Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

434new WordPress flaws this week

394,398entries in the database

41,159 results · page 212 of 824

Feb 7, 2026Wonka Slide: Stored Cross-Site ScriptingCVE-2026-1613 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wonka Slide plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `list_class` shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wonka Slide
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Wonka Slide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2026Wikiloops Track Player: Stored Cross-Site ScriptingCVE-2026-1611 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wikiloops Track Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wikiloops` shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Wikiloops Track Player
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Wikiloops Track Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2026Video Onclick: Stored Cross-Site ScriptingCVE-2026-1608 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Video Onclick plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `youtube` shortcode in all versions up to, and including, 0.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Video Onclick
Affected
up to 0.4.7
What to do
Affects up to 0.4.7. Update Video Onclick to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2026OMIGO: Stored Cross-Site ScriptingCVE-2026-1573 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The OMIGO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `omigo_donate_button` shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
OMIGO
Affected
up to 3.3
What to do
Affects up to 3.3. Update OMIGO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2026Simple Bible Verse via Shortcode: Stored Cross-Site ScriptingCVE-2026-1570 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Bible Verse via Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `verse` shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Bible Verse via Shortcode
Affected
up to 1.1
What to do
Affects up to 1.1. Update Simple Bible Verse via Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2026TITLE ANIMATOR: Cross-Site Request ForgeryCVE-2026-1082 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The TITLE ANIMATOR plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page form handler in `inc/settings-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
TITLE ANIMATOR
Affected
up to 1.0
What to do
Affects up to 1.0. Update TITLE ANIMATOR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2026Premmerce: Stored Cross-Site ScriptingCVE-2026-0555 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Premmerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premmerce_wizard_actions' AJAX endpoint in all versions up to, and including, 1.3.20. This is due to missing capability checks and insufficient input sanitization and output escaping on the `state` parameter. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the Premmerce Wizard admin page).
Product
Premmerce
Affected
up to 1.3.20
What to do
Affects up to 1.3.20. Update Premmerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2026Bucketlister: SQL InjectionCVE-2025-15477 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Bucketlister plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode `category` and `id` attributes in all versions up to, and including, 0.1.5 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Bucketlister
Affected
up to 0.1.5
What to do
Affects up to 0.1.5. Update Bucketlister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2026The Bucketlister: Unauthorized modification of dataCVE-2025-15476 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Bucketlister plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bucketlister_do_admin_ajax() function in all versions up to, and including, 0.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add delete or modify arbitrary bucket list items.
Product
The Bucketlister
Affected
up to 0.1.5
What to do
Affects up to 0.1.5. Update The Bucketlister to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 7, 2026Post Slides: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2025-15491 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks
Product
Post Slides
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Post Slides to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 7, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2025-15267 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.6.1
What to do
Affects up to 5.6.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2025-13463 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid component in all versions up to, and including, 5.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.5.3
What to do
Affects up to 5.5.3. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2025-12803 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bt_bb_tabs' shortcode in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.5.1
What to do
Affects up to 5.5.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2025-12159 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_raw_content shortcode in all versions up to, and including, 5.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.4.8
What to do
Affects up to 5.4.8. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 6, 2026Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Stored Cross-Site ScriptingCVE-2026-1293 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `yoast-schema` block attribute in all versions up to, and including, 26.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Affected
up to 26.8
What to do
Affects up to 26.8. Update Yoast SEO – Advanced SEO with real-time guidance and built-in AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026Code Snippets: Cross-Site Request ForgeryCVE-2026-1785 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the Cloud_Search_List_Table class. This makes it possible for unauthenticated attackers to force logged-in administrators to download or update cloud snippets without their consent via a crafted request, granted they can trick an administrator into visiting a malicious page.
Product
Code Snippets
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Code Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Feb 6, 2026WP Duplicate: Missing Authorization leading to Arbitrary File UploadCVE-2026-1499 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Duplicate plugin for WordPress is vulnerable to Missing Authorization leading to Arbitrary File Upload in all versions up to and including 1.1.8. This is due to a missing capability check on the `process_add_site()` AJAX action combined with path traversal in the file upload functionality. This makes it possible for authenticated (subscriber-level) attackers to set the internal `prod_key_random_id` option, which can then be used by an unauthenticated attacker to bypass authentication checks and write arbitrary files to the server via the `handle_upload_single_big_file()` function, ultimately leading to remote code execution.
