Updated 55 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

898 results · page 3 of 18

Sep 10, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Directory TraversalCVE-2026-77807 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 11.0.4
What to do
Affects up to 11.0.4. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2026Advanced Product Fields Extended for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-81789 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6.
Product
Advanced Product Fields Extended for WooCommerce
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Advanced Product Fields Extended for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026WP BackItUp Community Edition: Directory TraversalCVE-2026-18386 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup_file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The basename() normalization present in the handler only executes when the traversed target path does not exist, providing no protection against reads of existing files.
Product
WP BackItUp Community Edition
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP BackItUp Community Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Direct Download for WooCommerce: Directory TraversalCVE-2026-15019 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the (top-level include) function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site — not that the requested file path belongs to that product's configured downloads — making exploitation viable on any WooCommerce site with at least one such product.
Product
Direct Download for WooCommerce
Affected
up to 1.19
What to do
Affects up to 1.19. Update Direct Download for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026WP File Download: Directory TraversalCVE-2026-14975 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. An authenticated attacker with Subscriber-level access first poisons the _wpfd_file_metadata['file'] post-meta value via the unprotected file.save handler, after which the streaming endpoint — hooked on init with no authentication requirement — resolves and streams the traversed file path to any caller, including unauthenticated visitors.
Product
WP File Download
Affected
up to 6.3.8
What to do
Affects up to 6.3.8. Update WP File Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org joomunited.com
Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · WordPress plugins & themes · reported by WPScanLow 2.7
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
Product
JCH Optimize
Fixed in
5.0.1
What to do
Update JCH Optimize to 5.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadataCVE-2026-84066 · WordPress plugins & themes · reported by WPScanLow 3.1
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026Frontend Admin by DynamiApps: Does not properly validate a user-controllable directory path before deleting files within itCVE-2026-81347 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
Product
Frontend Admin by DynamiApps
Fixed in
3.29.13
What to do
Update Frontend Admin by DynamiApps to 3.29.13 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026WPFunnels: Does not restrict access to the log files it writes to a predictable location under the public uploads directoryCVE-2026-79631 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
Product
WPFunnels
Fixed in
3.13.0
What to do
Update WPFunnels to 3.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 3, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.CVE-2026-84813 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
Affected
up to 2.8.174
What to do
Affects up to 2.8.174. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.CVE-2026-84769 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
Affected
up to 6.4.26
What to do
Affects up to 6.4.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.CVE-2026-84758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
Affected
up to 6.4.26
What to do
Affects up to 6.4.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 1, 2026Listdom: AI-powered Business Directory with Classifieds Ads Listings: Stored Cross-Site ScriptingCVE-2026-19796 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations.
Product
Listdom: AI-powered Business Directory with Classifieds Ads Listings
Affected
up to 5.8.1
What to do
Affects up to 5.8.1. Update Listdom: AI-powered Business Directory with Classifieds Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2026User Frontend: Does not restrict access to its user directory search endpointCVE-2026-14567 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
Product
User Frontend
Fixed in
4.3.10
What to do
Update User Frontend to 4.3.10 or newer.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.CVE-2026-81271 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
Affected
up to 2.8.176
What to do
Affects up to 2.8.176. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2026Formidable Charts: Directory TraversalCVE-2026-15990 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active and requires the wp-content/uploads/frm-charts/ directory to exist, normally after an image-format chart is rendered.
Product
Formidable Charts
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Formidable Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record formidableforms.com wordfence.com
Aug 26, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not sanitize a user-supplied image reference before using itCVE-2026-77757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.3
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-18547 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute) in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the wp_kses 'templates' allowlist permits the id attribute on div elements but does not neutralize unescaped quotes within its value; when pickadate.js concatenates the stored id value into an HTML string via jQuery .html() on profile page load, the smuggled onfocus and autofocus attribute syntax breaks out of attribute context and executes as JavaScript.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.12.1
What to do
Affects up to 2.12.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026Super Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-28167 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.
