Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

6,267 results · page 22 of 126

May 25, 2026WP Search Analytics: Missing AuthorizationCVE-2026-27357 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cornel Raiu WP Search Analytics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Search Analytics: from n/a before 1.5.0.
Product
WP Search Analytics
Fixed in
1.5.0
What to do
Update WP Search Analytics to 1.5.0 or newer.
Full record and what to do →NVD record patchstack.com
May 25, 2026B2BKing: Missing AuthorizationCVE-2026-27346 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a before 5.2.10.
Product
B2BKing
Fixed in
5.2.10
What to do
Update B2BKing to 5.2.10 or newer.
Full record and what to do →NVD record patchstack.com
May 25, 2026Auto Affiliate Links: Missing AuthorizationCVE-2026-24592 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Auto Affiliate Links: from n/a through 6.8.8.3.
Product
Auto Affiliate Links
Affected
up to 6.8.8.3
What to do
Affects up to 6.8.8.3. Update Auto Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Newses: Missing AuthorizationCVE-2026-24586 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Themeansar Newses allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Newses: from n/a through 2.0.0.77.
Product
Newses
Affected
up to 2.0.0.77
What to do
Affects up to 2.0.0.77. Update Newses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026FlexTable: Missing AuthorizationCVE-2026-24582 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPPOOL FlexTable allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexTable: from n/a through 3.24.0.
Product
FlexTable
Affected
up to 3.24.0
What to do
Affects up to 3.24.0. Update FlexTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Autoship Cloud for WooCommerce Subscription Products: Missing AuthorizationCVE-2026-24527 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.
Product
Autoship Cloud for WooCommerce Subscription Products
Affected
up to 2.14.0
What to do
Affects up to 2.14.0. Update Autoship Cloud for WooCommerce Subscription Products to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026QR Redirector: Missing AuthorizationCVE-2026-24545 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects QR Redirector: from n/a through 2.0.3.
Product
QR Redirector
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update QR Redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026GamiPress: Missing AuthorizationCVE-2026-24546 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ruben Garcia GamiPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GamiPress: from n/a through 7.6.3.
Product
GamiPress
Affected
up to 7.6.3
What to do
Affects up to 7.6.3. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2026WooCommerce PayPal Payments: Unauthorized order manipulation and information disclosureCVE-2026-9284 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an arbitrary WooCommerce order ID in the `pay-now` context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers' order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim's WC order and then retrieving the PayPal order data.
Product
WooCommerce PayPal Payments
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WooCommerce PayPal Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 23, 2026Wishlist Member: Unauthorized modification of dataCVE-2026-6898 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3_Hooks::generate_api_key' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.
Product
Wishlist Member
Affected
up to 3.30.1
What to do
Affects up to 3.30.1. Update Wishlist Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wishlistmember.com wordfence.com
May 23, 2026Wishlist Member: Unauthorized modification of dataCVE-2026-6897 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember\Features\Team_Accounts::save_settings' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary plugin options, includes the REST API Secret Key, which can be used to create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.
Product
Wishlist Member
Affected
up to 3.30.1
What to do
Affects up to 3.30.1. Update Wishlist Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wishlistmember.com wordfence.com
May 23, 2026WishList Member: Missing Authorization leading to Sensitive Information Disclosure and Privilege EscalationCVE-2026-6895 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Disclosure and Privilege Escalation in versions up to and including 3.30.1. This is due to the missing capability checks in the 'export_settings' function. This function returns the REST API Secret Key to the attacker in the AJAX JSON response. An attacker who obtains this key can authenticate to the WishList Member API, create a new membership level assigned the administrator WordPress role, and register an arbitrary administrator-level user account, resulting in complete site takeover.
Product
WishList Member
Affected
up to 3.30.1
What to do
Affects up to 3.30.1. Update WishList Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wishlistmember.com wordfence.com
May 22, 2026Ditty – Responsive News Tickers, Sliders, and Lists: Authorization bypassCVE-2026-9011 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys — including drafts, pending, scheduled, and disabled entries — by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a 'publish' post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted.