Product
WP Duplicate
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update WP Duplicate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026Events Listing Widget: Stored Cross-Site ScriptingCVE-2026-1252 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Events Listing Widget
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Events Listing Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026Employee Directory: Stored Cross-Site ScriptingCVE-2026-1279 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_title' parameter in the `search_employee_directory` shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Employee Directory
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Employee Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026WaveSurfer-WP: Stored Cross-Site ScriptingCVE-2026-1909 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WaveSurfer-WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's audio shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on the 'src' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WaveSurfer-WP
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update WaveSurfer-WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026Docus – YouTube Video Playlist: Stored Cross-Site ScriptingCVE-2026-1888 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Docus – YouTube Video Playlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'docusplaylist' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Docus – YouTube Video Playlist
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Docus – YouTube Video Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026Orange Confort+ accessibility toolbar for: Stored Cross-Site ScriptingCVE-2026-1808 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orange Confort+ accessibility toolbar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' parameter of the ocplus_button shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Orange Confort+ accessibility toolbar for
Affected
up to 0.7
What to do
Affects up to 0.7. Update Orange Confort+ accessibility toolbar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026Tune Library: Stored Cross-Site ScriptingCVE-2026-1401 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tune Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSV import in all versions up to, and including, 1.6.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page. The vulnerability exists because the CSV import functionality lacks authorization checks and doesn't sanitize imported data, which is later rendered without escaping through the [tune-library] shortcode.
Product
Tune Library
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Tune Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 6, 2026OAuth Single Sign On – SSO (OAuth Client): Unauthorized accessCVE-2025-10753 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' option parameter. This makes it possible for unauthenticated attackers to set the global redirect URL option via the redirect_url parameter granted they can access the site directly.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.26.14
What to do
Affects up to 6.26.14. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines): Insecure Direct Object ReferenceCVE-2026-1228 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.3 via the tlgb_shortcode() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to disclose private timeline content via the id attribute supplied to the 'timeline_block' shortcode.
Product
Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines)
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2026Greenshift – animation and page builder blocks: Unauthorized access of dataCVE-2026-1927 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the greenshift_app_pass_validation() function in all versions up to, and including, 12.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve global plugin settings including stored AI API keys and modify plugin settings, including the injection of arbitrary web scripts via the 'custom_css' value (stored XSS). NOTE: This vulnerability was partially patched in version 12.6.
Product
Greenshift – animation and page builder blocks
Affected
up to 12.6
What to do
Affects up to 12.6. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026Peter's Date Countdown: Reflected Cross-Site ScriptingCVE-2026-1654 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Peter's Date Countdown plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Peter's Date Countdown
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Peter's Date Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026All In One Image Viewer Block: Server-Side Request ForgeryCVE-2026-1294 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
All In One Image Viewer Block
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update All In One Image Viewer Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026ProfileGrid – User Profiles, Groups and Communities: Insecure Direct Object ReferenceCVE-2026-1271 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the 'pm_upload_image' and 'pm_upload_cover_image' AJAX actions. This is due to the update_user_meta() function being called outside of the user authorization check in public/partials/crop.php and public/partials/coverimg_crop.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change any user's profile picture or cover image, including administrators.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.7.2
What to do
Affects up to 5.9.7.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026ELEX WordPress HelpDesk & Customer Ticketing System: Missing AuthorizationCVE-2025-14079 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global WSDesk settings via the `eh_crm_ticket_general` AJAX action.
Product
ELEX WordPress HelpDesk & Customer Ticketing System
Affected
up to 3.3.5
What to do
Affects up to 3.3.5. Update ELEX WordPress HelpDesk & Customer Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026Robin Image Optimizer – Unlimited Image Optimization & WebP Converter: Stored Cross-Site ScriptingCVE-2026-1319 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Robin Image Optimizer – Unlimited Image Optimization & WebP Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of a Media Library image in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Robin Image Optimizer – Unlimited Image Optimization & WebP Converter
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Robin Image Optimizer – Unlimited Image Optimization & WebP Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2026ProfileGrid – User Profiles, Groups and Communities: Unauthorized user suspensionCVE-2025-13416 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing capability check on the pm_deactivate_user_from_group() function in all versions up to, and including, 5.9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to suspend arbitrary users from groups, including administrators, via the pm_deactivate_user_from_group AJAX action.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.7.2
What to do
Affects up to 5.9.7.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026Dynamic Widget Content: Stored Cross-Site ScriptingCVE-2026-1268 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dynamic Widget Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget content field in the Gutenberg editor sidebar in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dynamic Widget Content
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update Dynamic Widget Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026ShortPixel Image Optimizer: Arbitrary File ReadCVE-2026-1246 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
Product
ShortPixel Image Optimizer
Affected
up to 6.4.2
What to do
Affects up to 6.4.2. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026Essential Widgets: Stored Cross-Site ScriptingCVE-2026-0867 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category, ew-page, and ew-menu shortcodes in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 3.0.
