Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

459new WordPress flaws this week

394,717entries in the database

19,374 results · page 50 of 388

Jul 27, 2026MainWP Child: Does not verify the requester's identity in its site-registration request handlerCVE-2026-12255 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Product
MainWP Child
Fixed in
6.1.2
What to do
Update MainWP Child to 6.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Advanced Ads: Does not sanitize and escape a shortcode parameter before outputting it in the pageCVE-2026-10082 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.
Product
Advanced Ads
Fixed in
2.0.23
What to do
Update Advanced Ads to 2.0.23 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Printcart Web to Print Product Designer for WooCommerce: Does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization checkCVE-2025-15662 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.
Product
Printcart Web to Print Product Designer for WooCommerce
Fixed in
2.5.3
What to do
Update Printcart Web to Print Product Designer for WooCommerce to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 25, 2026In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not providCVE-2026-64365 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev. The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jul 24, 2026WowOptin: Next-Gen Popup Maker: Does not have proper authorization on a REST endpointCVE-2026-14603 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database.
Product
WowOptin: Next-Gen Popup Maker
Fixed in
1.4.38
What to do
Update WowOptin: Next-Gen Popup Maker to 1.4.38 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026CAFEHAUS API: Does not have any authentication or authorisationCVE-2026-12981 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
Product
CAFEHAUS API
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update CAFEHAUS API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026Project Management, Bug and Issue Tracking: Does not sanitise and escape user supplied input before using it in a SQL queryCVE-2026-12877 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.
Product
Project Management, Bug and Issue Tracking
Fixed in
5.1.0
What to do
Update Project Management, Bug and Issue Tracking to 5.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not perform a capability check on its license management actionsCVE-2026-12690 · WordPress plugins & themes · reported by WPScanLow 3.8
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not perform any authorization or ownership check on some of its private-message thread actionsCVE-2026-12689 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not verify PayPal IPN notifications before granting paid group membershipCVE-2026-12688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not consistently enforce the role restriction configured on its front-end registration role-selection fieldCVE-2026-12497 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to accepting any non-administrator role. Combined with the absence of a nonce on the public registration handler, this allows an unauthenticated visitor to register an account with a higher role, such as Editor or Author, than the form was configured to offer.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.16.18
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.16.18 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.CVE-2026-15616 · Other software · Logto · reported by cret@cert.orgCritical 9.1
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.
Product
Logto
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 23, 2026DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundariCVE-2026-65899 · Other software · cure53 · reported by VulnCheckMedium 5.1
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.
Product
DOMPurify
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 23, 2026Post Status Notifier Lite: Does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`adminCVE-2026-9577 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.
Product
Post Status Notifier Lite
Fixed in
1.13.0
What to do
Update Post Status Notifier Lite to 1.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026WP Compress: Does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the pageCVE-2026-9066 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
Product
WP Compress
Fixed in
7.10.04
What to do
Update WP Compress to 7.10.04 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026security-ninja-premium: Does not verify the second authentication factor in one of its two-factor authentication code pathsCVE-2026-14291 · WordPress plugins & themes · reported by WPScanHigh 7.5
The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.
Product
security-ninja-premium
Fixed in
5.290
What to do
Update security-ninja-premium to 5.290 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Praison AI SEO: Does not perform authorization checks on several of its REST API routesCVE-2026-12082 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.
Product
Praison AI SEO
Fixed in
5.0.7
What to do
Update Praison AI SEO to 5.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 22, 2026Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.CVE-2026-65650 · Other software · Elgg · reported by MITREMedium 4.3
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.
Product
Elgg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 22, 2026Open Mercato does not validate regex rules.CVE-2026-16270 · Other software · Open Mercato · reported by cvd@cert.plMedium 6.9
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4.
Product
Open Mercato
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl github.com
Jul 22, 2026n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the auCVE-2026-65594 · Other software · n8n-io · reported by VulnCheckMedium 5.1
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner's connected integrations), breaking user and project isolation.
Product
n8n
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 22, 2026n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was appCVE-2026-65590 · Other software · n8n-io · reported by VulnCheckMedium 5.5
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected.
Product
n8n
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 22, 2026Timetics: Does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gatewaysCVE-2026-14322 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.
Product
Timetics
Fixed in
1.0.57
What to do
Update Timetics to 1.0.57 or newer.
Full record and what to do →NVD record wpscan.com
Jul 22, 2026Events Manager: Does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is storedCVE-2026-12987 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query that is built without parameterisation, so an unauthenticated attacker can read arbitrary database data (e.g. user password hashes, secret keys) when the booking is later loaded.
Product
Events Manager
Fixed in
7.3.7
What to do
Update Events Manager to 7.3.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 22, 2026Product Addons and Product Options With Custom Fields: Does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inlineCVE-2026-12968 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
Product
Product Addons and Product Options With Custom Fields
Fixed in
1.6.15
What to do
Update Product Addons and Product Options With Custom Fields to 1.6.15 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution.CVE-2026-64881 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comHigh 8.7
