Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,555 results · page 41 of 112
Jun 19, 2026WP Hotel Booking: Does not enforce capability checks in several of its AJAX handlersCVE-2026-9822 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
- Product
- WP Hotel Booking
- Fixed in
- 2.3.1
- What to do
- Update WP Hotel Booking to 2.3.1 or newer.
Jun 18, 2026MagicForm: Does not properly validate the type of files uploaded through an unauthenticated AJAX actionCVE-2026-9815 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MagicForm WordPress plugin through 0.1.3 does not properly validate the type of files uploaded through an unauthenticated AJAX action when a form's per-field extension allowlist is left empty, allowing unauthenticated attackers to upload PHP files and execute arbitrary code on the server.
- Product
- MagicForm
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update MagicForm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Taskbuilder: Does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodesCVE-2026-9570 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.
- Product
- Taskbuilder
- Fixed in
- 5.0.8
- What to do
- Update Taskbuilder to 5.0.8 or newer.
Jun 17, 2026LearnPress: Does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capabilityCVE-2026-8383 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request
- Product
- LearnPress
- Fixed in
- 4.3.7
- What to do
- Update LearnPress to 4.3.7 or newer.
Jun 17, 2026weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce: Does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected CVE-2026-8089 · WordPress plugins & themes · reported by WPScanHigh 7.1
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.
- Product
- weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce
- Fixed in
- 2.1.3
- What to do
- Update weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce to 2.1.3 or newer.
Jun 17, 2026WP Magnific Popup: Does not properly escape user-controlled link URLs before injecting them into the DOMCVE-2026-7850 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.
- Product
- WP Magnific Popup
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Magnific Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Form Builder CP: Does not properly sanitize a form configuration value before storing it and using itCVE-2026-9278 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Builder CP WordPress plugin before 1.2.47 does not properly sanitize a form configuration value before storing it and using it as part of a client-side script execution, allowing authenticated users with Editor-level access and above to perform Stored Cross-Site Scripting attacks against any visitor of a page rendering the affected form, even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).
- Product
- Form Builder CP
- Fixed in
- 1.2.47
- What to do
- Update Form Builder CP to 1.2.47 or newer.
Jun 15, 2026WP Go Maps: Does not perform any approval-state filtering on its public single-marker REST endpointCVE-2026-8386 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
- Product
- WP Go Maps
- Fixed in
- 10.0.10
- What to do
- Update WP Go Maps to 10.0.10 or newer.
Jun 15, 2026WP Go Maps: Does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables routeCVE-2026-8385 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.
- Product
- WP Go Maps
- Fixed in
- 10.0.10
- What to do
- Update WP Go Maps to 10.0.10 or newer.
Jun 14, 2026Iptanus File Upload: Does not implement proper file handlingCVE-2025-15546 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users.
- Product
- Iptanus File Upload
- Fixed in
- 5.1.7
- What to do
- Update Iptanus File Upload to 5.1.7 or newer.
Jun 13, 2026Store Locator: Does not validate a parameter before using it in a file pathCVE-2026-9062 · WordPress plugins & themes · reported by WPScanLow 3.4
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
- Product
- Store Locator
- Fixed in
- 1.6.9
- What to do
- Update Store Locator to 1.6.9 or newer.
Jun 13, 2026Store Locator: Does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9061 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).
- Product
- Store Locator
- Fixed in
- 1.6.9
- What to do
- Update Store Locator to 1.6.9 or newer.
Jun 12, 2026Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2026-9269 · WordPress plugins & themes · reported by WPScanLow 3.5
The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 5.1.5
- What to do
- Update Secure Copy Content Protection and Content Locking to 5.1.5 or newer.
Jun 10, 2026Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template.CVE-2026-53742 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.
- Affected
- up to 9.0.4
- What to do
- Affects up to 9.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Jun 10, 2026Schema & Structured Data for WP & AMP: Does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media typeCVE-2026-9067 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.60
- What to do
- Update Schema & Structured Data for WP & AMP to 1.60 or newer.
Jun 10, 2026Store Locator: Does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9060 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).
- Product
- Store Locator
- Fixed in
- 1.6.6
- What to do
- Update Store Locator to 1.6.6 or newer.
Jun 10, 2026Anti-Spam by CleanTalk. Spam protection: Does not properly sanitize content within a custom shortcode used in its email-encoding featureCVE-2026-8071 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.
- Product
- Anti-Spam by CleanTalk. Spam protection
- Fixed in
- 6.79
- What to do
- Update Anti-Spam by CleanTalk. Spam protection to 6.79 or newer.
Jun 10, 2026Xstore: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2026-3326 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Xstore
- Fixed in
- 9.7.3
- What to do
- Update Xstore to 9.7.3 or newer.