Product
Ditty – Responsive News Tickers, Sliders, and Lists
Affected
up to 3.1.65
What to do
Affects up to 3.1.65. Update Ditty – Responsive News Tickers, Sliders, and Lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2026Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder: Authorization bypassCVE-2026-8692 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the structure of any form — adding, removing, or altering fields — by writing attacker-controlled data to the plugin's FORMS database table. The 'ajax-nonce' nonce used by this handler is injected into the public frontend via wp_localize_script(), so any authenticated user who visits a page containing a form shortcode can obtain it without any elevated access.
Product
Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2026MotoPress Hotel Booking: Authorization bypassCVE-2026-8684 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce for this action is output in the HTML source of every public page through wp_localize_script (MPHB._data.nonces), so any unauthenticated visitor can obtain a valid nonce and perform the action without any account or prior interaction.
Product
MotoPress Hotel Booking
Affected
up to 6.0.1
What to do
Affects up to 6.0.1. Update MotoPress Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2026Location Weather: Unauthorized modification of dataCVE-2026-7249 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is exposed to all authenticated users via `wp_localize_script()` on the `init` hook.
Product
Location Weather
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Location Weather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2026FastX: Unauthorized limited plugin installation and activationCVE-2026-2518 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback' and 'ultp_activate_callback' functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the PostX plugin.
Product
FastX
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update FastX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
May 21, 2026GSheet For Woo Importer: Unauthorized loss of dataCVE-2026-4843 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.
Product
GSheet For Woo Importer
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update GSheet For Woo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 21, 2026HAPPY: Missing AuthorizationCVE-2026-39593 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.10.
Product
HAPPY
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update HAPPY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 21, 2026CF7 WOW Styler: Missing AuthorizationCVE-2026-27393 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 WOW Styler: from n/a through 1.7.6.
Product
CF7 WOW Styler
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update CF7 WOW Styler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 21, 2026Mail Mint: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-27349 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. This issue affects Mail Mint: from n/a through 1.19.5.
Product
Mail Mint
Affected
up to 1.19.5
What to do
Affects up to 1.19.5. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 20, 2026PDF for Elementor Forms + Drag And Drop Template Builder: Missing AuthorizationCVE-2026-45443 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Template Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through 5.5.1.
Product
PDF for Elementor Forms + Drag And Drop Template Builder
Affected
up to 5.5.1
What to do
Affects up to 5.5.1. Update PDF for Elementor Forms + Drag And Drop Template Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 20, 2026Image Photo Gallery Final Tiles Grid: Missing AuthorizationCVE-2026-27424 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.11
What to do
Affects up to 3.6.11. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 20, 2026WpBookingly: Missing AuthorizationCVE-2026-27405 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.
Product
WpBookingly
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WpBookingly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 20, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Missing AuthorizationCVE-2026-5200 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 10.8.2
What to do
Affects up to 10.8.2. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 20, 2026Decent Comments: Does not restrict access to comment author email addresses and post author email addresses via its REST API endpointCVE-2026-7385 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.
Product
Decent Comments
Fixed in
3.0.2
What to do
Update Decent Comments to 3.0.2 or newer.
Full record and what to do →NVD record wpscan.com
May 20, 2026Xpro Addons — 140+ Widgets for Elementor: Unauthorized modification of dataCVE-2025-15369 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_content_editor function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to create published Xpro templates.
Product
Xpro Addons — 140+ Widgets for Elementor
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Xpro Addons — 140+ Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 19, 2026TypeSquare Webfonts for ConoHa: Authorization bypassCVE-2026-8610 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's site-wide font settings, including the typesquare_auth option (fontThemeUseType), show_post_form, and typesquare_fonttheme, by submitting a POST request to any wp-admin page. For fontThemeUseType values 1 and 3, no nonce verification is performed either, meaning those branches are additionally exploitable via cross-site request forgery.
