Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,555 results · page 29 of 112
Aug 19, 2026Easy Media Replace: Does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list viewCVE-2026-15253 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.
- Product
- Easy Media Replace
- Affected
- up to 0.2.0
- What to do
- Affects up to 0.2.0. Update Easy Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026User Verification by PickPlugins: Does not verify that a request to resend a verification email is authorized to act on the supplied userCVE-2026-14861 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.
- Product
- User Verification by PickPlugins
- Affected
- up to 2.0.47
- What to do
- Affects up to 2.0.47. Update User Verification by PickPlugins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configurationCVE-2026-14826 · WordPress plugins & themes · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 11.2.4
- What to do
- Update Quiz and Survey Master (QSM) to 11.2.4 or newer.
Aug 19, 2026Quiz and Survey Master (QSM): Does not perform a per-object ownership check before saving a quiz's front-end text settingsCVE-2026-14825 · WordPress plugins & themes · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 11.2.4
- What to do
- Update Quiz and Survey Master (QSM) to 11.2.4 or newer.
Aug 19, 2026Booking calendar, Appointment Booking System: Does not properly sanitize uploaded SVG filesCVE-2026-14334 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.36
- What to do
- Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 202610Web Booster: Does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page headCVE-2026-14287 · WordPress plugins & themes · reported by WPScanMedium 4.7
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.
- Product
- 10Web Booster
- Fixed in
- 2.33.5
- What to do
- Update 10Web Booster to 2.33.5 or newer.
Aug 19, 2026WCFM Marketplace: Does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deletedCVE-2026-14196 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.
- Product
- WCFM Marketplace
- Fixed in
- 3.8.1
- What to do
- Update WCFM Marketplace to 3.8.1 or newer.
Aug 19, 2026Eventin: Does not verify ownership before allowing schedule records to be modified or deletedCVE-2026-13175 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.
- Product
- Eventin
- Fixed in
- 4.1.21
- What to do
- Update Eventin to 4.1.21 or newer.
Aug 19, 2026Eventin: Does not verify ownership or capability before deleting user accountsCVE-2026-13174 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.
- Product
- Eventin
- Fixed in
- 4.1.21
- What to do
- Update Eventin to 4.1.21 or newer.
Aug 19, 2026Eventin: Does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creationCVE-2026-13173 · WordPress plugins & themes · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.
- Product
- Eventin
- Fixed in
- 4.1.21
- What to do
- Update Eventin to 4.1.21 or newer.
Aug 19, 2026Eventin: Does not properly verify ownership of events before allowing them to be modifiedCVE-2026-13169 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.
- Product
- Eventin
- Fixed in
- 4.1.21
- What to do
- Update Eventin to 4.1.21 or newer.
Aug 19, 2026Dinatur: Does not sanitize and escape user input before using it in a SQL queryCVE-2026-12983 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the Dinatur WordPress plugin through 1.18's data.
- Product
- Dinatur
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update Dinatur to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Advanced File Manager: Does not perform capability checks in several of its file management AJAX actionsCVE-2026-11565 · WordPress plugins & themes · reported by WPScanHigh 8.5
The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site.
- Product
- Advanced File Manager
- Fixed in
- 5.4.13
- What to do
- Update Advanced File Manager to 5.4.13 or newer.
Aug 17, 2026ShopSmart Loyalty for WooCommerce: Does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated usersCVE-2026-14832 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
- Product
- ShopSmart Loyalty for WooCommerce
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update ShopSmart Loyalty for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 17, 2026WooMS: Does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such requestCVE-2026-13700 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.
- Product
- WooMS
- Affected
- up to 9.14
- What to do
- Affects up to 9.14. Update WooMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2026Extra Product Options Builder for WooCommerce: Does not verify that the requester is entitled to a customer-uploaded file before serving itCVE-2026-19728 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.
- Product
- Extra Product Options Builder for WooCommerce
- Fixed in
- 1.2.176
- What to do
- Update Extra Product Options Builder for WooCommerce to 1.2.176 or newer.
Aug 16, 2026Visualizer: Does not properly authorise access to the configuration of its chartsCVE-2026-19726 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from.
- Product
- Visualizer
- Fixed in
- 4.0.7
- What to do
- Update Visualizer to 4.0.7 or newer.
Aug 16, 2026WPvivid — Backup, Migration & Staging: Does not sanitise a value taken from an unauthenticated request before using it to build a log file pathCVE-2026-19725 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.
- Product
- WPvivid — Backup, Migration & Staging
- Fixed in
- 0.9.131
- What to do
- Update WPvivid — Backup, Migration & Staging to 0.9.131 or newer.
Aug 16, 2026CatFolders Document Gallery & PDF Library: Does not have authorisation checks in some of its REST API endpointsCVE-2026-19717 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.
- Product
- CatFolders Document Gallery & PDF Library
- Fixed in
- 2.0.7
- What to do
- Update CatFolders Document Gallery & PDF Library to 2.0.7 or newer.
