Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 26 of 126
Apr 8, 2026DEPART: Missing AuthorizationCVE-2026-39592 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through <= 1.0.7.
- Product
- DEPART
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update DEPART to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026NM Gift Registry and Wishlist Lite: Missing AuthorizationCVE-2026-39588 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nmerii NM Gift Registry and Wishlist Lite nm-gift-registry-and-wishlist-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NM Gift Registry and Wishlist Lite: from n/a through <= 5.13.
- Product
- NM Gift Registry and Wishlist Lite
- Affected
- up to 5.13
- What to do
- Affects up to 5.13. Update NM Gift Registry and Wishlist Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Booktics: Missing AuthorizationCVE-2026-39585 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.
- Product
- Booktics
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Bus Ticket Booking with Seat Reservation: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39572 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Retrieve Embedded Sensitive Data.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through < 5.6.5.
- Product
- Bus Ticket Booking with Seat Reservation
- What to do
- Update Bus Ticket Booking with Seat Reservation to the newest version.
Apr 8, 2026Instantio: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39571 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Data.This issue affects Instantio: from n/a through <= 3.3.30.
- Product
- Instantio
- Affected
- up to 3.3.30
- What to do
- Affects up to 3.3.30. Update Instantio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 202612 Step Meeting List: Missing AuthorizationCVE-2026-39569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.19.9.
- Product
- 12 Step Meeting List
- Affected
- up to 3.19.9
- What to do
- Affects up to 3.19.9. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026DirectoryPress: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39566 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedded Sensitive Data.This issue affects DirectoryPress: from n/a through <= 3.6.26.
- Product
- DirectoryPress
- Affected
- up to 3.6.26
- What to do
- Affects up to 3.6.26. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WpTravelly: Missing AuthorizationCVE-2026-39565 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.
- Product
- WpTravelly
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Share This Image: Missing AuthorizationCVE-2026-39563 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through <= 2.12.
- Product
- Share This Image
- Affected
- up to 2.12
- What to do
- Affects up to 2.12. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-39562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.10
- What to do
- Affects up to 20.8.10. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Revive.so: Missing AuthorizationCVE-2026-39561 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.7.
- Product
- Revive.so
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Revive.so to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Tourfic: Missing AuthorizationCVE-2026-39543 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4.
- Product
- Tourfic
- Affected
- up to 2.21.4
- What to do
- Affects up to 2.21.4. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026RSVP and Event Management: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.
- Product
- RSVP and Event Management
- Affected
- up to 2.7.16
- What to do
- Affects up to 2.7.16. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Display Eventbrite Events: Missing AuthorizationCVE-2026-39535 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: from n/a through <= 6.5.6.
- Product
- Display Eventbrite Events
- Affected
- up to 6.5.6
- What to do
- Affects up to 6.5.6. Update Display Eventbrite Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WP Delicious: Missing AuthorizationCVE-2026-39528 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.5.
- Product
- WP Delicious
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WpStream: Authorization Bypass Through User-Controlled KeyCVE-2026-39526 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through < 4.11.2.
- Product
- WpStream
- What to do
- Update WpStream to the newest version.
Apr 8, 2026weDocs: Missing AuthorizationCVE-2026-39520 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through <= 2.1.18.
- Product
- weDocs
- Affected
- up to 2.1.18
- What to do
- Affects up to 2.1.18. Update weDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Nexter Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39516 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.7.0.
- Product
- Nexter Blocks
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Image Photo Gallery Final Tiles Grid: Authorization Bypass Through User-Controlled KeyCVE-2026-39510 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.11.
- Product
- Image Photo Gallery Final Tiles Grid
- Affected
- up to 3.6.11
- What to do
- Affects up to 3.6.11. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Directorist: Missing AuthorizationCVE-2026-39509 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.
- Product
- Directorist
- Affected
- up to 8.5.10
- What to do
- Affects up to 8.5.10. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026AI Engine (Pro): Missing AuthorizationCVE-2026-39506 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine (Pro): from n/a through < 3.4.2.
- Product
- AI Engine (Pro)
- What to do
- Update AI Engine (Pro) to the newest version.
Apr 8, 2026Seriously Simple Podcasting: Missing AuthorizationCVE-2026-39505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.14.2
- What to do
- Affects up to 3.14.2. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026InstaWP Connect: Missing AuthorizationCVE-2026-39504 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.
- Product
- InstaWP Connect
- Affected
- up to 0.1.2.5
- What to do
- Affects up to 0.1.2.5. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026FOX: Missing AuthorizationCVE-2026-39501 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.
- Product
- FOX
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update FOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026SureCart: Missing AuthorizationCVE-2026-39488 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.