Jun 9, 2026Custom Block Builder: Does not consistently check the unfiltered_html capability across all paths that write to its block template code fieldsCVE-2026-8981 · WordPress plugins & themes · reported by WPScanLow 3.5
The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.
- Product
- Custom Block Builder
- Fixed in
- 4.3.0
- What to do
- Update Custom Block Builder to 4.3.0 or newer.
Jun 9, 2026WPForms: Does not verify the authenticity of incoming PayPal webhook events before processing themCVE-2026-4986 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.
- Product
- WPForms
- Fixed in
- 1.10.0.5
- What to do
- Update WPForms to 1.10.0.5 or newer.
Jun 2, 2026Really Simple Security: Does not enforce the second-factor challenge in two of its two-factor authentication REST endpointsCVE-2026-8293 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.
- Product
- Really Simple Security
- Fixed in
- 9.5.10.1
- What to do
- Update Really Simple Security to 9.5.10.1 or newer.
May 28, 2026Eupago Gateway For Woocommerce: Does not properly restrict access to its refund request handlerCVE-2026-7862 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated attackers to initiate refunds against any WooCommerce order using the merchant's payment gateway credentials, and for applicable payment methods, to redirect refunded funds to an attacker-controlled bank account.
- Product
- Eupago Gateway For Woocommerce
- Fixed in
- 4.7.2
- What to do
- Update Eupago Gateway For Woocommerce to 4.7.2 or newer.
May 27, 2026EventPress: Does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the responseCVE-2026-6268 · WordPress plugins & themes · reported by WPScanHigh 7.1
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
- Product
- EventPress
- Fixed in
- 22.2
- What to do
- Update EventPress to 22.2 or newer.
May 20, 2026Decent Comments: Does not restrict access to comment author email addresses and post author email addresses via its REST API endpointCVE-2026-7385 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.
- Product
- Decent Comments
- Fixed in
- 3.0.2
- What to do
- Update Decent Comments to 3.0.2 or newer.
May 20, 2026Email Encoder: Does not escape email addresses retrieved via user inputCVE-2026-5776 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
- Product
- Email Encoder
- Fixed in
- 2.4.7
- What to do
- Update Email Encoder to 2.4.7 or newer.
May 18, 2026Ajax Load More: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-6495 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ajax Load More
- Fixed in
- 7.8.4
- What to do
- Update Ajax Load More to 7.8.4 or newer.
May 18, 2026WP Maps: Does not properly sanitize a parameter before using it in a file pathCVE-2026-6381 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks.
- Product
- WP Maps
- Fixed in
- 4.9.3
- What to do
- Update WP Maps to 4.9.3 or newer.
May 18, 2026WP Photo Album Plus: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-6379 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- WP Photo Album Plus
- Fixed in
- 9.1.11.001
- What to do
- Update WP Photo Album Plus to 9.1.11.001 or newer.
May 11, 2026Custom css-js-php: Does not properly sanitize user input before using it in a SQL queryCVE-2026-6433 · WordPress plugins & themes · reported by WPScanHigh 7.3
The Custom css-js-php WordPress plugin through 2.0.7 does not properly sanitize user input before using it in a SQL query, and the result is passed to eval(), allowing unauthenticated users to execute arbitrary PHP code on the server.
- Product
- Custom css-js-php
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Custom css-js-php to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2026OttoKit: All-in-One Automation Platform: Does not properly sanitize user input before using it in a SQL statementCVE-2026-4935 · WordPress plugins & themes · reported by WPScanHigh 8.6
The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
- Product
- OttoKit: All-in-One Automation Platform
- Fixed in
- 1.1.23
- What to do
- Update OttoKit: All-in-One Automation Platform to 1.1.23 or newer.
Apr 28, 2026Check & Log Email: Does not properly handle email replacementCVE-2026-5306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled
- Product
- Check & Log Email
- Fixed in
- 2.0.13
- What to do
- Update Check & Log Email to 2.0.13 or newer.
Apr 23, 2026reCaptcha by WebDesignBy: Does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() functionCVE-2026-4512 · WordPress plugins & themes · reported by WPScanLow 3.5
The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page.
- Product
- reCaptcha by WebDesignBy
- Fixed in
- 2.0
- What to do
- Update reCaptcha by WebDesignBy to 2.0 or newer.
Apr 20, 2026Email Encoder: Does not sanitise and escape some of its settingsCVE-2024-7083 · WordPress plugins & themes · reported by WPScanLow 3.5
The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Encoder
- Fixed in
- 2.3.4
- What to do
- Update Email Encoder to 2.3.4 or newer.
Apr 13, 2026Product Filter for WooCommerce by WBW: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-3830 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- Product Filter for WooCommerce by WBW
- Fixed in
- 3.1.3
- What to do
- Update Product Filter for WooCommerce by WBW to 3.1.3 or newer.
