Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

542new WordPress flaws this week

391,181entries in the database

1,488 results · page 4 of 30

Sep 11, 2026Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce"): Insecure Direct Object ReferenceCVE-2026-11496 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.
Product
Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce")
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Registration Form for WooCommerce: Does not validate that the form referenced during registration is a legitimate registration formCVE-2026-81431 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.
Product
Registration Form for WooCommerce
Fixed in
1.1.3
What to do
Update Registration Form for WooCommerce to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 9, 2026WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping: Time-based SQL InjectionCVE-2026-19778 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping
Affected
up to 2.23.7
What to do
Affects up to 2.23.7. Update WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 9, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Does not restrict the redirect target of its email preference confirmation flow to the site's own hostCVE-2026-81741 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.
Product
Groundhogg — CRM, Newsletters, and Marketing Automation
Fixed in
4.7.2
What to do
Update Groundhogg — CRM, Newsletters, and Marketing Automation to 4.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 8, 2026EDD Product Catalog Feed by PixelYourSite: Unauthorized modification of data that can lead to a denial of serviceCVE-2026-9331 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Product
EDD Product Catalog Feed by PixelYourSite
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update EDD Product Catalog Feed by PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pixelyoursite.com wordfence.com
Sep 8, 2026Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.CVE-2026-81802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 7, 2026Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Insecure Direct Object ReferenceCVE-2026-4945 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
Product
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2026B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More: Does not verify that a role selected during registration is one actually offered on the registration formCVE-2026-85038 · WordPress plugins & themes · reported by WPScanMedium 5.3
The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.
Product
B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More
Fixed in
5.2.40
What to do
Update B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More to 5.2.40 or newer.
Full record and what to do →NVD record wpscan.com
Sep 6, 2026SureCart: Does not ensure that the account affected by a customer update is the same account its permission check authorisedCVE-2026-18480 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.
Product
SureCart
Fixed in
4.6.3
What to do
Update SureCart to 4.6.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026MemberDash: Insecure Direct Object ReferenceCVE-2026-16310 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification sent to the victim.
Product
MemberDash
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update MemberDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record memberdashwp.com wordfence.com
Sep 5, 2026Greenshift: Does not validate a user-supplied URL before fetching it server-sideCVE-2026-83543 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.
Product
Greenshift
Fixed in
13.2.0
What to do
Update Greenshift to 13.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · WordPress plugins & themes · reported by WPScanLow 2.7
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
Product
JCH Optimize
Fixed in
5.0.1
What to do
Update JCH Optimize to 5.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 4, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadataCVE-2026-84066 · WordPress plugins & themes · reported by WPScanLow 3.1
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9 or newer.
Full record and what to do →NVD record wpscan.com
Sep 3, 2026Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.CVE-2026-84836 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.
Affected
up to 1.22.3
What to do
Affects up to 1.22.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 3, 2026Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.CVE-2026-84769 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
Affected
up to 6.4.26
What to do
Affects up to 6.4.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.CVE-2026-84771 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.CVE-2026-81288 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 2, 2026WC Vendors: Does not verify that the vendor submitting a front-end order shipment status change owns the referenced orderCVE-2026-81427 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.
Product
WC Vendors
Fixed in
2.7.2.1
What to do
Update WC Vendors to 2.7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Advanced Custom Fields: Extended: Does not restrict the role submitted through its front-end user forms to the roles the form actually offersCVE-2026-80467 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
Product
Advanced Custom Fields: Extended
Fixed in
0.9.2.7
What to do
Update Advanced Custom Fields: Extended to 0.9.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Rank Math SEO: Does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadataCVE-2026-77785 · WordPress plugins & themes · reported by WPScanLow 2.7
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts.
Product
Rank Math SEO
Fixed in
1.0.277
What to do
Update Rank Math SEO to 1.0.277 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026User Profile Builder: Does not properly restrict its front-end file upload featureCVE-2026-76548 · WordPress plugins & themes · reported by WPScanHigh 8.2
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.
Product
User Profile Builder
Fixed in
4.0.1
What to do
Update User Profile Builder to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 29, 2026SmartAIPress: Does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-sideCVE-2026-16600 · WordPress plugins & themes · reported by WPScanHigh 7.7
The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.
Product
SmartAIPress
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update SmartAIPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field.CVE-2026-39071 · WordPress plugins & themes · reported by MITREMedium 5.4