- Product
- SureCart
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Youtube Embed Plus: Missing AuthorizationCVE-2026-39485 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Embed Plus: from n/a through <= 14.2.4.
- Product
- Youtube Embed Plus
- Affected
- up to 14.2.4
- What to do
- Affects up to 14.2.4. Update Youtube Embed Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026CartFlows: Missing AuthorizationCVE-2026-39477 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.
- Product
- CartFlows
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026User Feedback: Missing AuthorizationCVE-2026-39476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.
- Product
- User Feedback
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026PageLayer: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39469 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve Embedded Sensitive Data.This issue affects PageLayer: from n/a through <= 2.0.8.
- Product
- PageLayer
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Blog2Social: Social Media Auto Post & Scheduler: Authorization bypass through user-controlled keyCVE-2026-4330 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts.
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Affected
- up to 8.8.3
- What to do
- Affects up to 8.8.3. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Masteriyo LMS – Online Course Builder for eLearning, LMS & Education: Authorization Bypass Through User-Controlled KeyCVE-2026-5167 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content.
- Product
- Masteriyo LMS – Online Course Builder for eLearning, LMS & Education
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Masteriyo LMS – Online Course Builder for eLearning, LMS & Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026WP Blockade: Missing AuthorizationCVE-2026-3480 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14. The plugin registers an admin_post action hook 'wp-blockade-shortcode-render' that maps to the render_shortcode_preview() function. This function lacks any capability check (current_user_can()) and nonce verification, allowing any authenticated user to execute arbitrary WordPress shortcodes. The function takes a user-supplied 'shortcode' parameter from $_GET, passes it through stripslashes(), and directly executes it via do_shortcode(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes, which could lead to information disclosure, privilege escalation, or other impacts depending on what shortcodes are registered on the site (e.g., shortcodes from other plugins that display sensitive data, perform actions, or include files).
- Product
- WP Blockade
- Affected
- up to 0.9.14
- What to do
- Affects up to 0.9.14. Update WP Blockade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026PZ Frontend Manager: Missing AuthorizationCVE-2026-3477 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PZ Frontend Manager plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.6. The pzfm_user_request_action_callback() function, registered via the wp_ajax_pzfm_user_request_action action hook, lacks both capability checks and nonce verification. This function handles user activation, deactivation, and deletion operations. When the 'dataType' parameter is set to 'delete', the function calls wp_delete_user() on all provided user IDs without verifying that the current user has the appropriate permissions. Notably, the similar pzfm_remove_item_callback() function does check pzfm_can_delete_user() before performing deletions, indicating this was an oversight. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary WordPress users (including administrators) by sending a crafted request to the AJAX endpoint.
- Product
- PZ Frontend Manager
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update PZ Frontend Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026MainWP Child Reports: Missing AuthorizationCVE-2026-4299 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.
- Product
- MainWP Child Reports
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update MainWP Child Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026LTL Freight Quotes – R+L Carriers Edition: Missing AuthorizationCVE-2026-3646 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3.13. This is due to missing authentication, authorization, and nonce verification on a standalone PHP file that directly processes GET parameters and updates WordPress options. This makes it possible for unauthenticated attackers to modify the plugin's subscription plan settings, effectively downgrading the store from a paid plan to the Trial Plan, changing the store type, and manipulating subscription expiration dates, potentially disabling premium features such as Dropship and Hazardous Material handling.
- Product
- LTL Freight Quotes – R+L Carriers Edition
- Affected
- up to 3.3.13
- What to do
- Affects up to 3.3.13. Update LTL Freight Quotes – R+L Carriers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Hustle – Email Marketing, Lead Generation, Optins, Popups: Unauthorized modification of dataCVE-2026-2263 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hustle_module_converted' AJAX action in all versions up to, and including, 7.8.10.2. This makes it possible for unauthenticated attackers to forge conversion tracking events for any Hustle module, including draft modules that are never displayed to users, thereby manipulating marketing analytics and conversion statistics.
- Product
- Hustle – Email Marketing, Lead Generation, Optins, Popups
- Affected
- up to 7.8.10.2
- What to do
- Affects up to 7.8.10.2. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Smart Slider 3: Unauthorized access and modification of dataCVE-2026-4065 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The display_admin_ajax() method does not call checkForCap() (which requires unfiltered_html capability), and several controller actions only validate the nonce (validateToken()) without calling validatePermission(). This makes it possible for authenticated attackers, with Contributor-level access and above, to enumerate slider metadata and create, modify, and delete image storage records by obtaining the nextend_nonce exposed on post editor pages.
- Product
- Smart Slider 3
- Affected
- up to 3.5.1.33
- What to do
- Affects up to 3.5.1.33. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Backup Migration: Missing AuthorizationCVE-2025-14944 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.
