Updated 23 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

11,282 results · page 22 of 226

Jul 31, 2026WPGraphQL provides a GraphQL API for WordPress sites.CVE-2026-54768 · WordPress plugins & themes · reported by GitHubMedium 6.9
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
Fixed in
2.15.1
What to do
Update the plugin to 2.15.1 or newer.
Full record and what to do →NVD record github.com github.com
Jul 31, 2026BuddyPress: Does not properly enforce authorization on its private messaging endpointsCVE-2026-8155 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Product
BuddyPress
Fixed in
14.5.0
What to do
Update BuddyPress to 14.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026WP Go Maps: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-15381 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Product
WP Go Maps
Fixed in
10.1.04
What to do
Update WP Go Maps to 10.1.04 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Product Feed Manager For WooCommerce: Does not properly sanitise and escape product-feed custom filter rules before using them in a SQL queryCVE-2026-15258 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.
Product
Product Feed Manager For WooCommerce
Fixed in
7.6.1
What to do
Update Product Feed Manager For WooCommerce to 7.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026ShopMonitor.io: Does not properly restrict its email-rerouting test modeCVE-2026-14919 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.
Product
ShopMonitor.io
Fixed in
1.2.0
What to do
Update ShopMonitor.io to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Support Genix: Does not properly authorize access to support-ticket attachment downloadsCVE-2026-14862 · WordPress plugins & themes · reported by WPScanLow 3.7
The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.
Product
Support Genix
Fixed in
1.4.48
What to do
Update Support Genix to 1.4.48 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Paid Membership Subscriptions: Does not protect the member and payment export files it writes to a predictable location in the uploads directoryCVE-2026-14849 · WordPress plugins & themes · reported by WPScanLow 3.7
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.
Product
Paid Membership Subscriptions
Fixed in
3.0.7
What to do
Update Paid Membership Subscriptions to 3.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026FlxWoo: Does not verify with the payment processor that a checkout session was actually paid before marking the associated orderCVE-2026-14830 · WordPress plugins & themes · reported by WPScanHigh 7.5
The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.
Product
FlxWoo
Fixed in
3.1.1
What to do
Update FlxWoo to 3.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Check & Log Email: Does not properly sanitize and escape parameters before using them in SQL queriesCVE-2026-14554 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
Product
Check & Log Email
Fixed in
2.0.15
What to do
Update Check & Log Email to 2.0.15 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Demi: Stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protectionCVE-2026-14333 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.
Product
Demi
Fixed in
0.0.7
What to do
Update Demi to 0.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026GiveWP: Does not properly restrict access to a REST API endpoint that returns recurring-donation recordsCVE-2026-14319 · WordPress plugins & themes · reported by WPScanHigh 7.5
The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.
Product
GiveWP
Fixed in
4.16.3
What to do
Update GiveWP to 4.16.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Kirki: Does not properly sanitise and escape a value taken from the request before using it in a SQL statementCVE-2026-12721 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Product
Kirki
Fixed in
6.0.13
What to do
Update Kirki to 6.0.13 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026RegistrationMagic: Does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissionsCVE-2026-15255 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
Product
RegistrationMagic
Fixed in
6.0.9.4
What to do
Update RegistrationMagic to 6.0.9.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Tutor LMS: Does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that threadCVE-2026-14310 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
Product
Tutor LMS
Fixed in
4.0.0
What to do
Update Tutor LMS to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Online Scheduling and Appointment Booking System: Does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL queryCVE-2026-13395 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.
Product
Online Scheduling and Appointment Booking System
Fixed in
27.8
What to do
Update Online Scheduling and Appointment Booking System to 27.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Eventin: Does not properly authorize order creation and accepts an attacker-supplied order statusCVE-2026-13178 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.
Product
Eventin
Fixed in
4.1.16
What to do
Update Eventin to 4.1.16 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026ProfileGrid: Does not restrictCVE-2026-12687 · WordPress plugins & themes · reported by WPScanHigh 7.5
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.
