Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,282 results · page 30 of 226
Jun 2, 2026WaveRide: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39553 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.
- Product
- WaveRide
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WaveRide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Blueprint: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39552 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.
- Product
- Blueprint
- Fixed in
- 1.1.5
- What to do
- Update Blueprint to 1.1.5 or newer.
Jun 2, 2026Progress Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28116 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0.
- Product
- Progress Planner
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Progress Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Racquet: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69369 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.
- Product
- Racquet
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update Racquet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Cookiteer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68886 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.
- Product
- Cookiteer
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Cookiteer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Fermentio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58897 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0.
- Product
- Fermentio
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Fermentio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Spin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58707 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.
- Product
- Spin
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Spin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.
- Product
- WP Job Portal
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026WP Job Portal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42684 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.
- Product
- WP Job Portal
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Crafti: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58705 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion. This issue affects Crafti: from n/a through 1.12.
- Product
- Crafti
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Crafti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Accordion FAQ: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58024 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP Local File Inclusion. This issue affects Accordion FAQ: from n/a through 2.2.1.
- Product
- Accordion FAQ
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Accordion FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Confidant: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53440 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion. This issue affects Confidant: from n/a through 1.4.
- Product
- Confidant
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Confidant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Masteriyo LMS PRO: Incorrect Privilege AssignmentCVE-2025-53209 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a through 2.20.0.
- Product
- Masteriyo LMS PRO
- Affected
- up to 2.20.0
- What to do
- Affects up to 2.20.0. Update Masteriyo LMS PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Accordion FAQ: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-52759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnboundStudio Accordion FAQ allows Reflected XSS. This issue affects Accordion FAQ: from n/a through 2.2.1.
- Product
- Accordion FAQ
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Accordion FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026Classified Listing: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42679 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mamunur Rashid Classified Listing allows Path Traversal. This issue affects Classified Listing: from n/a through 5.3.8.
- Product
- Classified Listing
- Affected
- up to 5.3.8
- What to do
- Affects up to 5.3.8. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42678 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5.
- Product
- GiveWP
- Affected
- up to 4.14.5
- What to do
- Affects up to 4.14.5. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026myCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42676 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4.
- Product
- myCred
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42672 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.
- Product
- WP Directory Kit
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026Gravity Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-48866 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.
- Product
- Gravity Forms
- Affected
- up to 2.10.0.1
- What to do
- Affects up to 2.10.0.1. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026LearnPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48865 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS. This issue affects LearnPress: from n/a through 4.3.6.
- Product
- LearnPress
- Affected
- up to 4.3.6
- What to do
- Affects up to 4.3.6. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026WP Statistics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48839 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics allows DOM-Based XSS. This issue affects WP Statistics: from n/a through 14.16.6.
- Product
- WP Statistics
- Affected
- up to 14.16.6
- What to do
- Affects up to 14.16.6. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42683 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows DOM-Based XSS. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.8.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.8.8
- What to do
- Affects up to 1.8.8. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026e2pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42681 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.Com e2pdf allows Reflected XSS. This issue affects e2pdf: from n/a through 1.32.14.
- Product
- e2pdf
- Affected
- up to 1.32.14
- What to do
- Affects up to 1.32.14. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026Contest Gallery Pro: Incorrect Privilege AssignmentCVE-2026-42680 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege Escalation. This issue affects Contest Gallery Pro: from n/a through 29.0.1.
- Product
- Contest Gallery Pro
- Affected
- up to 29.0.1
- What to do
- Affects up to 29.0.1. Update Contest Gallery Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2026WP Travel Pro: Arbitrary user deletionCVE-2026-4290 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.
- Product
- WP Travel Pro
- Affected
- up to 10.6.0
- What to do
- Affects up to 10.6.0. Update WP Travel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwptravel.iowordfence.com
May 29, 2026WP Maps Pro: Privilege EscalationCVE-2026-8732 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
- Product
- WP Maps Pro
- Affected
- up to 6.1.0
- What to do
- Affects up to 6.1.0. Update WP Maps Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
May 28, 2026Eupago Gateway For Woocommerce: Does not properly restrict access to its refund request handlerCVE-2026-7862 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated attackers to initiate refunds against any WooCommerce order using the merchant's payment gateway credentials, and for applicable payment methods, to redirect refunded funds to an attacker-controlled bank account.
- Product
- Eupago Gateway For Woocommerce
- Fixed in
- 4.7.2
- What to do
- Update Eupago Gateway For Woocommerce to 4.7.2 or newer.
May 28, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-7651 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.5. This is due to missing ownership validation on a user-controlled attachment ID, allowing the plugin to store and subsequently delete arbitrary media attachments without verifying that the referenced attachment belongs to the requesting user. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary media attachments uploaded by any other user, including administrators.
