Updated 43 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

549new WordPress flaws this week

391,964entries in the database

15,361 results · page 33 of 308

Aug 10, 2026MotoPress Hotel Booking: Does not verify record ownership before updating customer recordsCVE-2026-15238 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
Product
MotoPress Hotel Booking
Fixed in
6.2.3
What to do
Update MotoPress Hotel Booking to 6.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026s2Member: Does not escape several shortcode attributes before outputting them inside an inline script contextCVE-2026-15047 · WordPress plugins & themes · reported by WPScanMedium 6.8
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
Product
s2Member
Fixed in
260805
What to do
Update s2Member to 260805 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Customer Reviews for WooCommerce: Does not perform nonce or capability checks on several settings-related AJAX actionsCVE-2026-14941 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
Product
Customer Reviews for WooCommerce
Fixed in
5.116.0
What to do
Update Customer Reviews for WooCommerce to 5.116.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Podcast Player: Does not validate the destination of a server-side request built from user-supplied inputCVE-2026-14860 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
Product
Podcast Player
Fixed in
8.3.1
What to do
Update Podcast Player to 8.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Advanced Excerpt: Does not sanitise and escape one of its settings before outputting it on the front end of the siteCVE-2026-13701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
Product
Advanced Excerpt
Fixed in
4.5
What to do
Update Advanced Excerpt to 4.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026AutoNetTV Relay: Does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization taskCVE-2026-13600 · WordPress plugins & themes · reported by WPScanHigh 8.1
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
Product
AutoNetTV Relay
Fixed in
3.0.14
What to do
Update AutoNetTV Relay to 3.0.14 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Eventin: Does not properly validate a template path setting before using it to include a local fileCVE-2026-13170 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
Product
Eventin
Fixed in
4.1.20
What to do
Update Eventin to 4.1.20 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026WPC Order Tip for WooCommerce: Does not perform authorisation or nonce checks in one of its reporting featuresCVE-2026-18357 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates.
Product
WPC Order Tip for WooCommerce
Fixed in
3.3.1
What to do
Update WPC Order Tip for WooCommerce to 3.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpointsCVE-2026-16574 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Fixed in
5.0.11
What to do
Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026YMC Filter: Does not sanitize and escape a layout builder setting before outputting it on a public endpointCVE-2026-16558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
Product
YMC Filter
Fixed in
3.12.8
What to do
Update YMC Filter to 3.12.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Link Library: Does not sanitise and escape a parameter before reflecting it back in a responseCVE-2026-16535 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
Product
Link Library
Fixed in
7.9.4
What to do
Update Link Library to 7.9.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Easy Accordion: Stored Cross-Site ScriptingCVE-2026-18988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Accordion
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Easy Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 7, 2026The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post contentCVE-2026-48093 · WordPress plugins & themes · reported by GitHubMedium 6.5
The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Aug 7, 2026The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping CVE-2026-48094 · WordPress plugins & themes · reported by GitHubMedium 5.3
The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp->request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin's sharing link is displayed. WordPress's security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `"`, `<`, `>` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Aug 7, 2026Estatik Real Estate: Does not bind its OAuth social login flow to the initiating user sessionCVE-2026-16262 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Product
Estatik Real Estate
Fixed in
4.3.3
What to do
Update Estatik Real Estate to 4.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Meow Gallery: Does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleriesCVE-2026-15386 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
Product
Meow Gallery
Fixed in
5.5.2
What to do
Update Meow Gallery to 5.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscriptions for WooCommerce: Does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2CVE-2026-15215 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
Product
Subscriptions for WooCommerce
Fixed in
2.0.1
What to do
Update Subscriptions for WooCommerce to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Comments: Does not properly escape a user-supplied URL before outputting it inside an HTML attributeCVE-2026-15032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
Product
Comments
Fixed in
7.6.60
What to do
Update Comments to 7.6.60 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscribe2: Does not properly escape a user-supplied value before reflecting it into a public subscription formCVE-2026-14331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
Product
Subscribe2
Fixed in
10.46
What to do
Update Subscribe2 to 10.46 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Ultra Addons for Contact Form 7: Stored Cross-Site ScriptingCVE-2026-12801 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultra Addons for Contact Form 7
Affected
up to 3.5.43
What to do
Affects up to 3.5.43. Update Ultra Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 6, 2026WP Hotel Booking: Does not ensure that room quantities and the resulting order total are non-negativeCVE-2026-15149 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.
Product
WP Hotel Booking
Fixed in
2.3.3
What to do
Update WP Hotel Booking to 2.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Simple Membership: Does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membershipCVE-2026-14936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.
Product
Simple Membership
Fixed in
4.7.7
What to do
Update Simple Membership to 4.7.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.CVE-2026-66711 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
Affected
up to 5.5.6
What to do
Affects up to 5.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.CVE-2026-66707 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
Affected
up to 3.7.5
What to do
Affects up to 3.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.CVE-2026-66706 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.CVE-2026-66705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
Affected
up to 5.2.1
What to do
Affects up to 5.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.CVE-2026-66703 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
Affected
up to 1.2.78.0
What to do
Affects up to 1.2.78.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.CVE-2026-66702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
Affected
up to 1.0.274.1
What to do
Affects up to 1.0.274.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.CVE-2026-66694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
Affected
up to 10.9.3.1
What to do
Affects up to 10.9.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.CVE-2026-66690 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
Affected
up to 4.16.5
What to do
Affects up to 4.16.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.CVE-2026-66688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
Affected
up to 1.45.2
What to do
Affects up to 1.45.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.CVE-2026-66664 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.
Affected
up to 14.2.0
What to do
Affects up to 14.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-66663 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
Affected
up to 5.5.79
What to do
Affects up to 5.5.79. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
Product
Events Manager
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.CVE-2026-66440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.CVE-2026-66439 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.
Affected
up to 3.2.0.3
What to do
Affects up to 3.2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.CVE-2026-65565 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
Affected
up to 5.2.3.3
What to do
Affects up to 5.2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.CVE-2026-65560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
Affected
up to 2.5.48
What to do
Affects up to 2.5.48. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.CVE-2026-65545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.CVE-2026-65544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
Affected
up to 7.14.5
What to do
Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.CVE-2026-65517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.CVE-2026-65515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
Affected
up to 2.35.0
What to do
Affects up to 2.35.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
Affected
up to 1.6.12.10
What to do
Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.CVE-2026-65509 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
Affected
up to 7.5.1
What to do
Affects up to 7.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.CVE-2026-61982 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.CVE-2026-61964 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
Affected
up to 5.2.9
What to do
Affects up to 5.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.CVE-2026-61963 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
Affected
up to 3.38
What to do
Affects up to 3.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.CVE-2026-61961 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
Affected
up to 4.5.6
What to do
Affects up to 4.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.CVE-2026-61959 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
Affected
up to 6.4.24
What to do
Affects up to 6.4.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.CVE-2026-28179 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
Affected
up to 1.33.0
What to do
Affects up to 1.33.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.