Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

359 results · page 5 of 8

Aug 6, 2026SEO Redirection: Does not perform a capability check in one of its authenticated AJAX actionsCVE-2026-13703 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs.
Product
SEO Redirection
Fixed in
9.19
What to do
Update SEO Redirection to 9.19 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026DHL Shipping Germany for WooCommerce: Does not perform any authorization check (no capabilityCVE-2026-16981 · WordPress plugins & themes · reported by WPScanMedium 5.3
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored shipping label, each containing the customer's full name, complete postal address, and order reference.
Product
DHL Shipping Germany for WooCommerce
Fixed in
4.0.1
What to do
Update DHL Shipping Germany for WooCommerce to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026YayPricing: Does not perform capability checks on several of its REST API routesCVE-2026-15230 · WordPress plugins & themes · reported by WPScanHigh 8.1
The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes.
Product
YayPricing
Fixed in
3.5.7
What to do
Update YayPricing to 3.5.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard.CVE-2026-15941 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 4, 2026Clearfy Cache: Does not perform a capability check in one of its admin-page dispatch pathsCVE-2026-16295 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
Product
Clearfy Cache
Fixed in
2.4.3
What to do
Update Clearfy Cache to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Contest Gallery: Does not perform any capability or nonce check in one of its handlersCVE-2026-16056 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
Product
Contest Gallery
Fixed in
30.0.7
What to do
Update Contest Gallery to 30.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Classified Listing: Does not perform a capability check on an AJAX action that returns aggregated store revenue totalsCVE-2026-16276 · WordPress plugins & themes · reported by WPScanLow 2.7
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.
Product
Classified Listing
Fixed in
5.4.4
What to do
Update Classified Listing to 5.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Classified Listing: Does not perform a capability or ownership check on an AJAX action that returns a post's contentCVE-2026-16274 · WordPress plugins & themes · reported by WPScanLow 2.7
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.
Product
Classified Listing
Fixed in
5.4.4
What to do
Update Classified Listing to 5.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Contest Gallery: Does not perform per-object capability or nonce checks in one of its post-deletion handlersCVE-2026-16057 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
Product
Contest Gallery
Fixed in
30.0.7
What to do
Update Contest Gallery to 30.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026GEO my WP: Does not perform any ownership or capability check on two of its logged-in AJAX actionsCVE-2026-15260 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation records by supplying arbitrary record IDs.
Product
GEO my WP
Fixed in
4.5.5.3
What to do
Update GEO my WP to 4.5.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Simply Schedule Appointments: Does not perform a capability check on an administrative appointment-listing shortcodeCVE-2026-15254 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
Product
Simply Schedule Appointments
Fixed in
1.6.12.11
What to do
Update Simply Schedule Appointments to 1.6.12.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026POUCO Import Users: Does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accountsCVE-2026-16256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
Product
POUCO Import Users
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update POUCO Import Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026LWS Optimize: Does not perform a capability check on its cache-clearing actionsCVE-2026-16042 · WordPress plugins & themes · reported by WPScanMedium 4.3
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds.
Product
LWS Optimize
Fixed in
3.4
What to do
Update LWS Optimize to 3.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026RT Mega Menu: Does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin pageCVE-2026-15385 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.
Product
RT Mega Menu
Fixed in
1.5.2
What to do
Update RT Mega Menu to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Five Star Restaurant Reservations: Does not perform a capability check on one of its AJAX actionsCVE-2026-15151 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
Product
Five Star Restaurant Reservations
Fixed in
2.7.23
What to do
Update Five Star Restaurant Reservations to 2.7.23 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026Clever Mega Menu for Visual Composer: Does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadataCVE-2026-11872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
Product
Clever Mega Menu for Visual Composer
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Clever Mega Menu for Visual Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Dynamic Pricing With Discount Rules for WooCommerce: Does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the responseCVE-2026-13725 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
Product
Dynamic Pricing With Discount Rules for WooCommerce
Fixed in
5.0.0
What to do
Update Dynamic Pricing With Discount Rules for WooCommerce to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Buckaroo Woocommerce Payments: Does not perform any capability check or nonce validation on an AJAX action that processes payment capture refundsCVE-2026-13329 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.