- Affected
- up to 5.1.5
- What to do
- Affects up to 5.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 28, 2026FOX – Currency Switcher Professional for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2026-9241 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the `get_value()` function in `classes/fixed/fixed_user_role.php` trusting the attacker-controlled `$_REQUEST['wooc_order_user_roles']` parameter to determine the user's role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user's session object via `$user->roles`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.
- Product
- FOX – Currency Switcher Professional for WooCommerce
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update FOX – Currency Switcher Professional for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 27, 2026Duplicate Page and Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49046 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Duplicate Page and Post allows Blind SQL Injection. This issue affects Duplicate Page and Post: from n/a through 2.9.5.
- Product
- Duplicate Page and Post
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update Duplicate Page and Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Advanced Custom Fields: Font Awesome Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-49044 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field allows Stored XSS. This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 5.0.2.
- Product
- Advanced Custom Fields: Font Awesome Field
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Advanced Custom Fields: Font Awesome Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026SeedProd Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-48972 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeedProd LLC SeedProd Pro allows PHP Local File Inclusion. This issue affects SeedProd Pro: from n/a before 6.19.5.
- Product
- SeedProd Pro
- Fixed in
- 6.19.5
- What to do
- Update SeedProd Pro to 6.19.5 or newer.
May 27, 2026Product Import Export for WooCommerce: Missing AuthorizationCVE-2026-48971 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6.
- Product
- Product Import Export for WooCommerce
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Product Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42762 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows DOM-Based XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Active Products Tables for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42761 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.9.
- Product
- Active Products Tables for WooCommerce
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Affiliate Super Assistent: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Affiliate Super Assistent amazonsimpleadmin allows Stored XSS.This issue affects Affiliate Super Assistent: from n/a through <= 1.10.1.
- Product
- Affiliate Super Assistent
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update Affiliate Super Assistent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026WebinarIgnition: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42757 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Path Traversal.This issue affects WebinarIgnition: from n/a through < 4.08.253.
- Product
- WebinarIgnition
- What to do
- Update WebinarIgnition to the newest version.
May 27, 2026QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42756 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly quickwebp allows Path Traversal.This issue affects QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly: from n/a through <= 3.2.7.
- Product
- QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026TableOn: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42755 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn posts-table-filterable allows Blind SQL Injection.This issue affects TableOn: from n/a through <= 1.0.5.1.
- Product
- TableOn
- Affected
- up to 1.0.5.1
- What to do
- Affects up to 1.0.5.1. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Favicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42754 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phbernard Favicon favicon-by-realfavicongenerator allows Reflected XSS.This issue affects Favicon: from n/a through <= 1.3.46.
- Product
- Favicon
- Affected
- up to 1.3.46
- What to do
- Affects up to 1.3.46. Update Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Booking Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42751 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through <= 2.1.18.
- Product
- Booking Manager
- Affected
- up to 2.1.18
- What to do
- Affects up to 2.1.18. Update Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026WPComplete: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42750 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.4.
- Product
- WPComplete
- Affected
- up to 2.9.5.4
- What to do
- Affects up to 2.9.5.4. Update WPComplete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Easy Form Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42747 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through <= 4.0.6.
- Product
- Easy Form Builder
- Affected
- up to 4.0.6
- What to do
- Affects up to 4.0.6. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Ads by WPQuads: Improper Validation of Specified Quantity in InputCVE-2026-42744 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded allows Manipulating Hidden Fields.This issue affects Ads by WPQuads: from n/a through <= 3.0.2.
- Product
- Ads by WPQuads
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Ads by WPQuads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Tainacan: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42740 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.
- Product
- Tainacan
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Advanced IP Blocker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42739 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IniLerm Advanced IP Blocker advanced-ip-blocker allows DOM-Based XSS.This issue affects Advanced IP Blocker: from n/a through <= 8.10.7.
- Product
- Advanced IP Blocker
- Affected
- up to 8.10.7
- What to do
- Affects up to 8.10.7. Update Advanced IP Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Smart Online Order for Clover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42738 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Stored XSS.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.
- Product
- Smart Online Order for Clover
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026VikBooking Hotel Booking Engine & PMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42737 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Path Traversal.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.9.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through <= 1.13.19.
- Product
- Geo Mashup
- Affected
- up to 1.13.19
- What to do
- Affects up to 1.13.19. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2026WPCS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42733 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 WPCS currency-switcher allows DOM-Based XSS.This issue affects WPCS: from n/a through <= 1.3.1.
- Product
- WPCS
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WPCS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.