Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,597 results · page 6 of 32
Jun 17, 2026Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions.CVE-2026-25446 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions.
- Affected
- up to 3.29.0
- What to do
- Affects up to 3.29.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.CVE-2026-22334 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.CVE-2026-22327 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.CVE-2025-69139 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.CVE-2025-69131 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.CVE-2025-69129 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.CVE-2025-69103 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions.CVE-2025-60223 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions.
- Affected
- up to 13.6.5
- What to do
- Affects up to 13.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.CVE-2025-60218 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in PT Luxa Addons <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.CVE-2025-49403 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.CVE-2024-52488 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026WP Review Slider Pro: Arbitrary File DeletionCVE-2026-8442 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected prefix but fails to sanitize path traversal sequences in the remaining relative path before passing it to unlink(). This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WP Review Slider Pro
- Affected
- up to 12.6.8
- What to do
- Affects up to 12.6.8. Update WP Review Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpreviewslider.comwordfence.com
Jun 16, 2026Abandoned Contact Form 7: Unauthorized arbitrary post deletionCVE-2026-9187 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, which is registered to both the wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks. The handler takes a user-supplied recover_id parameter from $_POST and passes it directly to wp_delete_post() with the force-delete flag set to true, without verifying that the ID belongs to the plugin's own cf7af_data post type. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, or other content on the affected site by sending a single admin-ajax.
- Product
- Abandoned Contact Form 7
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Abandoned Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.CVE-2026-49766 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.
- Affected
- up to 2.9.16
- What to do
- Affects up to 2.9.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.CVE-2026-49061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.CVE-2026-40779 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.
- Affected
- up to 7.8.8
- What to do
- Affects up to 7.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.CVE-2026-40772 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field <= 1.0.6 versions.CVE-2026-40769 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field <= 1.0.6 versions.
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.CVE-2026-40727 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.CVE-2026-39591 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.CVE-2026-39527 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.CVE-2026-39489 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.CVE-2026-39468 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.
- Affected
- up to 5.11.1
- What to do
- Affects up to 5.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbCVE-2018-25436 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the actioCVE-2016-20082 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 15, 2026WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipuCVE-2016-20081 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfr.wordpress.orgexploit-db.com
Jun 15, 2026WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by maCVE-2016-20079 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.
- Affected
- up to 2.28.3
- What to do
- Affects up to 2.28.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating CVE-2016-20078 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like wp-config.php containing database credentials and configuration data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting inCVE-2016-20077 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfr.wordpress.orgexploit-db.com
Jun 15, 2026WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by CVE-2016-20076 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 15, 2026WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or adCVE-2016-20075 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordetoilewebdesign.comexploit-db.com
Jun 15, 2026The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbCVE-2016-20071 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.
- Product
- 404 Redirection Manager
- What to do
- Update 404 Redirection Manager to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 15, 2026WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbCVE-2016-20068 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com
Jun 12, 2026LWS Optimize – All-in-One Speed Booster & Cache Tools: Arbitrary File ReadCVE-2026-12089 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function trusting <link rel="stylesheet" href="..."> values harvested from page HTML and converting same-site URLs to absolute filesystem paths before reading them with file_get_contents()/Minify\CSS::add(), without enforcing that the resolved path stay within ABSPATH or have a .css extension. This makes it possible for authenticated attackers, with Editor-level access and above, to read arbitrary files.
- Product
- LWS Optimize – All-in-One Speed Booster & Cache Tools
- Affected
- up to 3.3.19
- What to do
- Affects up to 3.3.19. Update LWS Optimize – All-in-One Speed Booster & Cache Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP codeCVE-2017-20251 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.
- Fixed in
- 3.3.1
- What to do
- Update the plugin to 3.3.1 or newer.
Full record and what to do →NVD recordfr.wordpress.orgexploit-db.com
Jun 9, 2026WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injectCVE-2017-20247 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can send GET requests with crafted SQL payloads in the aid parameter to extract sensitive database information including user credentials and table contents.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordapptha.comexploit-db.com
Jun 9, 2026Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by eCVE-2017-20244 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php endpoint with the 'send_mwp_form' action to extract sensitive database contents.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwow-company.comtad.group
Jun 9, 2026WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameteCVE-2016-20064 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordlenonleite.com.brwordpress.org
Jun 9, 2026Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious coCVE-2016-20063 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to extract sensitive database information including user credentials and site configuration data.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordlenonleite.com.brtarget
Jun 7, 2026WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting CVE-2024-58349 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 7, 2026WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files byCVE-2024-58348 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jun 7, 2026WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious filCVE-2023-54352 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Jun 7, 2026WordPress Plugin admin-word-count-column 2.2 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploitinCVE-2022-50953 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin admin-word-count-column 2.2 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting null byte injection in the path parameter. Attackers can send GET requests to download-csv.php with a crafted path parameter containing directory traversal sequences and null bytes to bypass file restrictions and read sensitive files like system configuration.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 6, 2026LearnPress – Backup & Migration Tool: Arbitrary File ReadCVE-2026-7565 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including, 4.1.4 via the 'import-user-file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- LearnPress – Backup & Migration Tool
- Affected
- up to 4.1.4
- What to do
- Affects up to 4.1.4. Update LearnPress – Backup & Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2026MDJM Event Management: Arbitrary File UploadCVE-2026-7537 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
- Product
- MDJM Event Management
- Affected
- up to 1.7.8.3
- What to do
- Affects up to 1.7.8.3. Update MDJM Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jun 5, 2026Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment DeletionCVE-2026-10038 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user's 'avatar' meta without validating that the attachment is owned by the user, combined with Charitable_Data_Processor::process_picture() returning the raw posted value when no file is uploaded, allowing the 'avatar' user meta to be poisoned with any attacker-chosen attachment ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments from the Media Library by performing a two-request chain (first poisoning the stored avatar meta value with a target attachment ID, then triggering deletion via a normal avatar upload).
- Product
- Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
- Affected
- up to 1.8.11.1
- What to do
- Affects up to 1.8.11.1. Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2026Migration, Backup, Staging – WPvivid Backup & Migration: Arbitrary directory deletionCVE-2025-12656 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
- Product
- Migration, Backup, Staging – WPvivid Backup & Migration
- Affected
- up to 0.9.128
- What to do
- Affects up to 0.9.128. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2026WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug): Arbitrary file uploadCVE-2026-5411 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.
- Product
- WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug)
- Affected
- up to 5.38
- What to do
- Affects up to 5.38. Update WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgetwpcaptcha.comwordfence.com
Jun 4, 2026WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manCVE-2019-25727 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordweb-dorado.comexploit-db.com
Jun 1, 2026WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code tCVE-2018-25434 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wpas_keys parameter. Attackers can send GET requests to autosuggest.php with crafted wpas_keys values to extract sensitive database information from WordPress posts and other tables.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.