- Product
- Backup Migration
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 7, 2026Ocean Extra: Missing AuthorizationCVE-2026-34903 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3.
- Product
- Ocean Extra
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2026LTL Freight Quotes – Worldwide Express Edition: Missing AuthorizationCVE-2026-34899 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Eniture technology LTL Freight Quotes – Worldwide Express Edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.2.1.
- Product
- LTL Freight Quotes – Worldwide Express Edition
- Affected
- up to 5.2.1
- What to do
- Affects up to 5.2.1. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Unauthorized membership payment bypassCVE-2026-3445 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the `change_plan_sub_id` parameter in the `process_checkout()` function. This makes it possible for authenticated attackers, with subscriber level access and above, to reference another user's active subscription during checkout to manipulate proration calculations, allowing them to obtain paid lifetime membership plans without payment via the `ppress_process_checkout` AJAX action.
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- Affected
- up to 4.16.11
- What to do
- Affects up to 4.16.11. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Authorization bypassCVE-2026-2826 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user has the `upload_files` capability in the `process_pattern` REST API endpoint. This makes it possible for authenticated attackers, with contributor level access and above, to upload images to the WordPress Media Library by supplying remote image URLs that the server downloads and creates as media attachments.
- Product
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 3, 2026Pie Register – User Registration, Profiles & Content Restriction: Unauthorized modification of dataCVE-2026-3571 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pie_main() function in all versions up to, and including, 3.8.4.8. This makes it possible for unauthenticated attackers to change registration form status.
- Product
- Pie Register – User Registration, Profiles & Content Restriction
- Affected
- up to 3.8.4.8
- What to do
- Affects up to 3.8.4.8. Update Pie Register – User Registration, Profiles & Content Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 31, 2026Database for Contact Form 7, WPforms, Elementor forms: Unauthorized access of dataCVE-2026-3831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers.
- Product
- Database for Contact Form 7, WPforms, Elementor forms
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 31, 2026WooPayments: Integrated WooCommerce Payments: Unauthorized modification of dataCVE-2026-1710 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_upe_appearance_ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to update plugin settings.
- Product
- WooPayments: Integrated WooCommerce Payments
- Affected
- up to 10.5.1
- What to do
- Affects up to 10.5.1. Update WooPayments: Integrated WooCommerce Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2026LeadConnector: Does not have authorization in a REST routeCVE-2026-1890 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
- Product
- LeadConnector
- Fixed in
- 3.0.22
- What to do
- Update LeadConnector to 3.0.22 or newer.
Mar 26, 2026Elementor Website Builder: Incorrect Authorization to Sensitive Information ExposureCVE-2026-1206 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the 'template_id' supplied to the 'get_template_data' action of the 'elementor_ajax' endpoint.
- Product
- Elementor Website Builder
- Affected
- up to 3.35.7
- What to do
- Affects up to 3.35.7. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 26, 2026Blog2Social: Social Media Auto Post & Scheduler: Unauthorized data lossCVE-2026-4331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2. This is due to the resetSocialMetaTags() function only verifying that the user has the 'read' capability and a valid b2s_security_nonce, both of which are available to Subscriber-level users, as the plugin grants 'blog2social_access' capability to all roles upon activation, allowing them to access the plugin's admin pages where the nonce is output. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all _b2s_post_meta records from the wp_postmeta table, permanently removing all custom social media meta tags for every post on the site.
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Affected
- up to 8.8.2
- What to do
- Affects up to 8.8.2. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 26, 2026FormLift for Infusionsoft Web Forms: Missing AuthorizationCVE-2026-4281 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.5.21. This is due to missing capability checks on the connect() and listen_for_tokens() methods of the FormLift_Infusionsoft_Manager class, both of which are hooked to 'plugins_loaded' and execute on every page load. The connect() function generates an OAuth connection password and leaks it in the redirect Location header without verifying the requesting user is authenticated or authorized. The listen_for_tokens() function only validates the temporary password but performs no user authentication before calling update_option() to save attacker-controlled OAuth tokens and app domain. This makes it possible for unauthenticated attackers to hijack the site's Infusionsoft connection by first triggering the OAuth flow to obtain the temporary password, then using that password to set arbitrary OAuth tokens and app domain via update_option(), effectively redirecting the plugin's API communication to an attacker-controlled server.
- Product
- FormLift for Infusionsoft Web Forms
- Affected
- up to 7.5.21
- What to do
- Affects up to 7.5.21. Update FormLift for Infusionsoft Web Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026PPWP: Missing AuthorizationCVE-2026-32562 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Folio Team PPWP password-protect-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPWP: from n/a through <= 1.9.15.
- Product
- PPWP
- Affected
- up to 1.9.15
- What to do
- Affects up to 1.9.15. Update PPWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.