Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

6,267 results · page 36 of 126

Jan 31, 2026Ajax Load More – Infinite Scroll, Load More, & Lazy Load: Unauthorized access of dataCVE-2025-15525 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.
Product
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
Affected
up to 7.8.1
What to do
Affects up to 7.8.1. Update Ajax Load More – Infinite Scroll, Load More, & Lazy Load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2026NEX-Forms – Ultimate Forms: Unauthorized access of dataCVE-2025-15510 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter.
Product
NEX-Forms – Ultimate Forms
Affected
up to 9.1.8
What to do
Affects up to 9.1.8. Update NEX-Forms – Ultimate Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 28, 2026Frontend File Manager: Unauthorized file sharingCVE-2026-1280 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to share arbitrary uploaded files via email by supplying a file ID. Since file IDs are sequential integers, attackers can enumerate all uploaded files on the site and exfiltrate sensitive data that was intended to be restricted to administrators only.
Product
Frontend File Manager
Affected
up to 23.5
What to do
Affects up to 23.5. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Rupantorpay: Unauthorized modification of dataCVE-2025-15511 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to modify WooCommerce order statuses by sending crafted requests to the WooCommerce API endpoint.
Product
Rupantorpay
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Rupantorpay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 28, 2026RegistrationMagic: Missing AuthorizationCVE-2026-1054 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.
Product
RegistrationMagic
Affected
up to 6.0.7.4
What to do
Affects up to 6.0.7.4. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Simple calendar for Elementor: Missing AuthorizationCVE-2026-1310 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the `miga_ajax_editor_cal_delete` function that is hooked to the `miga_editor_cal_delete` AJAX action with both authenticated and unauthenticated access enabled. This makes it possible for unauthenticated attackers to delete arbitrary calendar entries by sending a request with a valid nonce and the calendar entry ID.
Product
Simple calendar for Elementor
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Simple calendar for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026New User Approve: Unauthorized access of data and modification of dataCVE-2026-0832 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to approve or deny user accounts, retrieve sensitive user information including emails and roles, and force logout of privileged users.
Product
New User Approve
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Authorization bypassCVE-2026-0825 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to download sensitive form submission data containing personally identifiable information (PII) by accessing the CSV export endpoint with an export key that is exposed in publicly accessible page source code. The vulnerability is created because while the shortcode properly filters displayed entries by user, the CSV export handler completely bypasses this filtering and exports all entries regardless of user permissions.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 28, 2026Easy Replace Image: Missing AuthorizationCVE-2026-1298 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2. This is due to missing capability checks on the `image_replacement_from_url` function that is hooked to the `eri_from_url` AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to replace arbitrary image attachments on the site with images from external URLs, potentially enabling site defacement, phishing attacks, or content manipulation.
Product
Easy Replace Image
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Easy Replace Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2026Link Invoice Payment for WooCommerce: Unauthorized modification of dataCVE-2025-14971 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration.
Product
Link Invoice Payment for WooCommerce
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Link Invoice Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026WP Go Maps (formerly WP Google Maps): Unauthorized modification of dataCVE-2026-0593 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processBackgroundAction() function in all versions up to, and including, 10.0.04. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global map engine settings.
Product
WP Go Maps (formerly WP Google Maps)
Affected
up to 10.0.04
What to do
Affects up to 10.0.04. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2026Meta-box GalleryMeta: Unauthorized modification of dataCVE-2026-0687 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mb_gallery' custom post type in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Author-level access and above, to create and publish galleries.
Product
Meta-box GalleryMeta
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Meta-box GalleryMeta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026All-in-One Video Gallery: Unauthorized modification of dataCVE-2025-15516 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_callback_store_user_meta() function in versions 4.1.0 to 4.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary string-based user meta keys for their own account.
Product
All-in-One Video Gallery
Affected
4.1.0 to 4.6.4
What to do
Affects 4.1.0 to 4.6.4. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2026AIKTP: Unauthorized modification of dataCVE-2026-1103 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The AIKTP plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the /aiktp/getToken REST API endpoint in all versions up to, and including, 5.0.04. The endpoint uses the 'verify_user_logged_in' as a permission callback, which only checks if a user is logged in, but fails to verify if the user has administrative capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to retrieve the administrator's 'aiktpz_token' access token, which can then be used to create posts, upload media library files, and access private content as the administrator.
