Updated 39 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,818 results · page 6 of 37

Aug 28, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-18324 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.57.0.1
What to do
Affects up to 1.57.0.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 28, 2026Avada (Fusion) Builder: Stored Cross-Site ScriptingCVE-2026-16654 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's wp_kses_post filter does not neutralize the payload because the injected content resides entirely within a shortcode attribute string containing no HTML angle brackets, causing kses to pass it through unchanged at save time.
Product
Avada (Fusion) Builder
Affected
up to 3.15.6
What to do
Affects up to 3.15.6. Update Avada (Fusion) Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record avada.com wordfence.com
Aug 27, 2026Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce: Does not check the user's capabilities before allowing a stock-update operation through one of its REST endpointsCVE-2026-16569 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products.
Product
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
Affected
up to 0.4.62
What to do
Affects up to 0.4.62. Update Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 27, 2026Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce: Does not verify that the requesting user owns the customer profile being queried through one of its REST endpointsCVE-2026-16568 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.
Product
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce
Affected
up to 0.4.62
What to do
Affects up to 0.4.62. Update Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 26, 2026Greenshift – animation and page builder blocks: Stored Cross-Site ScriptingCVE-2026-5092 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customapi action handler in versions up to, and including, 12.8.9. This is due to insufficient sanitization of API responses before output via innerHTML. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Product
Greenshift – animation and page builder blocks
Affected
up to 12.8.9
What to do
Affects up to 12.8.9. Update Greenshift – animation and page builder blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Unrestricted File Type UploadCVE-2026-18080 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as `../helper.php`, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected `crm-attachments` directory and into `wp-content/uploads/`. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
Product
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
Affected
up to 1.17.8
What to do
Affects up to 1.17.8. Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 26, 2026Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More: Stored Cross-Site ScriptingCVE-2026-18331 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID — discoverable via the public WordPress REST API — an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.
Product
Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More
Affected
up to 6.33.1
What to do
Affects up to 6.33.1. Update Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2026Tutor LMS: Does not validate values used to build a database queryCVE-2026-19094 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.
Product
Tutor LMS
Fixed in
4.0.6
What to do
Update Tutor LMS to 4.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026WP Fastest Cache: Does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it cachesCVE-2026-74932 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.
Product
WP Fastest Cache
Fixed in
1.5.1
What to do
Update WP Fastest Cache to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 25, 2026ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Privilege EscalationCVE-2026-75971 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `<wp_option>` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting `users_can_register` to `1` and `default_role` to `administrator` — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators.
Product
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: DOM-Based Reflected Cross-Site ScriptingCVE-2026-18328 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.57.0
What to do
Affects up to 1.57.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-18323 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership validation and persist a crafted payload that, when rendered on the Submissions admin page, is auto-executed via the bundled Inputmask library's data-attribute callback binding.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.57.0.2
What to do
Affects up to 1.57.0.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2026MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor: Stored Cross-Site ScriptingCVE-2026-18100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf_form_id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace transformation of script tags into JavaScript template literal expressions provides an additional delivery path.
Product
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
Affected
up to 4.1.8
What to do
Affects up to 4.1.8. Update MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 25, 2026Gutenverse – WordPress Blocks, Page Builder & Site Editor: Stored Cross-Site ScriptingCVE-2026-19943 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious titleTag value survives wp_kses_post on save because it is stored inside a block-comment delimiter and the live HTML is only synthesized at render time by do_blocks(), meaning the payload also fires in administrator and editor sessions during post preview.
Product
Gutenverse – WordPress Blocks, Page Builder & Site Editor
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Gutenverse – WordPress Blocks, Page Builder & Site Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates: Stored Cross-Site ScriptingCVE-2026-75019 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives wp_kses_post on save because it contains no angle brackets — only a double-quote breakout of the cozyHoverEffect.boxShadow.color attribute value — allowing event-handler injection at the render stage.
Product
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
Affected
up to 2.2.16
What to do
Affects up to 2.2.16. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses: Insecure Direct Object ReferenceCVE-2026-10630 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.
Product
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Affected
up to 3.2.29
What to do
Affects up to 3.2.29. Update WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.CVE-2026-32477 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 23, 2026Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5.CVE-2026-77116 · WordPress plugins & themes · reported by WPScanMedium 4.3
Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL.