Aug 16, 2026Simple JWT Login: Does not validate the audience of the Google identity tokens it acceptsCVE-2026-19714 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Simple JWT Login WordPress plugin before 3.6.8 does not validate the audience of the Google identity tokens it accepts, allowing unauthenticated users to authenticate as any user whose email address such a token carries, up to and including an administrator. Every site with the Simple JWT Login WordPress plugin before 3.6.8's Google sign-in enabled is affected.
- Product
- Simple JWT Login
- Affected
- up to an
- Fixed in
- 3.6.8
- What to do
- Update Simple JWT Login to 3.6.8 or newer.
Aug 16, 2026Masteriyo LMS: Does not sanitise and escape a quiz field before outputting it back in a pageCVE-2026-19712 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.
- Product
- Masteriyo LMS
- Fixed in
- 2.3.3
- What to do
- Update Masteriyo LMS to 2.3.3 or newer.
Aug 16, 2026Premium Packages: Does not validate a withdrawal request against the requesting user's actual earned balanceCVE-2026-19711 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.
- Product
- Premium Packages
- Fixed in
- 7.0.7
- What to do
- Update Premium Packages to 7.0.7 or newer.
Aug 16, 2026ECS: Does not perform ownership or post-status checksCVE-2026-19613 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.
- Product
- ECS
- Fixed in
- 4.3.10
- What to do
- Update ECS to 4.3.10 or newer.
Aug 16, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18653 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.
- Product
- WP Directory Kit
- Fixed in
- 1.5.7
- What to do
- Update WP Directory Kit to 1.5.7 or newer.
Aug 16, 2026All-in-One WP Migration and Backup: Does not restrict its migration import functionality to network administrators on multisite installationsCVE-2026-17533 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.
- Product
- All-in-One WP Migration and Backup
- Fixed in
- 7.108
- What to do
- Update All-in-One WP Migration and Backup to 7.108 or newer.
Aug 16, 2026Manual Image Crop: Does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in userCVE-2026-15384 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.
- Product
- Manual Image Crop
- Fixed in
- 1.15
- What to do
- Update Manual Image Crop to 1.15 or newer.
Aug 16, 2026Divi: Does not properly escape some of its Social Media Follow module settings before outputting them in link attributesCVE-2026-13712 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.
- Product
- Divi
- Fixed in
- 5.9.0
- What to do
- Update Divi to 5.9.0 or newer.
Aug 15, 2026ECS: Does not have capability or ownership checks on its dynamic repeater actionsCVE-2026-18807 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.
- Product
- ECS
- Fixed in
- 4.3.13
- What to do
- Update ECS to 4.3.13 or newer.
Aug 15, 2026Backup Migration: Does not properly restrict a post-restore automatic login mechanismCVE-2026-18216 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
- Product
- Backup Migration
- Fixed in
- 2.1.7
- What to do
- Update Backup Migration to 2.1.7 or newer.
Aug 15, 2026Product Feed PRO for WooCommerce by AdTribes: Does not perform an authorization check on one of its REST read routesCVE-2026-16611 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.
- Product
- Product Feed PRO for WooCommerce by AdTribes
- Fixed in
- 13.5.7
- What to do
- Update Product Feed PRO for WooCommerce by AdTribes to 13.5.7 or newer.
Aug 15, 2026Simply Schedule Appointments: Does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to seeCVE-2026-16541 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.
- Product
- Simply Schedule Appointments
- Fixed in
- 1.6.12.17
- What to do
- Update Simply Schedule Appointments to 1.6.12.17 or newer.
Aug 15, 2026ECS: Does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor)CVE-2026-14230 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.
- Product
- ECS
- Fixed in
- 4.3.8
- What to do
- Update ECS to 4.3.8 or newer.
Aug 15, 2026ECS: Does not check the post status or any capabilityCVE-2026-14229 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.
- Product
- ECS
- Fixed in
- 4.3.8
- What to do
- Update ECS to 4.3.8 or newer.
Aug 14, 2026Essential Addons for Elementor: Does not prevent user-supplied registration fields from overwriting reserved account attributesCVE-2026-18039 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom profile field with a particular label has been configured.
- Product
- Essential Addons for Elementor
- Fixed in
- 6.7.2
- What to do
- Update Essential Addons for Elementor to 6.7.2 or newer.
Aug 14, 2026Epeken All Kurir for Woocommerce: Does not verify that a payment-confirmation request originates from the owner of the targeted orderCVE-2026-16739 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
- Product
- Epeken All Kurir for Woocommerce
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Epeken All Kurir for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2026Paymob for WooCommerce: Does not properly sanitise a client-supplied identifier before using it in a SQL query within its publicCVE-2026-15205 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database — including user credentials and other secrets — through both in-band (reflected) and time-based blind extraction.
- Product
- Paymob for WooCommerce
- Fixed in
- 4.1.9
- What to do
- Update Paymob for WooCommerce to 4.1.9 or newer.
