Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,555 results · page 32 of 112
Aug 9, 2026LWS Optimize: Does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboardCVE-2026-16032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
- Product
- LWS Optimize
- Fixed in
- 4.1.2
- What to do
- Update LWS Optimize to 4.1.2 or newer.
Aug 9, 2026InfiniteWP Client: Does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installationsCVE-2026-15038 · WordPress plugins & themes · reported by WPScanCritical 9.8
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
- Product
- InfiniteWP Client
- Fixed in
- 1.13.6
- What to do
- Update InfiniteWP Client to 1.13.6 or newer.
Aug 8, 2026AI Engine: Does not confine a caller-supplied file path before reading it and forwarding the contents to an external serviceCVE-2026-16955 · WordPress plugins & themes · reported by WPScanMedium 5
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
- Product
- AI Engine
- Fixed in
- 3.6.6
- What to do
- Update AI Engine to 3.6.6 or newer.
Aug 8, 2026AI Engine: Does not verify ownership of a guest's uploaded chatbot files before deletionCVE-2026-16953 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
- Product
- AI Engine
- Fixed in
- 3.6.4
- What to do
- Update AI Engine to 3.6.4 or newer.
Aug 8, 2026Solace Extra: Does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged usersCVE-2026-16948 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
- Product
- Solace Extra
- Fixed in
- 1.6.1
- What to do
- Update Solace Extra to 1.6.1 or newer.
Aug 8, 2026Download Monitor: Does not perform authorization checks on one of its download-logging AJAX actionsCVE-2026-16608 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
- Product
- Download Monitor
- Fixed in
- 5.2.6
- What to do
- Update Download Monitor to 5.2.6 or newer.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16595 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16594 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16590 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 8, 2026WP Directory Kit: Does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-16589 · WordPress plugins & themes · reported by WPScanHigh 7.7
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 8, 2026Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection: Does not perform any capability check on one of its REST API endpointsCVE-2026-16578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
- Product
- Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
- Fixed in
- 1.4.0
- What to do
- Update Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection to 1.4.0 or newer.
Aug 8, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpointsCVE-2026-16574 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
- Product
- Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
- Fixed in
- 5.0.11
- What to do
- Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.11 or newer.
Aug 8, 2026WP Statistics: Does not perform a capability check on a set of dashboard analytics AJAX handlersCVE-2026-16562 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
- Product
- WP Statistics
- Fixed in
- 14.16.10
- What to do
- Update WP Statistics to 14.16.10 or newer.
Aug 8, 2026YMC Filter: Does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged usersCVE-2026-16559 · WordPress plugins & themes · reported by WPScanMedium 6.8
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
- Product
- YMC Filter
- Fixed in
- 3.12.9
- What to do
- Update YMC Filter to 3.12.9 or newer.
Aug 8, 2026YMC Filter: Does not sanitize and escape a layout builder setting before outputting it on a public endpointCVE-2026-16558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
- Product
- YMC Filter
- Fixed in
- 3.12.8
- What to do
- Update YMC Filter to 3.12.8 or newer.
Aug 8, 2026Link Library: Does not sanitise and escape a parameter before reflecting it back in a responseCVE-2026-16535 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
- Product
- Link Library
- Fixed in
- 7.9.4
- What to do
- Update Link Library to 7.9.4 or newer.
Aug 8, 2026Appointment Hour Booking: Does not validate a client-supplied booking price against the server-side configured service priceCVE-2026-16282 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.
- Product
- Appointment Hour Booking
- Fixed in
- 1.5.88
- What to do
- Update Appointment Hour Booking to 1.5.88 or newer.
Aug 8, 2026Newsletters: Does not strictly compare its API authentication keyCVE-2026-16269 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.
- Product
- Newsletters
- Fixed in
- 4.16
- What to do
- Update Newsletters to 4.16 or newer.
Aug 8, 2026Newsletters: Does not restrict the classes allowedCVE-2026-16267 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.
- Product
- Newsletters
- Fixed in
- 4.16
- What to do
- Update Newsletters to 4.16 or newer.
Aug 7, 2026Simple CAPTCHA with Cloudflare Turnstile: Does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integrationCVE-2026-15239 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
- Product
- Simple CAPTCHA with Cloudflare Turnstile
- Fixed in
- 1.42.0
- What to do
- Update Simple CAPTCHA with Cloudflare Turnstile to 1.42.0 or newer.