Product
Essential Widgets
Affected
up to 3.0
Fixed in
3.0
What to do
Update Essential Widgets to 3.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers: Generic SQL InjectionCVE-2025-13192 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Injection via the multiple REST API endpoints in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Vulnerability was patched in version 2.2.1 for unauthenticated users, and fully patched in version 2.2.3 for Administrator+ level users.
Product
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026SportsPress: Local File InclusionCVE-2025-15368 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Product
SportsPress
Affected
up to 2.7.26
What to do
Affects up to 2.7.26. Update SportsPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026SIBS woocommerce payment gateway: Time-based SQL InjectionCVE-2026-1370 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SIBS woocommerce payment gateway plugin for WordPress is vulnerable to time-based SQL Injection via the ‘referencedId’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
SIBS woocommerce payment gateway
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update SIBS woocommerce payment gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2026All push notification for WP: Time-based SQL InjectionCVE-2026-0816 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'delete_id' parameter in all versions up to, and including, 1.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
All push notification for WP
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update All push notification for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026WP Content Permission: Stored Cross-Site ScriptingCVE-2026-0743 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Content Permission
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Content Permission to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Smart Appointment & Booking: Stored Cross-Site ScriptingCVE-2026-0742 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Appointment & Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saab_save_form_data AJAX action in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Smart Appointment & Booking
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Smart Appointment & Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Extended Random Number Generator: Stored Cross-Site ScriptingCVE-2026-0681 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Extended Random Number Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Extended Random Number Generator
Affected
up to 1.1
What to do
Affects up to 1.1. Update Extended Random Number Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Fortis for WooCommerce: Authorization bypassCVE-2026-0679 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'check_fortis_notify_response' function in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update arbitrary WooCommerce order statuses to paid/processing/completed, effectively allowing them to mark orders as paid without payment.
Product
Fortis for WooCommerce
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Fortis for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026WebPurify Profanity Filter: Unauthorized modification of dataCVE-2026-0572 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WebPurify Profanity Filter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'webpurify_save_options' function in all versions up to, and including, 4.0.2. This makes it possible for unauthenticated attackers to change plugin settings.
Product
WebPurify Profanity Filter
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update WebPurify Profanity Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2026Magic Import Document Extractor: Sensitive Information ExposureCVE-2025-15508 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_settings() function. This makes it possible for unauthenticated attackers to extract the site's magicimport.ai license key from the page source on any page containing the plugin's shortcode.
Product
Magic Import Document Extractor
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Magic Import Document Extractor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2026Magic Import Document Extractor: Unauthorized modification of dataCVE-2025-15507 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.5. This makes it possible for unauthenticated attackers to modify the plugin's license status and credit balance.
Product
Magic Import Document Extractor
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Magic Import Document Extractor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Code Explorer: Path TraversalCVE-2025-15487 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Code Explorer
Affected
up to 1.4.6
What to do
Affects up to 1.4.6. Update Code Explorer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2026Chapa Payment Gateway Plugin for WooCommerce: Sensitive Information ExposureCVE-2025-15482 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 via 'chapa_proceed' WooCommerce API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including the merchant's Chapa secret API key.
Product
Chapa Payment Gateway Plugin for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Chapa Payment Gateway Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2026SEO Flow by LupsOnline: Unauthorized modification of dataCVE-2025-15285 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories.
Product
SEO Flow by LupsOnline
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update SEO Flow by LupsOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 4, 2026Infility Global: Unauthenticated SQL InjectionCVE-2025-15268 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and including, 2.14.46. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append - with certain server configurations - additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Infility Global
Affected
up to 2.14.46
What to do
Affects up to 2.14.46. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.