Product
Super Forms
Affected
up to 6.3.316
What to do
Affects up to 6.3.316. Update Super Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Directory TraversalCVE-2026-18027 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
Product
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 20, 2026Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.CVE-2026-66649 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
Affected
up to 2.5.8
What to do
Affects up to 2.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.CVE-2026-66604 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
Affected
up to 2.8.173
What to do
Affects up to 2.8.173. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 19, 2026WP Directory Kit: Does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rowsCVE-2026-18231 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.
Product
WP Directory Kit
Fixed in
1.5.7
What to do
Update WP Directory Kit to 1.5.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2026Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.CVE-2026-68565 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
Affected
up to 2.8.172
What to do
Affects up to 2.8.172. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Directory TraversalCVE-2026-17604 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18653 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.
Product
WP Directory Kit
Fixed in
1.5.7
What to do
Update WP Directory Kit to 1.5.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More: Directory TraversalCVE-2026-15056 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse_file_path function. This makes it possible for authenticated attackers, with vendor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2026Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.CVE-2026-28142 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
Affected
up to 1.7.13
What to do
Affects up to 1.7.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.CVE-2026-28004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
Affected
up to 6.4.25
What to do
Affects up to 6.4.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-28001 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-27538 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18474 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
Product
WP Directory Kit
Fixed in
1.5.6
What to do
Update WP Directory Kit to 1.5.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-18230 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
Product
WP Directory Kit
Fixed in
1.5.6
What to do
Update WP Directory Kit to 1.5.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 11, 2026GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: Arbitrary file deletionCVE-2026-19091 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation.
Product
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
Affected
up to 2.8.169
What to do
Affects up to 2.8.169. Update GeoDirectory – WP Business Directory Plugin and Classified Listings Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Aug 10, 2026Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro: (<= 3CVE-2026-19074 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensitive information exposure via the AJAX action `acadp_public_custom_fields_listings`.
Product
Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro
Affected
up to 3.4.2
Fixed in
3.4.3
What to do
Update Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026WP Directory Kit: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-18473 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026GeoDirectory: Does not perform any authorization checkCVE-2026-16988 · WordPress plugins & themes · reported by WPScanHigh 7.5
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
Product
GeoDirectory
Fixed in
2.8.169
What to do
Update GeoDirectory to 2.8.169 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16595 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16594 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16590 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Directory Kit: Does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-16589 · WordPress plugins & themes · reported by WPScanHigh 7.7
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.CVE-2026-61959 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
Affected
up to 6.4.24
What to do
Affects up to 6.4.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: Stored Cross-Site ScriptingCVE-2026-18501 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Affected
up to 1.2.69
What to do
Affects up to 1.2.69. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Aug 5, 2026DHL Shipping Germany for WooCommerce: Does not protect its shipping-label storage directory with server-independent access controlCVE-2026-16993 · WordPress plugins & themes · reported by WPScanLow 3.7
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess (such as nginx) an unauthenticated visitor can download stored shipping labels (each containing a customer's name and postal address) by requesting predictable filenames.
Product
DHL Shipping Germany for WooCommerce
Fixed in
4.0.1
What to do
Update DHL Shipping Germany for WooCommerce to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026GeoDirectory: Does not restrict a user-search handler to users allowed to list usersCVE-2026-16968 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.
Product
GeoDirectory
Fixed in
2.8.168
What to do
Update GeoDirectory to 2.8.168 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026GeoDirectory: Does not sanitise and escape a place-category setting before outputting it back in an admin pageCVE-2025-15677 · WordPress plugins & themes · reported by WPScanLow 3.5
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
GeoDirectory
Fixed in
2.8.110
What to do
Update GeoDirectory to 2.8.110 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026User Access Manager: Directory TraversalCVE-2026-18352 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.
Product
User Access Manager
Affected
up to 2.3.15
What to do
Affects up to 2.3.15. Update User Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026CubeWP Framework: Directory TraversalCVE-2026-13339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable by unauthenticated attackers because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.
Product
CubeWP Framework
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026Support Genix: Does not prevent directory traversal in its ticket-attachment download routeCVE-2026-15932 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server.
Product
Support Genix
Fixed in
1.4.48
What to do
Update Support Genix to 1.4.48 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026HUSKY: Does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion pathCVE-2026-15244 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.
Product
HUSKY
Fixed in
1.4.1
What to do
Update HUSKY to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.