Product
AIKTP
Affected
up to 5.0.04
What to do
Affects up to 5.0.04. Update AIKTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026ThemeRuby Multi Authors – Assign Multiple Writers to Posts: Stored Cross-Site ScriptingCVE-2026-1097 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' shortcode attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ThemeRuby Multi Authors – Assign Multiple Writers to Posts
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update ThemeRuby Multi Authors – Assign Multiple Writers to Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026GZSEO: Authorization bypass leading to Stored Cross-Site ScriptingCVE-2025-14941 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GZSEO plugin for WordPress is vulnerable to authorization bypass leading to Stored Cross-Site Scripting in all versions up to, and including, 2.0.11. This is due to missing capability checks on multiple AJAX handlers combined with insufficient input sanitization and output escaping on the embed_code parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary content into any post on the site that will execute whenever a user accesses an injected page.
Product
GZSEO
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update GZSEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026Alchemist Ajax Upload: Unauthorized media file deletionCVE-2025-14629 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'delete_file' function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments.
Product
Alchemist Ajax Upload
Affected
up to 1.1
What to do
Affects up to 1.1. Update Alchemist Ajax Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2026Wise Analytics: Missing AuthorizationCVE-2025-14609 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Wise Analytics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.9. This is due to missing capability checks on the REST API endpoint '/wise-analytics/v1/report'. This makes it possible for unauthenticated attackers to access sensitive analytics data including administrator usernames, login timestamps, visitor tracking information, and business intelligence data via the 'name' parameter granted they can send unauthenticated requests.
Product
Wise Analytics
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Wise Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026All-in-One Video Gallery: Unauthorized modification of dataCVE-2025-14947 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_callback_create_bunny_stream_video`, `ajax_callback_get_bunny_stream_video`, and `ajax_callback_delete_bunny_stream_video` functions in all versions up to, and including, 4.6.4. This makes it possible for unauthenticated attackers to create and delete videos on the Bunny Stream CDN associated with the victim's account, provided they can obtain a valid nonce which is exposed in public player templates.
Product
All-in-One Video Gallery
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update All-in-One Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026Sugar Calendar (Lite): Missing AuthorizationCVE-2026-24636 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.
Product
Sugar Calendar (Lite)
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update Sugar Calendar (Lite) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Ultimate Reviews: Authorization Bypass Through User-Controlled KeyCVE-2026-24634 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Reviews: from n/a through <= 3.2.16.
Product
Ultimate Reviews
Affected
up to 3.2.16
What to do
Affects up to 3.2.16. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Add Expires Headers & Optimized Minify: Missing AuthorizationCVE-2026-24633 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Expires Headers & Optimized Minify: from n/a through <= 3.2.0.
Product
Add Expires Headers & Optimized Minify
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Add Expires Headers & Optimized Minify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Rosebud: Authorization Bypass Through User-Controlled KeyCVE-2026-24631 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rosebud: from n/a through <= 1.4.
Product
Rosebud
Affected
up to 1.4
What to do
Affects up to 1.4. Update Rosebud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Trusona for: Missing AuthorizationCVE-2026-24627 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Trusona Trusona for WordPress trusona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusona for WordPress: from n/a through <= 2.0.0.
Product
Trusona for
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Trusona for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026File Uploads Addon for WooCommerce: Missing AuthorizationCVE-2026-24625 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through <= 1.7.3.
Product
File Uploads Addon for WooCommerce
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update File Uploads Addon for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Suggestion Toolkit: Missing AuthorizationCVE-2026-24622 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Sergiy Dzysyak Suggestion Toolkit suggestion-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Suggestion Toolkit: from n/a through <= 5.0.
Product
Suggestion Toolkit
Affected
up to 5.0
What to do
Affects up to 5.0. Update Suggestion Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026PopCash.Net Code Integration Tool: Missing AuthorizationCVE-2026-24619 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PopCash PopCash.Net Code Integration Tool popcashnet-code-integration-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PopCash.Net Code Integration Tool: from n/a through <= 1.8.
Product
PopCash.Net Code Integration Tool
Affected
up to 1.8
What to do
Affects up to 1.8. Update PopCash.Net Code Integration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026WP Popups: Missing AuthorizationCVE-2026-24616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Damian WP Popups wp-popups-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Popups: from n/a through <= 2.2.0.5.
Product
WP Popups
Affected
up to 2.2.0.5
What to do
Affects up to 2.2.0.5. Update WP Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Cream Magazine: Missing AuthorizationCVE-2026-24615 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Cream Magazine cream-magazine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Magazine: from n/a through <= 2.1.10.
Product
Cream Magazine
Affected
up to 2.1.10
What to do
Affects up to 2.1.10. Update Cream Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Ecwid Shopping Cart: Missing AuthorizationCVE-2026-24613 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.6.
Product
Ecwid Shopping Cart
Affected
up to 7.0.6
What to do
Affects up to 7.0.6. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Orchid Store: Missing AuthorizationCVE-2026-24612 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orchid Store: from n/a through <= 1.5.15.