Apr 13, 2026Form Maker by 10Web: Does not properly prepare SQL queriesCVE-2025-15441 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL Injection attacks possible in certain contexts.
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.38
- What to do
- Update Form Maker by 10Web to 1.15.38 or newer.
Apr 10, 2026YITH WooCommerce Wishlist: Does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operationsCVE-2026-4432 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
- Product
- YITH WooCommerce Wishlist
- Fixed in
- 4.13.0
- What to do
- Update YITH WooCommerce Wishlist to 4.13.0 or newer.
Apr 8, 2026ActivityPub: Does not properly filter posts to be displayedCVE-2026-4338 · WordPress plugins & themes · reported by WPScanHigh 7.5
The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts
- Product
- ActivityPub
- Fixed in
- 8.0.2
- What to do
- Update ActivityPub to 8.0.2 or newer.
Apr 7, 2026SQL Chart Builder: Does not properly escape user inputCVE-2026-4079 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.
- Product
- SQL Chart Builder
- Fixed in
- 2.3.8
- What to do
- Update SQL Chart Builder to 2.3.8 or newer.
Apr 7, 2026Popup Box: Does not properly validate nonces in the add_or_edit_popupbox() function before saving popup dataCVE-2025-15611 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers to perform Cross-Site Request Forgery attacks. When an authenticated admin visits a malicious page, the attacker can create or modify popups with arbitrary JavaScript that executes in the admin panel and frontend.
- Product
- Popup Box
- Fixed in
- 5.5.0
- What to do
- Update Popup Box to 5.5.0 or newer.
Mar 31, 2026Performance Monitor: Does not validate a parameter before making a request to itCVE-2026-3881 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks
- Product
- Performance Monitor
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Performance Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2026LeadConnector: Does not have authorization in a REST routeCVE-2026-1890 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
- Product
- LeadConnector
- Fixed in
- 3.0.22
- What to do
- Update LeadConnector to 3.0.22 or newer.
Mar 26, 2026WP Lightbox 2: Does not sanitise and escape some of its settingsCVE-2026-1430 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Lightbox 2
- Fixed in
- 3.0.7
- What to do
- Update WP Lightbox 2 to 3.0.7 or newer.
Mar 26, 2026Responsive Plus: Is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute the update_responsive_woo_free_shipping_left_shortcode AJAX action that does not properly valiCVE-2025-15488 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Responsive Plus WordPress plugin before 3.4.3 is vulnerable to arbitrary shortcode execution due to the software allowing unauthenticated users to execute the update_responsive_woo_free_shipping_left_shortcode AJAX action that does not properly validate the content_rech_data parameter before processing it as a shortcode.
- Product
- Responsive Plus
- Fixed in
- 3.4.3
- What to do
- Update Responsive Plus to 3.4.3 or newer.
Mar 23, 2026trx_addons: Does not correctly validate file types in one of its AJAX actionCVE-2026-1969 · WordPress plugins & themes · reported by WPScanMedium 5.3
The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448
- Product
- trx_addons
- Fixed in
- 2.38.5
- What to do
- Update trx_addons to 2.38.5 or newer.
Mar 12, 2026Reading progressbar: Does not sanitise and escape some of its settingsCVE-2026-2687 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Reading progressbar
- Fixed in
- 1.3.1
- What to do
- Update Reading progressbar to 1.3.1 or newer.
Mar 12, 2026Timetics: Does not have authorization in a REST endpointCVE-2025-15473 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.
- Product
- Timetics
- Fixed in
- 1.0.52
- What to do
- Update Timetics to 1.0.52 or newer.
Mar 11, 2026divi-booster: Does not have authorization and CSRF checks in one of its fixing functionCVE-2026-2626 · WordPress plugins & themes · reported by WPScanHigh 8.1
The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the use of unserialize() on the data, this could be further exploited when combined with a PHP gadget chain to achieve PHP Object Injection
- Product
- divi-booster
- Fixed in
- 5.0.2
- What to do
- Update divi-booster to 5.0.2 or newer.
Mar 11, 2026DukaPress: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-2466 · WordPress plugins & themes · reported by WPScanHigh 7.1
The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- DukaPress
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update DukaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2026Gutena Forms: Does not validate option to be updatedCVE-2026-1753 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).
- Product
- Gutena Forms
- Fixed in
- 1.6.1
- What to do
- Update Gutena Forms to 1.6.1 or newer.
Mar 10, 2026Court Reservation: Does not have CSRF check in placeCVE-2026-1508 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Court Reservation
- Fixed in
- 1.10.9
- What to do
- Update Court Reservation to 1.10.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.