Affected
up to 0.8.5
What to do
Affects up to 0.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 23, 2026Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.CVE-2026-77115 · WordPress plugins & themes · reported by WPScanHigh 7.1
Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Aug 22, 2026WS Form LITE – Drag & Drop Contact Form Builder: PHP Object InjectionCVE-2026-4703 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
WS Form LITE – Drag & Drop Contact Form Builder
Affected
up to 1.10.80
What to do
Affects up to 1.10.80. Update WS Form LITE – Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026GreenShift – Animation and Page Builder Blocks: Unauthorized modification of dataCVE-2026-5093 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' function that only verifies the 'edit_posts' capability instead of requiring administrative privileges. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global WordPress theme color settings site-wide, leading to site defacement.
Product
GreenShift – Animation and Page Builder Blocks
Affected
up to 12.8.9
What to do
Affects up to 12.8.9. Update GreenShift – Animation and Page Builder Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026Themify Builder: Authorization bypassCVE-2026-75027 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the stored Themify Builder styling data (padding and margin properties) of arbitrary posts, including private and draft posts, by supplying an attacker-controlled post ID and JSON styling payload. The nonce required by the handler is automatically emitted to all frontend pages rendered by the builder via wp_localize_script, meaning any unauthenticated visitor can trivially retrieve a valid nonce from page source and satisfy the only access control in place.
Product
Themify Builder
Affected
up to 7.8.0
What to do
Affects up to 7.8.0. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 20, 2026Depicter — Popup & Slider Builder: Does not validate the type of a file uploaded through its import feature and does not remove a malformed uploadCVE-2026-15049 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.
Product
Depicter — Popup & Slider Builder
Fixed in
4.8.0
What to do
Update Depicter — Popup & Slider Builder to 4.8.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026W3 Total Cache: Does not properly validate the request path it uses to build cache file namesCVE-2026-18051 · WordPress plugins & themes · reported by WPScanCritical 10
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
Product
W3 Total Cache
Fixed in
2.10.5
What to do
Update W3 Total Cache to 2.10.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026Animation Addons for Elementor: Does not validate a user-supplied value before using it to build the host of a server-side HTTP requestCVE-2026-17565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.
Product
Animation Addons for Elementor
Fixed in
2.7.2
What to do
Update Animation Addons for Elementor to 2.7.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2026Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.CVE-2026-74006 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2026Contact Form, Survey, Quiz & Popup Form Builder – ARForms: PHP Object InjectionCVE-2024-13784 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Contact Form, Survey, Quiz & Popup Form Builder – ARForms
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update Contact Form, Survey, Quiz & Popup Form Builder – ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Aug 16, 2026Bold Page Builder: Stored Cross-Site ScriptingCVE-2026-2357 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bold Page Builder
Affected
up to 5.6.8
What to do
Affects up to 5.6.8. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 16, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Authorization bypassCVE-2026-18347 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read arbitrary user metadata and sensitive user record fields — including email address, assigned roles, registration date, and any user_meta values — belonging to any WordPress user including administrators, by supplying a target user ID with a user-type context to the frontend collection endpoint.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Directory TraversalCVE-2026-17604 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The intended strpos()-based guard against leaving the uploads directory is bypassed by crafting a URL that includes the uploads base path as a substring while embedding directory traversal sequences, such as /wp-content/uploads/../../wp-config.php.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Insecure Direct Object ReferenceCVE-2026-12998 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the 'draft' parameter and read other users' saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the 'Save and Continue' feature enabled.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.55.0.2
What to do
Affects up to 1.55.0.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Extra Product Options Builder for WooCommerce: Does not verify that the requester is entitled to a customer-uploaded file before serving itCVE-2026-19728 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 writes a deny-all rule into its upload directories, so the disclosure only crosses a boundary on web servers that honour it, such as Apache. Where it is ignored, as on a default nginx setup, the same files are already served at their direct URL and the endpoint exposes nothing further.
Product
Extra Product Options Builder for WooCommerce
Fixed in
1.2.176
What to do
Update Extra Product Options Builder for WooCommerce to 1.2.176 or newer.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026WPvivid — Backup, Migration & Staging: Does not sanitise a value taken from an unauthenticated request before using it to build a log file pathCVE-2026-19725 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.
Product
WPvivid — Backup, Migration & Staging
Fixed in
0.9.131
What to do
Update WPvivid — Backup, Migration & Staging to 0.9.131 or newer.