Aug 7, 2026Subscriptions for WooCommerce: Does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the orCVE-2026-15211 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
- Product
- Subscriptions for WooCommerce
- Fixed in
- 2.0.1
- What to do
- Update Subscriptions for WooCommerce to 2.0.1 or newer.
Aug 7, 2026WP Events Manager: Does not verify that an incoming payment notification originates from the site's configured merchant accountCVE-2026-15148 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
- Product
- WP Events Manager
- Fixed in
- 2.2.5
- What to do
- Update WP Events Manager to 2.2.5 or newer.
Aug 7, 2026WP Maps: Does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatchesCVE-2026-16265 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
- Product
- WP Maps
- Fixed in
- 4.9.7
- What to do
- Update WP Maps to 4.9.7 or newer.
Aug 7, 2026WP Maps: Does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusionCVE-2026-16263 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.
- Product
- WP Maps
- Fixed in
- 4.9.7
- What to do
- Update WP Maps to 4.9.7 or newer.
Aug 7, 2026Estatik Real Estate: Does not bind its OAuth social login flow to the initiating user sessionCVE-2026-16262 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.3
- What to do
- Update Estatik Real Estate to 4.3.3 or newer.
Aug 7, 2026Ajax Search Lite: Does not prevent the deserialization of untrusted inputCVE-2026-16258 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.
- Product
- Ajax Search Lite
- Fixed in
- 4.14.5
- What to do
- Update Ajax Search Lite to 4.14.5 or newer.
Aug 7, 2026MStore API: Does not perform authorization or purchase-ownership checks on its REST product-review creation routeCVE-2026-16041 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
- Product
- MStore API
- Fixed in
- 4.21.0
- What to do
- Update MStore API to 4.21.0 or newer.
Aug 7, 2026MStore API: Does not restrict its vendor-orders endpoint to the caller's own ordersCVE-2026-16039 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
- Product
- MStore API
- Fixed in
- 4.21.0
- What to do
- Update MStore API to 4.21.0 or newer.
Aug 7, 2026MStore API: Does not verify the payment with the payment gateway before marking an orderCVE-2026-16038 · WordPress plugins & themes · reported by WPScanCritical 9.1
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
- Product
- MStore API
- Fixed in
- 4.21.0
- What to do
- Update MStore API to 4.21.0 or newer.
Aug 7, 2026MStore API: Does not correctly verify the cryptographic signature of the token used to authenticate its phone-based loginCVE-2026-16030 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
- Product
- MStore API
- Fixed in
- 4.21.0
- What to do
- Update MStore API to 4.21.0 or newer.
Aug 7, 2026Meow Gallery: Does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleriesCVE-2026-15386 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
- Product
- Meow Gallery
- Fixed in
- 5.5.2
- What to do
- Update Meow Gallery to 5.5.2 or newer.
Aug 7, 2026Content Views: Does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL queryCVE-2026-15361 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
- Product
- Content Views
- Fixed in
- 4.5
- What to do
- Update Content Views to 4.5 or newer.
Aug 7, 2026Templately: Does not have an authorisation check on one of its request handlersCVE-2026-15359 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site's cloud template library to attacker-controlled content.
- Product
- Templately
- Fixed in
- 3.7.1
- What to do
- Update Templately to 3.7.1 or newer.
Aug 7, 2026BNE Testimonials: Does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline scriptCVE-2026-15245 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.
- Product
- BNE Testimonials
- Fixed in
- 2.0.8.2
- What to do
- Update BNE Testimonials to 2.0.8.2 or newer.
Aug 7, 2026Subscriptions for WooCommerce: Does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2CVE-2026-15215 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
- Product
- Subscriptions for WooCommerce
- Fixed in
- 2.0.1
- What to do
- Update Subscriptions for WooCommerce to 2.0.1 or newer.
Aug 7, 2026Subscriptions for WooCommerce: Does not verify that the requester owns the subscription being viewed before rendering its detailsCVE-2026-15214 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
- Product
- Subscriptions for WooCommerce
- Fixed in
- 2.0.1
- What to do
- Update Subscriptions for WooCommerce to 2.0.1 or newer.