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.
Fixed in
5.0.9
What to do
Update the plugin to 5.0.9 or newer.
Full record and what to do →NVD record github.com github.com
Aug 28, 2026WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature.CVE-2026-39070 · WordPress plugins & themes · reported by MITREMedium 4.8
WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect user to malicious site or control the account.
Fixed in
1.7.2
What to do
Update the plugin to 1.7.2 or newer.
Full record and what to do →NVD record github.com github.com
Aug 28, 2026Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.CVE-2026-81299 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2026Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.CVE-2026-80433 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
Affected
up to 1.2.12
What to do
Affects up to 1.2.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 27, 2026Defender Security: Does not restrict a network-wide setting to network administratorsCVE-2026-19225 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Product
Defender Security
Fixed in
6.2.0
What to do
Update Defender Security to 6.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026WP Data Access: Insecure Direct Object ReferenceCVE-2026-3235 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_access' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from protected app containers by exploiting a mismatch between the authorization check (performed against app_id) and data retrieval (performed using cnt_id without verifying container ownership).
Product
WP Data Access
Affected
up to 5.5.68
What to do
Affects up to 5.5.68. Update WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not sanitize a user-supplied image reference before using itCVE-2026-77757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.3
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026AI Engine: Does not perform an authorisation check on one of its administration-only featuresCVE-2026-75798 · WordPress plugins & themes · reported by WPScanMedium 5.3
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.
Product
AI Engine
Fixed in
3.7.2
What to do
Update AI Engine to 3.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026WPCafe: Does not perform an authorization checkCVE-2026-14550 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator moderation workflow.
Product
WPCafe
Fixed in
3.0.18
What to do
Update WPCafe to 3.0.18 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026CM Map Locations – Visualize and share your locations in a few clicks: Limited Arbitrary File UploadCVE-2026-16601 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.
Product
CM Map Locations – Visualize and share your locations in a few clicks
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update CM Map Locations – Visualize and share your locations in a few clicks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses: Insecure Direct Object ReferenceCVE-2026-10630 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.
Product
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Affected
up to 3.2.29
What to do
Affects up to 3.2.29. Update WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-78278 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66587 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 24, 2026Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.CVE-2026-66585 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 22, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Directory TraversalCVE-2026-18027 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
Product
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026The kk Star Ratings – Rate Post & Collect User Feedbacks: Arbitrary shortcode executionCVE-2026-3424 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The kk Star Ratings – Rate Post & Collect User Feedbacks
Affected
up to 5.4.10.3
What to do
Affects up to 5.4.10.3. Update The kk Star Ratings – Rate Post & Collect User Feedbacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 21, 2026WPeMatico RSS Feed Fetcher: Unauthorized modification of data that can lead to privilege escalationCVE-2026-19883 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
Product
WPeMatico RSS Feed Fetcher
Affected
up to 2.8.24
What to do
Affects up to 2.8.24. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Aug 20, 2026Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66586 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 20, 2026Depicter — Popup & Slider Builder: Does not validate the type of a file uploaded through its import feature and does not remove a malformed uploadCVE-2026-15049 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.
Product
Depicter — Popup & Slider Builder
Fixed in
4.8.0
What to do
Update Depicter — Popup & Slider Builder to 4.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026TabaPay Gateway: Does not validate the payment callback before establishing a session for the account associated with the referenced orderCVE-2026-18031 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
Product
TabaPay Gateway
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update TabaPay Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback: Arbitrary file deletionCVE-2026-19942 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.
Product
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 18, 2026Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.CVE-2026-74009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
Affected
up to 4.8.7
What to do
Affects up to 4.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Shortcodes and extra features for Phlox: Insertion of Sensitive Information Into Sent DataCVE-2026-74008 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.17.24
What to do
Affects up to 2.17.24. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.CVE-2026-73395 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
Affected
up to 3.2.36
What to do
Affects up to 3.2.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.CVE-2026-73383 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
Affected
up to 6.6.47
What to do
Affects up to 6.6.47. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.CVE-2026-66644 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.CVE-2026-66641 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
Affected
up to 4.6.8
What to do
Affects up to 4.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.CVE-2026-66637 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.