Product
Buckaroo Woocommerce Payments
Fixed in
4.9.0
What to do
Update Buckaroo Woocommerce Payments to 4.9.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026JS Help Desk: Grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handlerCVE-2026-14931 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
Product
JS Help Desk
Fixed in
3.1.4
What to do
Update JS Help Desk to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Paid Membership Subscriptions: Does not perform capability or nonce checks on one of its payment-related AJAX actionsCVE-2026-14847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.
Product
Paid Membership Subscriptions
Fixed in
3.0.7
What to do
Update Paid Membership Subscriptions to 3.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Mailgun for: Does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing listsCVE-2026-14834 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored API credentials.
Product
Mailgun for
Fixed in
2.2.1
What to do
Update Mailgun for to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026ElementsKit Elementor Addons: Does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPCVE-2026-13392 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.
Product
ElementsKit Elementor Addons
Fixed in
3.10.01
What to do
Update ElementsKit Elementor Addons to 3.10.01 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Ultimate Member: Does not filter administrator-level capabilities from the roles it makes selectable on its registration formsCVE-2026-12251 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
Product
Ultimate Member
Fixed in
2.12.1
What to do
Update Ultimate Member to 2.12.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Ultimate Addons for WPBakery Page Builder: Does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packsCVE-2026-15382 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request.
Product
Ultimate Addons for WPBakery Page Builder
Fixed in
3.21.4
What to do
Update Ultimate Addons for WPBakery Page Builder to 3.21.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Search Atlas SEO: Does not perform a capability or nonce check in one of its AJAX handlersCVE-2026-15252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and consuming its indexing quota.
Product
Search Atlas SEO
Fixed in
2.6.12
What to do
Update Search Atlas SEO to 2.6.12 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026MotoPress Hotel Booking: Does not perform a capability check before returning a booking's full customer details in one of its AJAX actionsCVE-2026-15235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.
Product
MotoPress Hotel Booking
Fixed in
6.0.4
What to do
Update MotoPress Hotel Booking to 6.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Sync Post With Other Site: Does not correctly enforce the page-editing capability on a REST route that creates and updates postsCVE-2026-14923 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability (such as a Contributor) can create, publish, and overwrite arbitrary Pages, including modifying content authored by higher-privileged users.
Product
Sync Post With Other Site
Fixed in
1.9.3
What to do
Update Sync Post With Other Site to 1.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026WP Real IP-based Access Control: Does not perform any capability or nonce checks before storing one of its option valuesCVE-2026-14592 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.
Product
WP Real IP-based Access Control
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update WP Real IP-based Access Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026LifterLMS: Does not perform a capability check in one of its select2 query AJAX handlersCVE-2026-14231 · WordPress plugins & themes · reported by WPScanMedium 4.3
The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.
Product
LifterLMS
Fixed in
10.0.10
What to do
Update LifterLMS to 10.0.10 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Easy Appointments: Does not require a sufficient capability on one of its appointment-listing REST endpointsCVE-2026-14226 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.
Product
Easy Appointments
Fixed in
3.12.28
What to do
Update Easy Appointments to 3.12.28 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Easy Appointments: Does not verify ownership or capabilityCVE-2026-14223 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.
Product
Easy Appointments
Fixed in
3.12.28
What to do
Update Easy Appointments to 3.12.28 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Easy Appointments: Does not perform any capability or nonce check in one of its connection-deletion actionsCVE-2026-14222 · WordPress plugins & themes · reported by WPScanLow 3.8
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.
Product
Easy Appointments
Fixed in
3.12.28
What to do
Update Easy Appointments to 3.12.28 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Easy Appointments: Does not perform capability checks in several of its appointment-management actionsCVE-2026-14221 · WordPress plugins & themes · reported by WPScanLow 3.8
The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.