Aug 14, 2026Embed Google Photos album: Does not escape a shortcode attribute value before outputting it inside an HTML attributeCVE-2026-14290 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.
- Product
- Embed Google Photos album
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Embed Google Photos album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Ecwid by Lightspeed Ecommerce Shopping Cart: Does not perform a capability check or nonce verification on one of its store-management actionsCVE-2026-14332 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it.
- Product
- Ecwid by Lightspeed Ecommerce Shopping Cart
- Fixed in
- 7.0.9
- What to do
- Update Ecwid by Lightspeed Ecommerce Shopping Cart to 7.0.9 or newer.
Aug 13, 2026ShopEngine Elementor WooCommerce Builder Addon: Does not protect one of its authentication endpoints against CSRFCVE-2026-19088 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
- Product
- ShopEngine Elementor WooCommerce Builder Addon
- Fixed in
- 4.9.3
- What to do
- Update ShopEngine Elementor WooCommerce Builder Addon to 4.9.3 or newer.
Aug 13, 2026WP Helper Premium: Does not verify the order keyCVE-2026-18945 · WordPress plugins & themes · reported by WPScanHigh 8.2
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders. Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled.
- Product
- WP Helper Premium
- Fixed in
- 4.7.6
- What to do
- Update WP Helper Premium to 4.7.6 or newer.
Aug 13, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) is assigned to the appointment being accessedCVE-2026-14213 · WordPress plugins & themes · reported by WPScanLow 3.7
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.6
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.6 or newer.
Aug 13, 2026Customer Email Verification for WooCommerce: Does not correctly validate the email-verification activation codeCVE-2026-14182 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.
- Product
- Customer Email Verification for WooCommerce
- Fixed in
- 3.2.6
- What to do
- Update Customer Email Verification for WooCommerce to 3.2.6 or newer.
Aug 13, 2026KiviCare: Does not restrict the roles assignable through its unauthenticated registration endpointCVE-2026-13610 · WordPress plugins & themes · reported by WPScanHigh 7.5
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
- Product
- KiviCare
- Fixed in
- 4.5.2
- What to do
- Update KiviCare to 4.5.2 or newer.
Aug 13, 2026Food Menu: Does not perform any capability or ownership check on its reservation-status update actionCVE-2026-13328 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations.
- Product
- Food Menu
- Fixed in
- 6.0.2
- What to do
- Update Food Menu to 6.0.2 or newer.
Aug 12, 2026Estatik Real Estate: Does not validate the same recipient list that it later uses to address the message sent by its property request formCVE-2026-18044 · WordPress plugins & themes · reported by WPScanLow 3.7
The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later uses to address the message sent by its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To on sites where the form is configured to route to a custom address.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.4
- What to do
- Update Estatik Real Estate to 4.3.4 or newer.
Aug 12, 2026Quick Paypal Payments: Does not verify the paid amountCVE-2026-17008 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.
- Product
- Quick Paypal Payments
- Affected
- up to 5.7.50
- What to do
- Affects up to 5.7.50. Update Quick Paypal Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026Payment Button for PayPal: Does not enforce the merchant-configured price server-side and trusts a client-supplied payment amountCVE-2026-16990 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Button for PayPal WordPress plugin through 1.2.3.44 does not enforce the merchant-configured price server-side and trusts a client-supplied payment amount, allowing unauthenticated attackers to create a real PayPal order against the merchant for an arbitrary lower amount.
- Product
- Payment Button for PayPal
- Affected
- up to 1.2.3.44
- What to do
- Affects up to 1.2.3.44. Update Payment Button for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026Kirki: Does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode executionCVE-2026-16747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Kirki WordPress plugin before 6.2.1 does not properly authorise its front-end form submission REST routes and passes attacker-controlled input through shortcode execution, allowing unauthenticated users to run any shortcode registered on the site, which on a default install leads to disclosure of the site administrator's email address and an arbitrary-recipient mail relay from the victim's domain.
- Product
- Kirki
- Fixed in
- 6.2.1
- What to do
- Update Kirki to 6.2.1 or newer.
Aug 12, 2026Payment Gateway for PayPal on WooCommerce: Does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parametersCVE-2026-16621 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that payment actually succeeded before completing an order in its PayPal return handler: it reads attacker-controlled parameters, performs no amount comparison and no order-ownership check, and completes the order even when the server-side gateway verification fails, allowing an unauthenticated attacker to mark arbitrary orders as paid without paying.
- Product
- Payment Gateway for PayPal on WooCommerce
- Fixed in
- 9.2.1
- What to do
- Update Payment Gateway for PayPal on WooCommerce to 9.2.1 or newer.
Aug 12, 2026Welcart e-Commerce: Does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a staCVE-2026-15213 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying.
- Product
- Welcart e-Commerce
- Fixed in
- 2.11.33
- What to do
- Update Welcart e-Commerce to 2.11.33 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.