Aug 7, 2026Comments: Does not properly escape a user-supplied URL before outputting it inside an HTML attributeCVE-2026-15032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
- Product
- Comments
- Fixed in
- 7.6.60
- What to do
- Update Comments to 7.6.60 or newer.
Aug 7, 2026Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content: Does not restrict REST API access to authenticated usersCVE-2026-14943 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.
- Product
- Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content
- Fixed in
- 2.8.4
- What to do
- Update Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content to 2.8.4 or newer.
Aug 7, 2026Subscribe2: Does not properly escape a user-supplied value before reflecting it into a public subscription formCVE-2026-14331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
- Product
- Subscribe2
- Fixed in
- 10.46
- What to do
- Update Subscribe2 to 10.46 or newer.
Aug 7, 2026WP Events Manager: Does not validate the requested quantityCVE-2026-14205 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
- Product
- WP Events Manager
- Fixed in
- 2.2.5
- What to do
- Update WP Events Manager to 2.2.5 or newer.
Aug 6, 2026DataPress (Dataverse Integration): Does not properly restrict access to its template rendering feature and exposes the viewing user's data to itCVE-2026-5336 · WordPress plugins & themes · reported by WPScanMedium 6.8
The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.
- Product
- DataPress (Dataverse Integration)
- Fixed in
- 2.91
- What to do
- Update DataPress (Dataverse Integration) to 2.91 or newer.
Aug 6, 2026WPC Name Your Price for WooCommerce: Does not enforce its server-side price allowlist for products configured in "Select" price modeCVE-2026-16620 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfixed vector from CVE-2025-12115, whose 2.2.0 fix only addressed applying a custom price to products where Name Your Price is disabled and left the Select-mode allowlist unenforced through 2.2.4.
- Product
- WPC Name Your Price for WooCommerce
- Affected
- up to 2.2.4
- Fixed in
- 2.2.5
- What to do
- Update WPC Name Your Price for WooCommerce to 2.2.5 or newer.
Aug 6, 2026miniOrange 2FA: Does not correctly limit the number of second-factor verification attemptsCVE-2026-16619 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
- Product
- miniOrange 2FA
- Fixed in
- 6.2.8
- What to do
- Update miniOrange 2FA to 6.2.8 or newer.
Aug 6, 2026Event Booking Manager for WooCommerce (Pro): Does not validate the ticket price on the server during its native (non-WooCommerce) checkoutCVE-2026-16067 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.
- Product
- Event Booking Manager for WooCommerce (Pro)
- Fixed in
- 5.0.3
- What to do
- Update Event Booking Manager for WooCommerce (Pro) to 5.0.3 or newer.
Aug 6, 2026Ninja Forms: Does not prevent user-supplied query-string inputCVE-2026-15256 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.
- Product
- Ninja Forms
- Fixed in
- 3.14.10
- What to do
- Update Ninja Forms to 3.14.10 or newer.
Aug 6, 2026RegistrationMagic: Does not compare the verified PayPal capture's amountCVE-2026-15208 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.5
- What to do
- Update RegistrationMagic to 6.0.9.5 or newer.
Aug 6, 2026WP Hotel Booking: Does not verify that a payment notification corresponds to a payment made to the site's own merchant accountCVE-2026-15152 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.
- Product
- WP Hotel Booking
- Fixed in
- 2.3.2
- What to do
- Update WP Hotel Booking to 2.3.2 or newer.
Aug 6, 2026WP Hotel Booking: Does not ensure that room quantities and the resulting order total are non-negativeCVE-2026-15149 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.
- Product
- WP Hotel Booking
- Fixed in
- 2.3.3
- What to do
- Update WP Hotel Booking to 2.3.3 or newer.
Aug 6, 2026Five Star Restaurant Reservations: Does not verify the authenticity of incoming payment notificationsCVE-2026-15147 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.7.23
- What to do
- Update Five Star Restaurant Reservations to 2.7.23 or newer.
Aug 6, 2026Simple Membership: Does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membershipCVE-2026-14936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.
- Product
- Simple Membership
- Fixed in
- 4.7.7
- What to do
- Update Simple Membership to 4.7.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.