Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
537 results · page 3 of 11
Jun 17, 2026Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.CVE-2025-69120 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.CVE-2025-15657 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.
- Affected
- up to 93.1.0
- What to do
- Affects up to 93.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.CVE-2026-54807 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.CVE-2026-49767 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.CVE-2026-39529 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.CVE-2026-27400 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.CVE-2026-22327 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.CVE-2026-22326 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.CVE-2025-69176 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.CVE-2025-69149 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.CVE-2025-69141 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.CVE-2025-69131 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.CVE-2025-69129 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Especio <= 1.0 versions.CVE-2025-69124 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Especio <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.CVE-2025-69116 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.CVE-2025-58954 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.
- Affected
- up to 2.11.0
- What to do
- Affects up to 2.11.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.CVE-2024-52488 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.CVE-2026-49769 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.CVE-2026-45439 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-45437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.CVE-2026-40787 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.
- Affected
- up to 11.0.0
- What to do
- Affects up to 11.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field <= 1.0.6 versions.CVE-2026-40769 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field <= 1.0.6 versions.
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.CVE-2026-39594 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.CVE-2026-39511 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.
- Affected
- up to 9.1.08.001
- What to do
- Affects up to 9.1.08.001. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.CVE-2026-39470 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.CVE-2025-60175 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.CVE-2025-15659 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbCVE-2018-25436 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipuCVE-2016-20081 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfr.wordpress.orgexploit-db.com
Jun 15, 2026WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating CVE-2016-20078 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like wp-config.php containing database credentials and configuration data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbCVE-2016-20071 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.
- Product
- 404 Redirection Manager
- What to do
- Update 404 Redirection Manager to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to mCVE-2016-20070 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com
Jun 15, 2026the shortcode function that fails to sanitize the calendar parameter before using it in database queries: WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injectionCVE-2016-20069 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.
- Product
- the shortcode function that fails to sanitize the calendar parameter before using it in database queries
- What to do
- Update the shortcode function that fails to sanitize the calendar parameter before using it in database queries to the newest version.
Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com
Jun 15, 2026WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbCVE-2016-20068 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com
Jun 15, 2026WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated usCVE-2016-20067 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 15, 2026WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file uplCVE-2016-20066 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers like onerror attributes to execute arbitrary JavaScript in the browsers of users viewing the affected content.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 12, 2026WordPress Toolkit before 6.11.0 as used in cPanel & WHM,: Argument injectionCVE-2026-47365 · WordPress plugins & themes · reported by support@hackerone.comCritical 9.9
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.
- Product
- WordPress Toolkit before 6.11.0 as used in cPanel & WHM,
- Fixed in
- 6.11.0
- What to do
- Update WordPress Toolkit before 6.11.0 as used in cPanel & WHM, to 6.11.0 or newer.
Jun 9, 2026WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injectCVE-2017-20247 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can send GET requests with crafted SQL payloads in the aid parameter to extract sensitive database information including user credentials and table contents.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordapptha.comexploit-db.com
Jun 9, 2026Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious coCVE-2016-20063 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to extract sensitive database information including user credentials and site configuration data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordlenonleite.com.brtarget
Jun 7, 2026WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting CVE-2024-58349 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 4, 2026WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manCVE-2019-25727 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordweb-dorado.comexploit-db.com
May 17, 2026WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POCVE-2018-25335 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to execute code from the uploads directory.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
May 17, 2026WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting fiCVE-2018-25329 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting file paths into the url parameter. Attackers can send GET requests to wp.spritz.content.filter.php with malicious url values to access sensitive files like system configuration and credentials.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddownloads.wordpress.orgexploit-db.com
May 16, 2026WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating CVE-2021-47979 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
May 10, 2026WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafCVE-2022-50955 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
May 10, 2026WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipuCVE-2022-50954 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the controller parameter in tblight.php. Attackers can supply path traversal sequences through the controller GET parameter to include arbitrary files outside the intended controllers directory.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
May 10, 2026WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scriptsCVE-2022-50946 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject script payloads through the testimonial title field that execute in the browsers of other users viewing the draft post, enabling cookie theft and session hijacking.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddownloads.wordpress.orgexploit-db.com
May 10, 2026WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaCVE-2022-50945 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by exploiting unsanitized input fields. Attackers can insert JavaScript payloads in the dady_input_text or dady2_input_text fields via the plugin options panel to execute arbitrary code when the page is viewed.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordprofiles.wordpress.orgexploit-db.com
May 10, 2026Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by enteCVE-2021-47929 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfilterable-portfolio.comwordpress.org
Feb 11, 2026WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered loCVE-2019-25315 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.