Full record and what to do →NVD record wpscan.com
Aug 16, 2026Kubio AI Page Builder: Authorization bypassCVE-2026-16779 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite front-page configuration options (show_on_front, page_on_front, and page_for_posts), rewrite primary navigation menu items, replace template parts, and overwrite the Kubio global-data post. Although a nonce check via check_ajax_referer() is present, the nonce is unconditionally emitted into window.kubioUtilsData for every user who can load the block editor, making it harvestable by any Contributor and therefore an ineffective authorization barrier.
Product
Kubio AI Page Builder
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2026Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI: Authorization bypassCVE-2026-13167 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with delegated form management access and above, to activate arbitrary already-installed WordPress plugins — including previously deactivated or vulnerable plugins — without holding the core activate_plugins capability. Exploitation requires the target user to hold a delegated Everest Forms capability (manage_everest_forms, everest_forms_create_forms, or everest_forms_view_forms), which the plugin's own roles and permissions tool allows administrators to assign to non-administrator roles such as Author; the nonces required to exploit the AJAX handlers are emitted on EVF admin pages accessible to any such delegated user.
Product
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026User Profile Builder: Authentication BypassCVE-2026-15826 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.
Product
User Profile Builder
Affected
up to 3.16.4
What to do
Affects up to 3.16.4. Update User Profile Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Beaver Builder Page Builder – Drag and Drop Website Builder: Stored Cross-Site ScriptingCVE-2026-17090 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' (Button Code) Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Beaver Builder grants editor access to any WordPress role holding the edit_posts capability by default, meaning Author-level users and above can exploit this vulnerability.
Product
Beaver Builder Page Builder – Drag and Drop Website Builder
Affected
up to 2.10.2.2
What to do
Affects up to 2.10.2.2. Update Beaver Builder Page Builder – Drag and Drop Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 15, 2026Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder: Blind SQL InjectionCVE-2026-15993 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that a form is configured with a DB-backed dynamic choice field whose WHERE template references the {username} placeholder, and the attacker must first set their own display_name to a SQL payload via the standard WordPress profile edit screen before triggering the fm_reload_input AJAX endpoint.
Product
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Affected
up to 1.15.44
What to do
Affects up to 1.15.44. Update Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: Generic SQL InjectionCVE-2026-16810 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2026Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server.CVE-2026-73533 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wpmanageninja.com
Aug 13, 2026Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server.CVE-2026-73532 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 13, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Stored Cross-Site ScriptingCVE-2026-18146 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the browser of an administrator (or any user with the Fluent Forms entry-viewing capability) when they view the form's entry Submission Logs in the WordPress admin dashboard. Exploitation requires that a site administrator or Fluent Forms manager has configured an email notification whose subject or static (direct) Send To value references an attacker-influenced Smartcode such as an input_password field value, a cookie value, or submission.response.
Product
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Affected
up to 6.2.11
What to do
Affects up to 6.2.11. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 13, 2026ShopEngine Elementor WooCommerce Builder Addon: Does not protect one of its authentication endpoints against CSRFCVE-2026-19088 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout are stored under and readable by the attacker.
Product
ShopEngine Elementor WooCommerce Builder Addon
Fixed in
4.9.3
What to do
Update ShopEngine Elementor WooCommerce Builder Addon to 4.9.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Royal Addons for Elementor: Does not validate a widget setting used to build an HTML tag before outputting itCVE-2026-19217 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Royal Addons for Elementor
Fixed in
1.7.1065
What to do
Update Royal Addons for Elementor to 1.7.1065 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Photo Album Plus: Does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own optionsCVE-2026-18049 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
Product
WP Photo Album Plus
Fixed in
9.2.07.002
What to do
Update WP Photo Album Plus to 9.2.07.002 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Photo Album Plus: Does not validate a client-controlled value used to build a file path in one of its public endpoint actionsCVE-2026-18048 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
Product
WP Photo Album Plus
Fixed in
9.2.07.002
What to do
Update WP Photo Album Plus to 9.2.07.002 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Form Maker by 10Web: Does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice fieldCVE-2026-16977 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
Product
Form Maker by 10Web
Fixed in
1.15.45
What to do
Update Form Maker by 10Web to 1.15.45 or newer.
Full record and what to do →NVD record wpscan.com
Aug 11, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-16974 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 10, 2026Podcast Player: Does not validate the destination of a server-side request built from user-supplied inputCVE-2026-14860 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
Product
Podcast Player
Fixed in
8.3.1
What to do
Update Podcast Player to 8.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026YMC Filter: Does not sanitize and escape a layout builder setting before outputting it on a public endpointCVE-2026-16558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
Product
YMC Filter
Fixed in
3.12.8
What to do
Update YMC Filter to 3.12.8 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.