Product
TypeSquare Webfonts for ConoHa
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update TypeSquare Webfonts for ConoHa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Oliver POS – A WooCommerce Point of Sale (POS): Authorization Bypass Through User-Controlled KeyCVE-2026-6072 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied 'OliverAuth' header value against the 'oliver_pos_authorization_token' option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP's type juggling, the loose comparison '0' == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending 'OliverAuth: 0'. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover.
Product
Oliver POS – A WooCommerce Point of Sale (POS)
Affected
up to 2.4.2.6
What to do
Affects up to 2.4.2.6. Update Oliver POS – A WooCommerce Point of Sale (POS) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Authorization bypassCVE-2026-8096 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026the public checkout endpoint that: Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorizationCVE-2026-47100 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.
Product
the public checkout endpoint that
What to do
Update the public checkout endpoint that to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org sansec.io
May 19, 2026Presto Player: Missing AuthorizationCVE-2026-45442 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Presto Player: from n/a through 4.1.3.
Product
Presto Player
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 18, 2026Feeds for YouTube (YouTube video, channel, and gallery plugin): Is vulnerable to unauthorized modification of the Feeds for YouTube (YouTube videoCVE-2026-1631 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4 is vulnerable to unauthorized modification of the Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4's license key due to a missing capability check on the 'actions' function. This makes it possible for subscribers and above delete the license key.
Product
Feeds for YouTube (YouTube video, channel, and gallery plugin)
Fixed in
2.6.4
What to do
Update Feeds for YouTube (YouTube video, channel, and gallery plugin) to 2.6.4 or newer.
Full record and what to do →NVD record wpscan.com
May 16, 2026Multicollab: Content Team Collaboration and Editorial Workflow: Unauthorized modification of dataCVE-2025-4202 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf_add_comment' function in all versions up to, and including, 5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to arbitrary collaborations.
Product
Multicollab: Content Team Collaboration and Editorial Workflow
Affected
up to 5.2
What to do
Affects up to 5.2. Update Multicollab: Content Team Collaboration and Editorial Workflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2026Essential Chat Support: Authorization bypassCVE-2026-8681 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset all plugin configuration settings — including general settings, display rules, custom CSS, and WooCommerce tab settings — to their defaults by sending a POST request with ecs_reset_settings=1.
Product
Essential Chat Support
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Essential Chat Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2026Classified Listing – AI-Powered Classified ads & Business Directory: Unauthorized accessCVE-2026-7563 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 5.3.10. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add arbitrary notes to any order and trigger unsolicited notification and moderation emails to listing owners without administrative authorization.
Product
Classified Listing – AI-Powered Classified ads & Business Directory
Affected
up to 5.3.10
What to do
Affects up to 5.3.10. Update Classified Listing – AI-Powered Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2026Smartcat Translator for WPML: Unauthorized modification of dataCVE-2026-4683 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Smartcat Translator for WPML plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'routeData' REST endpoint in all versions up to, and including, 3.1.77. This makes it possible for unauthenticated attackers to overwrite the plugin's Smartcat API credentials (account ID, API secret key, hub key, API host, and hub host), effectively hijacking the translation service or causing a denial of service.
Product
Smartcat Translator for WPML
Affected
up to 3.1.77
What to do
Affects up to 3.1.77. Update Smartcat Translator for WPML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2026FOX – Currency Switcher Professional for WooCommerce: Unauthorized data lossCVE-2026-4094 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete the entire multi-currency configuration by visiting any wp-admin page with the `woocs_reset` parameter appended. Additionally, because no nonce is verified, this is also exploitable via Cross-Site Request Forgery against any administrator. The vulnerability may also be exploited by Subscriber-level users if the site is configured to allow Subscriber access to 'wp-admin' pages.