Product
Orchid Store
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update Orchid Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Travel Monster: Missing AuthorizationCVE-2026-24607 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Monster: from n/a through <= 1.3.3.
Product
Travel Monster
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Travel Monster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Bayarcash WooCommerce: Missing AuthorizationCVE-2026-24606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.
Product
Bayarcash WooCommerce
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update Bayarcash WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026X Addons for Elementor: Missing AuthorizationCVE-2026-24605 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects X Addons for Elementor: from n/a through <= 1.0.23.
Product
X Addons for Elementor
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update X Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Simple GDPR Cookie Compliance: Missing AuthorizationCVE-2026-24604 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple GDPR Cookie Compliance: from n/a through <= 2.0.0.
Product
Simple GDPR Cookie Compliance
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Simple GDPR Cookie Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Universal Google Adsense and Ads manager: Missing AuthorizationCVE-2026-24603 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Universal Google Adsense and Ads manager universal-google-adsense-and-ads-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Google Adsense and Ads manager: from n/a through <= 1.1.8.
Product
Universal Google Adsense and Ads manager
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Universal Google Adsense and Ads manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026NextMove Lite: Authorization Bypass Through User-Controlled KeyCVE-2026-24599 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.
Product
NextMove Lite
Affected
up to 2.23.0
What to do
Affects up to 2.23.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Multilanguage by BestWebSoft: Missing AuthorizationCVE-2026-24598 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multilanguage by BestWebSoft: from n/a through <= 1.5.2.
Product
Multilanguage by BestWebSoft
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Multilanguage by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Zoho CRM Lead Magnet: Missing AuthorizationCVE-2026-24595 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.8.1.9.
Product
Zoho CRM Lead Magnet
Affected
up to 1.8.1.9
What to do
Affects up to 1.8.1.9. Update Zoho CRM Lead Magnet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026AWP Classifieds: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24593 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: from n/a through <= 4.4.3.
Product
AWP Classifieds
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Smart Product Viewer: Missing AuthorizationCVE-2026-24588 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in topdevs Smart Product Viewer smart-product-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Product Viewer: from n/a through <= 1.5.4.
Product
Smart Product Viewer
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Smart Product Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026AJAX Hits Counter + Popular Posts Widget: Missing AuthorizationCVE-2026-24587 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Hits Counter + Popular Posts Widget: from n/a through <= 0.10.210305.
Product
AJAX Hits Counter + Popular Posts Widget
Affected
up to 0.10.210305
What to do
Affects up to 0.10.210305. Update AJAX Hits Counter + Popular Posts Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Hyyan WooCommerce Polylang Integration: Missing AuthorizationCVE-2026-24585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Hyyan Abo Fakher Hyyan WooCommerce Polylang Integration woo-poly-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hyyan WooCommerce Polylang Integration: from n/a through <= 1.5.0.
Product
Hyyan WooCommerce Polylang Integration
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Hyyan WooCommerce Polylang Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026SumUp Payment Gateway For WooCommerce: Missing AuthorizationCVE-2026-24583 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SumUp Payment Gateway For WooCommerce: from n/a through <= 2.7.9.
Product
SumUp Payment Gateway For WooCommerce
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update SumUp Payment Gateway For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Points and Rewards for WooCommerce: Missing AuthorizationCVE-2026-24581 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Points and Rewards for WooCommerce: from n/a through <= 2.9.5.
Product
Points and Rewards for WooCommerce
Affected
up to 2.9.5
What to do
Affects up to 2.9.5. Update Points and Rewards for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Ecwid Shopping Cart: Missing AuthorizationCVE-2026-24580 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.5.
Product
Ecwid Shopping Cart
Affected
up to 7.0.5
What to do
Affects up to 7.0.5. Update Ecwid Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Ai Image Alt Text Generator for WP: Missing AuthorizationCVE-2026-24579 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.9.
Product
Ai Image Alt Text Generator for WP
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Ai Image Alt Text Generator for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Admin login URL Change: Missing AuthorizationCVE-2026-24578 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin login URL Change: from n/a through <= 1.1.5.
Product
Admin login URL Change
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Admin login URL Change to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Pie Register: Missing AuthorizationCVE-2026-24577 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pie Register: from n/a through <= 3.8.4.8.
Product
Pie Register
Affected
up to 3.8.4.8
What to do
Affects up to 3.8.4.8. Update Pie Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026BOX NOW Delivery: Missing AuthorizationCVE-2026-24571 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in boxnow BOX NOW Delivery box-now-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BOX NOW Delivery: from n/a through <= 3.0.2.
Product
BOX NOW Delivery
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update BOX NOW Delivery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.