Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

4,614 results · page 20 of 93

Aug 18, 2026Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.CVE-2026-32472 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.CVE-2026-32470 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.CVE-2026-32468 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.
Affected
up to 2.11.14
What to do
Affects up to 2.11.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.CVE-2026-32464 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.CVE-2026-32333 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.
Affected
up to 5.4.7
What to do
Affects up to 5.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.CVE-2026-28571 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
Affected
up to 2.15.7
What to do
Affects up to 2.15.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.CVE-2026-28570 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.CVE-2026-28569 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
Affected
up to 4.7.43
What to do
Affects up to 4.7.43. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.CVE-2026-28568 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
Affected
up to 5.7.1
What to do
Affects up to 5.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.CVE-2026-28567 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.CVE-2026-28192 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
Affected
up to 7.1.67
What to do
Affects up to 7.1.67. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 17, 2026ShopSmart Loyalty for WooCommerce: Does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated usersCVE-2026-14832 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
Product
ShopSmart Loyalty for WooCommerce
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update ShopSmart Loyalty for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026The School Management – Education & Learning ERP: Generic SQL InjectionCVE-2026-9767 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation.
Product
The School Management – Education & Learning ERP
Affected
up to 5.4
What to do
Affects up to 5.4. Update The School Management – Education & Learning ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026WPvivid — Backup, Migration & Staging: Does not sanitise a value taken from an unauthenticated request before using it to build a log file pathCVE-2026-19725 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.131
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.131 or newer.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026CatFolders Document Gallery & PDF Library: Does not have authorisation checks in some of its REST API endpointsCVE-2026-19717 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.
Product
CatFolders Document Gallery & PDF Library
Fixed in
2.0.7
What to do
Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026Solace Extra: Unauthorized modification and loss of dataCVE-2026-18316 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() function in versions up to, and including, 1.6.0. The handler is registered on both wp_ajax_action-import-zip and wp_ajax_nopriv_action-import-zip and only verifies the 'ajax-nonce' nonce, which is emitted on every admin page via wp_localize_script (unrestricted admin_enqueue_scripts hook) and is therefore accessible to any authenticated user including Subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to wipe navigation menus, sidebar widgets (via update_option('sidebars_widgets', array())), all theme mods (via remove_theme_mods()), and Elementor templates, as well as trigger arbitrary demo-content imports.
Product
Solace Extra
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Solace Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Manual Image Crop: Does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in userCVE-2026-15384 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.
Product
Manual Image Crop
Fixed in
1.15
What to do
Update Manual Image Crop to 1.15 or newer.
Full record and what to do →NVD record wpscan.com
Aug 15, 2026User Profile Builder: Authentication BypassCVE-2026-15826 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
Product
User Profile Builder
Affected
up to 3.16.4
What to do
Affects up to 3.16.4. Update User Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026User Session Synchronizer: Authentication Bypass leading to Account TakeoverCVE-2026-15341 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` parameters; when `ussync-key` references an unregistered slot, `get_option()` returns `false` for both the secret key and the domain list, causing the AES-256-CBC encryption key to degrade to the fully predictable `md5('')` and the referer allowlist to collapse to an empty-string match, while the AES IV is unconditionally hard-coded as `md5('another-secret')`. This makes it possible for unauthenticated attackers to supply a crafted request encrypting any known or guessable user email address in the `ussync-ref` parameter, causing the handler to call `wp_set_auth_cookie()` for the matched user and granting full authentication as that user — including administrators — with no prior knowledge of site secrets.
Product
User Session Synchronizer
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update User Session Synchronizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 20266Storage Rentals: Authentication bypassCVE-2026-15303 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user resolved by the attacker-supplied email address. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting that user's email address.
Product
6Storage Rentals
Affected
up to 2.27.0
What to do
Affects up to 2.27.0. Update 6Storage Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Object Sync for Salesforce: Unauthenticated SQL InjectionCVE-2026-15162 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpress_object_type value is concatenated directly into a SQL query (post_type = "$object_type", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->get_results() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpress_id (e.g. 1) is required — no authentication or Salesforce connection.
Product
Object Sync for Salesforce
What to do
Update Object Sync for Salesforce to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.CVE-2026-73403 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.CVE-2026-73401 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
Affected
up to 0.1.3.7
What to do
Affects up to 0.1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.CVE-2026-73353 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73349 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.CVE-2026-66704 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.CVE-2026-66700 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.CVE-2026-66698 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
Affected
up to 1.10.1
What to do
Affects up to 1.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.CVE-2026-66697 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.CVE-2026-66691 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.CVE-2026-66689 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.CVE-2026-66660 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.CVE-2026-66657 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.CVE-2026-66656 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.CVE-2026-66655 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
Affected
up to 1.30.36
What to do
Affects up to 1.30.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.CVE-2026-66653 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.CVE-2026-66478 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.CVE-2026-66472 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.
Affected
up to 2.3.12
What to do
Affects up to 2.3.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.CVE-2026-66469 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.CVE-2026-66468 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versiCVE-2026-66466 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.CVE-2026-66465 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
Affected
up to 1.3.0.1
What to do
Affects up to 1.3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.CVE-2026-66464 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
Affected
up to 5.2.7
What to do
Affects up to 5.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.CVE-2026-66463 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.
Affected
up to 2.9
What to do
Affects up to 2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.CVE-2026-66462 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
Affected
up to 5.3.8
What to do
Affects up to 5.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.CVE-2026-66461 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.CVE-2026-66459 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.CVE-2026-66458 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.CVE-2026-66454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.
Affected
up to 1.5
What to do
Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.CVE-2026-66453 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.
Affected
up to 10.30.26
What to do
Affects up to 10.30.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.