Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,137 results · page 38 of 203
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.CVE-2026-65539 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.CVE-2026-65538 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.CVE-2026-65536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.CVE-2026-65534 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.CVE-2026-65531 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Graphina – Charts and Graphs For Elementor: Missing AuthorizationCVE-2026-65529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina – Charts and Graphs For Elementor: from n/a through 3.1.12.
- Product
- Graphina – Charts and Graphs For Elementor
- Affected
- up to 3.1.12
- What to do
- Affects up to 3.1.12. Update Graphina – Charts and Graphs For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.CVE-2026-65525 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.CVE-2026-65521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.CVE-2026-65519 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
- Affected
- up to 2.7.7.29
- What to do
- Affects up to 2.7.7.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65516 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
- Affected
- up to 7.5.4
- What to do
- Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.CVE-2026-65506 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
- Affected
- up to 5.12
- What to do
- Affects up to 5.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.CVE-2026-65505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.CVE-2026-65501 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65500 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
- Affected
- up to 7.5.4
- What to do
- Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65499 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.CVE-2026-65498 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.
- Affected
- up to 7.5.0
- What to do
- Affects up to 7.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.CVE-2026-65496 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.
- Affected
- up to 7.5.0
- What to do
- Affects up to 7.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.CVE-2026-65495 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Create: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-65490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0.
- Product
- Create
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Create to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026LA-Studio Element Kit for Elementor: Missing AuthorizationCVE-2026-65489 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.CVE-2026-65487 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
- Affected
- up to 7.7.6
- What to do
- Affects up to 7.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.CVE-2026-65486 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.CVE-2026-65485 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.
- Affected
- up to 2.6.5
- What to do
- Affects up to 2.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.CVE-2026-65483 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.CVE-2026-65476 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.CVE-2026-65474 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
- Affected
- up to 5.2.10
- What to do
- Affects up to 5.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.CVE-2026-65472 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.CVE-2026-65471 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.
- Affected
- up to 5.15.6
- What to do
- Affects up to 5.15.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.CVE-2026-65469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
- Affected
- up to 4.4.7
- What to do
- Affects up to 4.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.CVE-2026-65468 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-65464 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
- Affected
- up to 4.16.3
- What to do
- Affects up to 4.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.CVE-2026-65460 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Chouby Polylang and Chouby Polylang Pro: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-65458 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5.
- Product
- Chouby Polylang and Chouby Polylang Pro
- Affected
- up to 3.8.5
- What to do
- Affects up to 3.8.5. Update Chouby Polylang and Chouby Polylang Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.CVE-2026-65453 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
- Affected
- up to 6.19
- What to do
- Affects up to 6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.CVE-2026-65452 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
- Affected
- up to 6.19
- What to do
- Affects up to 6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.CVE-2026-61981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
- Affected
- up to 15.0.8
- What to do
- Affects up to 15.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.CVE-2026-61972 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.CVE-2026-61954 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.
- Affected
- up to 3.8.9
- What to do
- Affects up to 3.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.CVE-2026-61951 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.CVE-2026-61950 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in Bookly <= 27.7 versions.CVE-2026-61949 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Bookly <= 27.7 versions.
- Affected
- up to 27.7
- What to do
- Affects up to 27.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-61948 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.CVE-2026-61947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.CVE-2026-61946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.
- Affected
- up to 3.12.27
- What to do
- Affects up to 3.12.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026WooCommerce Product Stock Alert: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-61945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.
- Product
- WooCommerce Product Stock Alert
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update WooCommerce Product Stock Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.CVE-2026-61944 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
- Affected
- up to 27.7
- What to do
- Affects up to 27.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-61943 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.CVE-2026-59555 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
- Affected
- up to 2.7.8.3
- What to do
- Affects up to 2.7.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.