Product
ProfileGrid
Fixed in
5.9.9.8
What to do
Update ProfileGrid to 5.9.9.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026WP Ghost (Hide My WP Ghost): Does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headersCVE-2026-11870 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.
Product
WP Ghost (Hide My WP Ghost)
Fixed in
7.0.05
What to do
Update WP Ghost (Hide My WP Ghost) to 7.0.05 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Admin and Site Enhancements (ASE) Pro: Remote Code ExecutionCVE-2026-16610 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.
Product
Admin and Site Enhancements (ASE) Pro
Affected
up to 8.9.0
What to do
Affects up to 8.9.0. Update Admin and Site Enhancements (ASE) Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wpase.com
Jul 29, 2026Improved Save Button: Second-order SQL InjectionCVE-2026-16092 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Improved Save Button
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Improved Save Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 29, 2026Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce): Arbitrary File UploadCVE-2026-14270 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.
Product
Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce)
Affected
up to 2.3.2
Fixed in
2.3.2
What to do
Update Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) to 2.3.2 or newer.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 29, 2026Cost Calculator Builder PRO: Remote Code ExecutionCVE-2026-14900 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.
Product
Cost Calculator Builder PRO
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Cost Calculator Builder PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record stylemixthemes.com wordfence.com
Jul 29, 2026Link Library: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2026-18197 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4.
Product
Link Library
Fixed in
7.9.4
What to do
Update Link Library to 7.9.4 or newer.
Full record and what to do →NVD record tenable.com wordpress.org
Jul 29, 2026miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn): Does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued forCVE-2026-14300 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
Product
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
Fixed in
7.8.0
What to do
Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) to 7.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026PayU CommercePro: Does not verify the payment-gateway signature before applying order modificationsCVE-2026-13692 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.
Product
PayU CommercePro
Fixed in
3.9.0
What to do
Update PayU CommercePro to 3.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026UsersWP: Does not validate the selected authentication provider in its two-factor login handlerCVE-2026-13690 · WordPress plugins & themes · reported by WPScanHigh 7.4
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
Product
UsersWP
Fixed in
1.2.67
What to do
Update UsersWP to 1.2.67 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026WowStore – Store Builder & Product Blocks for WooCommerce: Stored Cross-Site ScriptingCVE-2026-17162 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WowStore – Store Builder & Product Blocks for WooCommerce
Affected
up to 4.4.24
What to do
Affects up to 4.4.24. Update WowStore – Store Builder & Product Blocks for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026WowStore – Store Builder & Product Blocks for WooCommerce: Stored Cross-Site ScriptingCVE-2026-17161 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time wp_kses_post sanitization is ineffective because the payload is stored inside a Gutenberg block delimiter comment as JSON, which wp_kses_post preserves, allowing an attribute-breakout string to survive to the server-side render_callback.
Product
WowStore – Store Builder & Product Blocks for WooCommerce
Affected
up to 4.4.24
What to do
Affects up to 4.4.24. Update WowStore – Store Builder & Product Blocks for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Stored Cross-Site ScriptingCVE-2026-15016 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via [pmpro_member_profile_edit] Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record paidmembershipspro.com wordfence.com
Jul 28, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: SQL InjectionCVE-2026-15267 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query — the value is re-read at line 144 using only sanitize_text_field() (overwriting the earlier absint() result), then concatenated into the SQL WHERE clause as an unquoted numeric operand using only esc_sql(), which does not protect against injection in that context, and finally string-interpolated into the $wpdb->prepare() format string, bypassing parameterization entirely. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Taskbuilder – Project Management & Task Management Tool With Kanban Board
Affected
up to 5.0.9
What to do
Affects up to 5.0.9. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Premium Packages – Sell Digital Products Securely: SQL InjectionCVE-2026-12800 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied parameter, which is interpolated directly into a raw SQL query string in the CouponCodes::find() method without use of $wpdb->prepare() or esc_sql(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Premium Packages – Sell Digital Products Securely
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Premium Packages – Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Chaty Pro: Authenticated Time-Based Blind SQL InjectionCVE-2026-6251 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class-admin-base.php retrieving the widget_id POST parameter via filter_input(INPUT_POST, ...) and directly concatenating the value into a raw SQL query in a numeric context without using $wpdb->prepare() or any integer casting. Additionally, the nonce verification check is performed after the SQL query has already executed, providing no protection against the injection. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary SQL commands, potentially leading to unauthorized extraction of sensitive database contents including user credentials and configuration data.