Product
Easy Appointments
Affected
up to 4.0
What to do
Affects up to 4.0. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Easy Appointments: Does not perform a per-request capability or nonce check on one of its customer-listing handlersCVE-2026-14188 · WordPress plugins & themes · reported by WPScanLow 2.7
The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.
Product
Easy Appointments
Fixed in
3.12.28
What to do
Update Easy Appointments to 3.12.28 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026WP Travel Engine: Does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6CVE-2026-12500 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).
Product
WP Travel Engine
Fixed in
6.8.2
What to do
Update WP Travel Engine to 6.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Frontend Admin by DynamiApps: Does not perform capability checks on its taxonomy term creationCVE-2026-11867 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.
Product
Frontend Admin by DynamiApps
Fixed in
3.29.7
What to do
Update Frontend Admin by DynamiApps to 3.29.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026WOLF: Does not perform a nonce or capability check on one of its AJAX actionsCVE-2026-14234 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.
Product
WOLF
Fixed in
1.1.0
What to do
Update WOLF to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026Quiz and Survey Master (QSM): Does not perform a capability check before deleting output templatesCVE-2026-14821 · WordPress plugins & themes · reported by WPScanLow 2.7
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.
Product
Quiz and Survey Master (QSM)
Fixed in
11.1.5
What to do
Update Quiz and Survey Master (QSM) to 11.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Custom Fields Account Registration For Woocommerce: Does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefixCVE-2026-13152 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.
Product
Custom Fields Account Registration For Woocommerce
Fixed in
1.4
What to do
Update Custom Fields Account Registration For Woocommerce to 1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not perform a capability check on its license management actionsCVE-2026-12690 · WordPress plugins & themes · reported by WPScanLow 3.8
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026WPBot: Does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlersCVE-2026-14185 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.
Product
WPBot
Fixed in
8.2.0
What to do
Update WPBot to 8.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026ThumbPress: Does not perform a capability check on one of its AJAX actionsCVE-2026-13432 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality.
Product
ThumbPress
Fixed in
6.2.2
What to do
Update ThumbPress to 6.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026MailerSend: Does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce)CVE-2026-13156 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.
Product
MailerSend
Fixed in
1.0.8
What to do
Update MailerSend to 1.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026WP Travel: Does not perform capability or ownership checks on its booking cancellation actionCVE-2026-11868 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Product
WP Travel
Fixed in
11.7.1
What to do
Update WP Travel to 11.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026User Registration & Membership: Does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifierCVE-2026-11966 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.
Product
User Registration & Membership
Fixed in
5.2.3
What to do
Update User Registration & Membership to 5.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026RTMKit: Does not perform a proper capability check on one of its -builder AJAX actionsCVE-2026-12907 · WordPress plugins & themes · reported by WPScanLow 2.7
The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Author role to create and activate a site-wide template that overrides the header, footer or other global areas displayed to all visitors, which is normally restricted to administrators.
Product
RTMKit
Fixed in
2.0.9
What to do
Update RTMKit to 2.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026RTMKit: Does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directlyCVE-2026-12906 · WordPress plugins & themes · reported by WPScanLow 2.7
The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users' private, draft, pending, scheduled and trashed posts.
Product
RTMKit
Fixed in
2.0.9
What to do
Update RTMKit to 2.0.9 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026Header Footer Builder for Elementor: Does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user)CVE-2026-12869 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.
Product
Header Footer Builder for Elementor
Fixed in
1.2.1
What to do
Update Header Footer Builder for Elementor to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 15, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a per-object capability check in its post-duplication AJAX actionCVE-2026-11580 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.17
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.17 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026WP Job Portal: Does not perform capability or ownership checks before allowing job moderation actionsCVE-2026-12396 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.
Product
WP Job Portal
Fixed in
2.5.5
What to do
Update WP Job Portal to 2.5.5 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.