_func() with no sanitization or allowlist validation, relying solely on an is_callable() check that permits dangerous PHP built-ins such as system, shell_exec, exec, passthru, and assert. This makes it possible for authenticated attackers, with author-level access and above, to execute code on the server. An identical sink exists for the 'callback' attribute, providing a second independent vector through the same shortcode.
Product
Crawlomatic Multipage Scraper Post Generator
Affected
up to 2.7.2
What to do
Affects up to 2.7.2. Update Crawlomatic Multipage Scraper Post Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 22, 2026FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution: Blind Server-Side Request ForgeryCVE-2026-7798 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the 'SubscribeURL' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key ('_fc_bounce_key') has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.
Product
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
Affected
up to 2.9.87
What to do
Affects up to 2.9.87. Update FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 20, 2026Anomify AI – Anomaly Detection and Alerting: Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)CVE-2026-6405 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in versions up to and including 0.3.6. This is due to missing nonce verification on the settings page handler and insufficient output escaping in the admin_options.php template. The settings form includes no wp_nonce_field() and the handler performs no check_admin_referer() check, meaning any cross-origin POST can modify plugin settings. The API key field is sanitized only with sanitize_text_field(), which strips HTML tags but does not encode double-quote characters; the value is then rendered into an HTML attribute via bare echo without esc_attr(), allowing a double-quote attribute-escape payload to survive both sanitization and storage. This makes it possible for unauthenticated attackers to inject arbitrary web scripts by tricking a logged-in administrator into visiting a malicious page that submits a forged request, storing the payload in the database and causing it to execute in the administrator's browser whenever the plugin settings page is visited.
Product
Anomify AI – Anomaly Detection and Alerting
Affected
up to 0.3.6
What to do
Affects up to 0.3.6. Update Anomify AI – Anomaly Detection and Alerting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 20, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Missing AuthorizationCVE-2026-5200 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 10.8.2
What to do
Affects up to 10.8.2. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 20, 2026AI Chatbot & Workflow Automation by AIWU: Stored Cross-Site ScriptingCVE-2026-2955 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Practical exploitation is constrained due to a 20-character storage limit.
Product
AI Chatbot & Workflow Automation by AIWU
Affected
up to 1.4.14
What to do
Affects up to 1.4.14. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 19, 2026Anomify AI – Anomaly Detection and Alerting: Stored Cross-Site ScriptingCVE-2026-6404 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'anomify_api_key' parameter in versions up to and including 0.3.6. This is due to insufficient input sanitization and missing output escaping: the plugin applies sanitize_text_field() to the Metric Data Key input before saving it via update_option(), but sanitize_text_field() strips HTML tags without encoding double-quote characters, and the value is then echoed directly into an HTML attribute context (value="...") without esc_attr(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that execute whenever a user visits the plugin's settings page.
Product
Anomify AI – Anomaly Detection and Alerting
Affected
up to 0.3.6
What to do
Affects up to 0.3.6. Update Anomify AI – Anomaly Detection and Alerting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript byCVE-2020-37225 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Powie's WHOIS Domain Check 0.9.31 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by exploiting unsanitized input fields in plugin settings. Attackers can submit malicious payloads through textarea and input elements in the pwhois_settings.php configuration page to execute JavaScript in the admin context and escalate privileges.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.haao.sh powie.de
May 12, 2026AI Chatbot & Workflow Automation by AIWU: SQL InjectionCVE-2026-2993 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query in the getListForTbl() function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This issue is partially mitigated by a patch in version 1.4.11 that adds a nonce check for a nonce that is only available to administrators.
Product
AI Chatbot & Workflow Automation by AIWU
Affected
up to 1.4.17
What to do
Affects up to 1.4.17. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 8, 2026OttoKit: All-in-One Automation Platform: Does not properly sanitize user input before using it in a SQL statementCVE-2026-4935 · WordPress plugins & themes · reported by WPScanHigh 8.6
The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
Product
OttoKit: All-in-One Automation Platform
Fixed in
1.1.23
What to do
Update OttoKit: All-in-One Automation Platform to 1.1.23 or newer.
Full record and what to do →NVD record wpscan.com
Apr 8, 2026Precious Metals Automated Product Pricing – Pro: Missing AuthorizationCVE-2026-39704 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.
Product
Precious Metals Automated Product Pricing – Pro
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Precious Metals Automated Product Pricing – Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026AI Workflow Automation: Missing AuthorizationCVE-2026-39699 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in massiveshift AI Workflow Automation ai-workflow-automation-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Workflow Automation: from n/a through <= 1.4.2.
Product
AI Workflow Automation
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update AI Workflow Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Automated FedEx live/manual rates with shipping labels: Missing AuthorizationCVE-2026-25456 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automated FedEx live/manual rates with shipping labels: from n/a through <= 5.1.9.
Product
Automated FedEx live/manual rates with shipping labels
Affected
up to 5.1.9
What to do
Affects up to 5.1.9. Update Automated FedEx live/manual rates with shipping labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WP Sessions Time Monitoring Full Automatic: Missing AuthorizationCVE-2026-32362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.3.
Product
WP Sessions Time Monitoring Full Automatic
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 7, 2026Infomaniak Connect for OpenID: Stored Cross-Site ScriptingCVE-2026-1824 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Infomaniak Connect for OpenID plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'endpoint_login' parameter of the infomaniak_connect_generic_auth_url shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Infomaniak Connect for OpenID
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Infomaniak Connect for OpenID to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Chroma: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28020 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Chroma chroma allows PHP Local File Inclusion.This issue affects Chroma: from n/a through <= 1.11.
Product
Chroma
Affected
up to 1.11
What to do
Affects up to 1.11. Update Chroma to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 2, 2026Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Server-Side Request ForgeryCVE-2026-2269 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.0.3 via the download_url() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additionally, the plugin stores the contents of the remote files on the server, which can be leveraged to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
Affected
up to 7.0.0.3
What to do
Affects up to 7.0.0.3. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2026weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation: Unauthorized form deletionCVE-2025-14339 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the `weMail` JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to the forms endpoint.
Product
weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2026Zoho ZeptoMail: Missing AuthorizationCVE-2025-67972 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9.
Product
Zoho ZeptoMail
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Zoho ZeptoMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Automatic Featured Images from Videos: Missing AuthorizationCVE-2026-24535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7.
Product
Automatic Featured Images from Videos
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.