The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.
Product
Security Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com
Jul 21, 2026In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.CVE-2026-16243 · Other software · Eclipse Foundation · reported by emo@eclipse.orgMedium 5.7
In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.
Product
Eclipse OMR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 21, 2026bpost-shipping-platform: Does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submissionCVE-2026-8082 · WordPress plugins & themes · reported by WPScanHigh 7.5
The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.
Product
bpost-shipping-platform
Fixed in
3.2.3
What to do
Update bpost-shipping-platform to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026WPBot: Does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlersCVE-2026-14185 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.
Product
WPBot
Fixed in
8.2.0
What to do
Update WPBot to 8.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026Academy LMS: Does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlersCVE-2026-14184 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
Product
Academy LMS
Fixed in
3.8.1
What to do
Update Academy LMS to 3.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026Classified Listing: Does not verify that the order targeted by its payment-receipt handler belongs to the requesting userCVE-2026-14183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.
Product
Classified Listing
Fixed in
5.3.9
What to do
Update Classified Listing to 5.3.9 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026Bit Form: Does not properly validate its workflow-trigger token once the associated transient has expiredCVE-2026-13694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Product
Bit Form
Fixed in
3.1.0
What to do
Update Bit Form to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026Bit Form: Does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification emailCVE-2026-13693 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
Product
Bit Form
Fixed in
3.1.0
What to do
Update Bit Form to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026Free Builder for Elementor: Does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboardCVE-2026-11767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.
Product
Free Builder for Elementor
Fixed in
1.6.7
What to do
Update Free Builder for Elementor to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root.CVE-2026-15788 · Other software · moby · reported by security@docker.comMedium 5.6
BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.
Product
BuildKit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Jul 20, 2026Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access controCVE-2026-62414 · Websites & servers · reported by security@joomla.orgCritical 9.1
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record joomlack.fr
Jul 20, 2026Windu CMS does not validate types of uploaded files.CVE-2026-57311 · Other software · JCD · reported by cvd@cert.plMedium 5.3
Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also affect other versions.
Product
Windu CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl windu.org
Jul 20, 2026Tag Groups is the Advanced Way to Display Your Taxonomy Terms: Does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content typeCVE-2026-9833 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
Product
Tag Groups is the Advanced Way to Display Your Taxonomy Terms
Fixed in
2.2.0
What to do
Update Tag Groups is the Advanced Way to Display Your Taxonomy Terms to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Elementor Website Builder: Does not properly check user permissions before returning post data through one of its REST endpointsCVE-2026-8825 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
Product
Elementor Website Builder
Fixed in
4.1.4
What to do
Update Elementor Website Builder to 4.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026ThumbPress: Does not perform a capability check on one of its AJAX actionsCVE-2026-13432 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality.
Product
ThumbPress
Fixed in
6.2.2
What to do
Update ThumbPress to 6.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026MailerSend: Does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce)CVE-2026-13156 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.
Product
MailerSend
Fixed in
1.0.8
What to do
Update MailerSend to 1.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Kirki: Does not validate a user-supplied URL before requesting it server-sideCVE-2026-13147 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Product
Kirki
Fixed in
6.0.12
What to do
Update Kirki to 6.0.12 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Social Login, Passkeys, Magic Link & Email OTP: Does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verificationCVE-2026-13142 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Product
Social Login, Passkeys, Magic Link & Email OTP
Fixed in
1.4.1
What to do
Update Social Login, Passkeys, Magic Link & Email OTP to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026PayPlus Payment Gateway: Does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated usersCVE-2026-12973 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.
Product
PayPlus Payment Gateway
Fixed in
8.2.2
What to do
Update PayPlus Payment Gateway to 8.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026PayPlus Payment Gateway: Does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated usersCVE-2026-12972 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.
Product
PayPlus Payment Gateway
Fixed in
8.2.2
What to do
Update PayPlus Payment Gateway to 8.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026LearnPress: Does not escape a search parameter before reflecting it into an HTML attributeCVE-2026-12970 · WordPress plugins & themes · reported by WPScanHigh 7.1
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
Product
LearnPress
Fixed in
4.4.1
What to do
Update LearnPress to 4.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026All-in-One WP Migration and Backup: Does not properly sanitise a user-supplied value before using it to build a file pathCVE-2026-12898 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Product
All-in-One WP Migration and Backup
Fixed in
7.106
What to do
Update All-in-One WP Migration and Backup to 7.106 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Kirki: Does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sendsCVE-2026-12724 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
Product
Kirki
Fixed in
6.0.12
What to do
Update Kirki to 6.0.12 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Kirki: Does not perform any authorisation check on one of its REST routesCVE-2026-12723 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
Product
Kirki
Fixed in
6.0.12
What to do
Update Kirki to 6.0.12 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026SlimStat Analytics: Does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reportsCVE-2026-12592 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.
Product
SlimStat Analytics
Fixed in
5.5.0
What to do
Update SlimStat Analytics to 5.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026WP Travel: Does not perform capability or ownership checks on its booking cancellation actionCVE-2026-11868 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Product
WP Travel
Fixed in
11.7.1
What to do
Update WP Travel to 11.7.1 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.