Product
Chaty Pro
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update Chaty Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before reflecting it back in an admin pageCVE-2026-14870 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Database for Contact Form 7, WPforms, Elementor forms
Fixed in
1.5.3
What to do
Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026Event Tickets and Registration: Does not properly escape event titles before outputting them in a ticket history logCVE-2026-14819 · WordPress plugins & themes · reported by WPScanLow 3.5
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.
Product
Event Tickets and Registration
Fixed in
5.28.4
What to do
Update Event Tickets and Registration to 5.28.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.CVE-2026-65445 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.CVE-2026-65437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions.
Affected
up to 6.82
What to do
Affects up to 6.82. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.CVE-2026-61953 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.
Affected
up to 15.0.6
What to do
Affects up to 15.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.CVE-2026-59553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.CVE-2026-59535 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.
Affected
up to 10.9.2
What to do
Affects up to 10.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026bookingpress-appointment-booking-pro: Does not correctly invoke its REST permission callbackCVE-2026-9830 · WordPress plugins & themes · reported by WPScanHigh 8.2
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.
Product
bookingpress-appointment-booking-pro
Fixed in
5.7.3
What to do
Update bookingpress-appointment-booking-pro to 5.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Calendar: Does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing pageCVE-2026-14827 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
Product
Calendar
Fixed in
1.3.18
What to do
Update Calendar to 1.3.18 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration: Does not correctly verify ownership before deleting an attachmentCVE-2026-14568 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.
Product
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration
Fixed in
4.3.8
What to do
Update User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration to 4.3.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Download Manager: Does not bind its temporary download token to the requesting session nor expire it promptlyCVE-2026-14235 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
Product
Download Manager
Fixed in
3.3.62
What to do
Update Download Manager to 3.3.62 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Smart Manager: Does not properly encode a post field before rendering it into an HTML attribute in its management gridCVE-2026-14203 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.
Product
Smart Manager
Fixed in
8.92.0
What to do
Update Smart Manager to 8.92.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026微信二维码登陆: Does not properly validate WeChat webhook requestsCVE-2026-13597 · WordPress plugins & themes · reported by WPScanCritical 9.1
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
Product
微信二维码登陆
Affected
up to 1.3
What to do
Affects up to 1.3. Update 微信二维码登陆 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX actionCVE-2026-12982 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
Product
Document Gallery
Fixed in
5.1.1
What to do
Update Document Gallery to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Clover Payment Gateway by Zaytech for WooCommerce: Does not verify that an approved external payment record actually belongs to the WooCommerce order being completedCVE-2026-12493 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).
Product
Clover Payment Gateway by Zaytech for WooCommerce
Fixed in
1.3.6
What to do
Update Clover Payment Gateway by Zaytech for WooCommerce to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Printcart Web to Print Product Designer for WooCommerce: Does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization checkCVE-2025-15662 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.
Product
Printcart Web to Print Product Designer for WooCommerce
Fixed in
2.5.3
What to do
Update Printcart Web to Print Product Designer for WooCommerce to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 25, 2026Fluent Forms Pro Add On Pack: PHP Object InjectionCVE-2026-15962 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.
Product
Fluent Forms Pro Add On Pack
Affected
up to 6.2.6
What to do
Affects up to 6.2.6. Update Fluent Forms Pro Add On Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fluentforms.com wordfence.com
Jul 25, 2026Checkout Field Editor for WooCommerce (Pro): Directory TraversalCVE-2026-14955 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Checkout Field Editor for WooCommerce (Pro)
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update Checkout Field Editor for WooCommerce (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themehigh.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.