Product
FOX – Currency Switcher Professional for WooCommerce
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Database Backup for: Authorization bypassCVE-2026-4031 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups are written. This makes it possible for unauthenticated attackers to send a request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory (e.g., wp-content/uploads/), and if a scheduled backup is due, intercept the backup file before it is cleaned up. The backup file has a predictable name based on the database name, table prefix, date, and Swatch Internet Time, making interception reliable. Successful exploitation leads to Sensitive Information Exposure including database credentials, user password hashes, and personally identifiable information. This vulnerability requires that the site administrator has configured scheduled backups.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Database Backup for: Unauthorized arbitrary file read and deletionCVE-2026-4030 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup directory parameter. This makes it possible for unauthenticated attackers to read and delete arbitrary files on the server, leading to Sensitive Information Exposure and potential site takeover. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026Database Backup for: Unauthorized database exportCVE-2026-4029 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to export database tables, leading to Sensitive Information Exposure. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
Product
Database Backup for
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Database Backup for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026InfusedWoo Pro: Authorization bypassCVE-2026-6512 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.
Product
InfusedWoo Pro
Affected
up to 5.1.2
What to do
Affects up to 5.1.2. Update InfusedWoo Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.infusedwoo.com wordfence.com
May 14, 2026User Registration & Membership: Missing AuthorizationCVE-2026-6145 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.1.5. This is due to the is_admin_creation_process() method relying solely on the presence of action=createuser in the $_REQUEST superglobal without performing any authentication or capability check. This makes it possible for unauthenticated attackers to bypass the admin approval requirement when registering new accounts via the fallback submission path.
Product
User Registration & Membership
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update User Registration & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026Fluent Forms: Authorization Bypass Through User-Controlled KeyCVE-2026-5396 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 6.1.21. This is due to the SubmissionPolicy class authorizing submission-level actions (read, modify, delete, add notes) based on a user-supplied `form_id` query parameter. This makes it possible for authenticated attackers, with Fluent Forms Manager access restricted to specific forms, to read, modify status, add notes to, and permanently delete form submissions belonging to any other form by spoofing the form_id parameter to a form they are authorized for.
Product
Fluent Forms
Affected
up to 6.1.21
What to do
Affects up to 6.1.21. Update Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan: Unauthorized modification of dataCVE-2026-3829 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple_basic_get_requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.
Product
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
Affected
up to 7.8.5.10
What to do
Affects up to 7.8.5.10. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026My Calendar – Accessible Event Manager: Authorization bypassCVE-2026-7525 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to bypass the moderation and approval workflow by tampering with the POST body to publish events or set other unauthorized statuses such as cancelled or private, in ways their role does not permit. While the UI correctly restricts low-privilege users to a draft-only submit button, this restriction is enforced only client-side, making it trivially bypassable by directly manipulating the POST request.
Product
My Calendar – Accessible Event Manager
Affected
up to 3.7.9
What to do
Affects up to 3.7.9. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 13, 2026ProfileGrid – User Profiles, Groups and Communities: Unauthorized accessCVE-2026-4609 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_user function in all versions up to, and including, 5.9.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add themselves or any registered user to any ProfileGrid group, including closed and paid groups, bypassing all authorization and payment gates.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.8.4
What to do
Affects up to 5.9.8.4. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026ProfileGrid – User Profiles, Groups and Communities: Authorization bypassCVE-2026-4607 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action via the pm_set_group_order, pm_set_group_items, and pm_set_field_order AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify site-wide ProfileGrid group settings including group menu order, group list order, group icon display, and field ordering.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.8.4
What to do
Affects up to 5.9.8.4. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026RTMKit Addons for Elementor: Unauthorized modification of dataCVE-2026-3426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_widget() and reset_all_widgets() functions in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with Author-level access and above, to modify or reset site-wide widget configurations.
Product
RTMKit Addons for Elementor
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update RTMKit Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026Hostinger Reach – AI-Powered Email Marketing for: Unauthorized modification of dataCVE-2026-2515 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_ajax_action' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to use the 'hostinger_reach_connection_notice_action' action to update the API key value stored in the database. This vulnerability can only be exploited when the plugin is not connected to a site and no API key value exists in the database.
Product
Hostinger Reach – AI-Powered Email Marketing for
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Hostinger Reach – AI-Powered Email Marketing for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.