Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,614 results · page 39 of 93
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.CVE-2026-39463 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.
- Affected
- up to 4.9.31
- What to do
- Affects up to 4.9.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.CVE-2026-39451 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
- Affected
- up to 18.0
- What to do
- Affects up to 18.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.CVE-2026-39450 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.CVE-2026-39449 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.CVE-2026-39447 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.
- Affected
- up to 1.6.10.6
- What to do
- Affects up to 1.6.10.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.CVE-2026-39441 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.CVE-2026-39435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.
- Affected
- up to 15.1.3
- What to do
- Affects up to 15.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.CVE-2026-34902 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.CVE-2026-34901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.CVE-2026-34900 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.
- Affected
- up to 4.14.2
- What to do
- Affects up to 4.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.CVE-2026-34898 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.CVE-2026-34891 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.CVE-2026-34886 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.CVE-2026-27333 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.
- Affected
- up to 7.3.23
- What to do
- Affects up to 7.3.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.CVE-2026-27089 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.CVE-2026-27053 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.CVE-2026-25440 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.CVE-2026-25425 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.CVE-2026-23970 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions.CVE-2025-68872 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions.
- Affected
- up to 1.3.03.27
- What to do
- Affects up to 1.3.03.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.CVE-2025-68851 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.CVE-2025-68840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Faust.Js: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-49062 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7.
- Product
- Faust.Js
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update Faust.Js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injeCVE-2019-25746 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordslicedinvoices.comwordpress.org
Jun 15, 2026WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup filesCVE-2018-25437 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordcherryframework.comexploit-db.com
Jun 15, 2026WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbCVE-2018-25436 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar setCVE-2016-20084 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the actioCVE-2016-20082 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 15, 2026WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipuCVE-2016-20081 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfr.wordpress.orgexploit-db.com
Jun 15, 2026WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by maCVE-2016-20079 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.
- Affected
- up to 2.28.3
- What to do
- Affects up to 2.28.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating CVE-2016-20078 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like wp-config.php containing database credentials and configuration data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting inCVE-2016-20077 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfr.wordpress.orgexploit-db.com
Jun 15, 2026WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by CVE-2016-20076 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 15, 2026WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or adCVE-2016-20075 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordetoilewebdesign.comexploit-db.com
Jun 15, 2026The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbCVE-2016-20071 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.
- Product
- 404 Redirection Manager
- What to do
- Update 404 Redirection Manager to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to mCVE-2016-20070 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com
Jun 15, 2026the shortcode function that fails to sanitize the calendar parameter before using it in database queries: WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injectionCVE-2016-20069 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.
- Product
- the shortcode function that fails to sanitize the calendar parameter before using it in database queries
- What to do
- Update the shortcode function that fails to sanitize the calendar parameter before using it in database queries to the newest version.
Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com
Jun 15, 2026WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbCVE-2016-20068 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com
Jun 15, 2026WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated usCVE-2016-20067 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 15, 2026WP MAPS PRO: Registers an unauthenticated AJAX action whichCVE-2026-8935 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
- Product
- WP MAPS PRO
- Fixed in
- 6.1.1
- What to do
- Update WP MAPS PRO to 6.1.1 or newer.
Jun 13, 2026Meow Gallery: Unauthorized modification of dataCVE-2026-1291 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the REST API endpoint /wp-json/meow-gallery/v1/save_shortcode in all versions up to, and including, 5.4.4 This makes it possible for authenticated attackers, with Author-level access and above, to arbitrarily create or overwrite existing gallery shortcode records by supplying a user-controlled id value. The endpoint performs database update operations without verifying that the requesting user is authorized to modify the referenced gallery record or create their own.
- Product
- Meow Gallery
- Affected
- up to 5.4.4
- What to do
- Affects up to 5.4.4. Update Meow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 13, 2026Store Locator: Does not validate a parameter before using it in a file pathCVE-2026-9062 · WordPress plugins & themes · reported by WPScanLow 3.4
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
- Product
- Store Locator
- Fixed in
- 1.6.9
- What to do
- Update Store Locator to 1.6.9 or newer.
Jun 13, 2026Store Locator: Does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9061 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).
- Product
- Store Locator
- Fixed in
- 1.6.9
- What to do
- Update Store Locator to 1.6.9 or newer.
Jun 11, 2026UpdraftPlus: WP Backup & Migration: Authentication BypassCVE-2026-10795 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
- Product
- UpdraftPlus: WP Backup & Migration
- Affected
- up to 1.26.4
- What to do
- Affects up to 1.26.4. Update UpdraftPlus: WP Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Jun 10, 2026Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice.CVE-2026-53740 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Jun 10, 2026the duplicate_post_dismiss_notice handler, which verifies no nonce or capability: Yoast Duplicate Post through 4.6 contains a cross-site request forgeryCVE-2026-53739 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.
- Product
- the duplicate_post_dismiss_notice handler, which verifies no nonce or capability
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update the duplicate_post_dismiss_notice handler, which verifies no nonce or capability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Jun 10, 2026the duplicate_post action handler that lacks nonce verification: Easy Twitter Feeds before 1.2.13 contains a cross-site request forgeryCVE-2026-53736 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type.
- Product
- the duplicate_post action handler that lacks nonce verification
- Fixed in
- 1.2.13
- What to do
- Update the duplicate_post action handler that lacks nonce verification to 1.2.13 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Jun 10, 2026Store Locator: Does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9060 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).
- Product
- Store Locator
- Fixed in
- 1.6.6
- What to do
- Update Store Locator to 1.6.6 or newer.
Jun 10, 2026Xstore: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2026-3326 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Xstore
- Fixed in
- 9.7.3
- What to do
- Update Xstore to 9.7.3 or newer.
Jun 9, 2026WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP codeCVE-2017-20251 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.
- Fixed in
- 3.3.1
- What to do
- Update the plugin to 3.3.1 or newer.
Full record and what to do →NVD recordfr.wordpress.orgexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.