Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,957 results · page 6 of 40
Aug 26, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) owns the provider account being updatedCVE-2026-14212 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.8
- What to do
- Update Booking for Appointments and Events Calendar to 9.8 or newer.
Aug 25, 2026ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution: Privilege EscalationCVE-2026-75971 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary `<wp_option>` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting `users_can_register` to `1` and `default_role` to `administrator` — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators.
- Product
- ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution
- Affected
- up to 4.9.4
- What to do
- Affects up to 4.9.4. Update ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026Mane: Local File InclusionCVE-2026-78478 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Mane
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Mane to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Aug 25, 2026InfusedWoo Pro: Privilege EscalationCVE-2026-19892 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the `ajax_iwar_preview_email()` function, which uses `is_admin()` as its only authorization check and allows low-privilege users to render email preview merge fields for an arbitrary email address. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate and retrieve a valid password reset link for any WordPress user, including administrators, enabling account takeover.
- Product
- InfusedWoo Pro
- Affected
- up to 5.1.17
- What to do
- Affects up to 5.1.17. Update InfusedWoo Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddownloads.infusedwoo.comwordfence.com
Aug 25, 2026Events Manager – Calendar, Bookings, Tickets, and more!: Reflected Cross-Site ScriptingCVE-2026-17089 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The shortcode entry point sanitizes 'header_format' via wp_kses(), but the unauthenticated 'search_events_grouped' AJAX action bypasses this sanitization entirely, leaving the parameter unsanitized before it is echoed into the HTML body in output_grouped().
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.4.0.1
- What to do
- Affects up to 7.4.0.1. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026Events Manager – Calendar, Bookings, Tickets, and more!: Local File InclusionCVE-2026-14280 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal key is subsequently executed via an include_once() call that fires on every admin_init invocation — including unauthenticated admin-ajax.php requests — meaning once the malicious key is stored by an administrator, the inclusion is triggered without any further authentication or capability check.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.3.7.4
- What to do
- Affects up to 7.3.7.4. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026Events Manager – Calendar, Bookings, Tickets, and more!: Authorization bypassCVE-2026-10627 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view the titles, dates, descriptions, and location details of events and locations that administrators have marked as draft, pending, trashed, or private.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.4.0
- What to do
- Affects up to 7.4.0. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026Events Manager – Calendar, Bookings, Tickets, and more!: Generic SQL InjectionCVE-2026-15023 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an attacker first plants SQL metacharacters in a custom meta key via the standard add-meta flow (WordPress stores these verbatim in wp_postmeta), then triggers the injection by invoking the event_duplicate or location_duplicate action, which reads the stored meta keys via get_post_meta() and concatenates them unsafely into the INSERT query.
- Product
- Events Manager – Calendar, Bookings, Tickets, and more!
- Affected
- up to 7.4.0
- What to do
- Affects up to 7.4.0. Update Events Manager – Calendar, Bookings, Tickets, and more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.CVE-2026-78268 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.CVE-2026-78267 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.CVE-2026-78265 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
- Affected
- up to 6.17.2
- What to do
- Affects up to 6.17.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.CVE-2026-32561 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.CVE-2026-32560 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.CVE-2026-66671 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Local File Inclusion in Måne <= 1.7 versions.CVE-2026-66670 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.CVE-2026-66648 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66587 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
- What to do
- Update the plugin to the newest version.
Aug 24, 2026Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.CVE-2026-32558 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
- Affected
- up to 8.9.1
- What to do
- Affects up to 8.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Privilege Escalation in Digits <= 9.2 versions.CVE-2026-28165 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Digits <= 9.2 versions.
- Affected
- up to 9.2
- What to do
- Affects up to 9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.CVE-2026-28152 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 24, 2026Unauthenticated Local File Inclusion in Tonda < 2.6 versions.CVE-2026-28151 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
- What to do
- Update the plugin to the newest version.
Aug 21, 2026WPeMatico RSS Feed Fetcher: Unauthorized modification of data that can lead to privilege escalationCVE-2026-19883 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and including, 2.8.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access.
- Product
- WPeMatico RSS Feed Fetcher
- Affected
- up to 2.8.24
- What to do
- Affects up to 2.8.24. Update WPeMatico RSS Feed Fetcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Aug 20, 2026Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
- Affected
- up to 10.4.0
- What to do
- Affects up to 10.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66586 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.CVE-2026-28150 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.CVE-2025-15689 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.
- Affected
- up to 2.5.5
- What to do
- Affects up to 2.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.CVE-2025-15637 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Events Made Easy: Local File InclusionCVE-2026-75963 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
- Product
- Events Made Easy
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Events Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2026Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.CVE-2026-73390 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Local File Inclusion in Resido <= 1.5 versions.CVE-2026-73387 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.CVE-2026-73347 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026TabaPay Gateway: Does not validate the payment callback before establishing a session for the account associated with the referenced orderCVE-2026-18031 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
- Product
- TabaPay Gateway
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update TabaPay Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Booking calendar, Appointment Booking System: Does not properly sanitize uploaded SVG filesCVE-2026-14334 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.36
- What to do
- Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.CVE-2026-73400 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
- Affected
- up to 2.4.11
- What to do
- Affects up to 2.4.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.CVE-2026-73395 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
- Affected
- up to 3.2.36
- What to do
- Affects up to 3.2.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.CVE-2026-73339 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 18, 2026Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.CVE-2026-68568 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.
- Affected
- up to 3.7.41
- What to do
- Affects up to 3.7.41. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.CVE-2026-32464 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.CVE-2026-28570 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2026-18432 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.29.9
- What to do
- Affects up to 3.29.9. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Insecure Direct Object ReferenceCVE-2026-13358 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa_past_appointments due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to access appointment records belonging to arbitrary users and harvest the per-appointment ownership tokens (32-character hashes) embedded in the rendered HTML, which can then be used without any authentication to read or modify those appointments including full customer PII such as name, email, phone number, and private notes. The /wp-json/ssa/v1/render-shortcode REST endpoint is registered unconditionally on rest_api_init regardless of whether the Divi theme is installed, and its permission callback only requires current_user_can('edit_posts'), meaning any Contributor-level account is sufficient to trigger this entire exploit chain.
- Product
- Appointment Booking Calendar — Simply Schedule Appointments Booking
- Affected
- up to 1.6.12.10
- What to do
- Affects up to 1.6.12.10. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 15, 2026Pods – Custom Content Types and Fields: Privilege EscalationCVE-2026-19598 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.
- Product
- Pods – Custom Content Types and Fields
- Affected
- up to 3.3.9
- What to do
- Affects up to 3.3.9. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 15, 2026Real Estate Manager Pro: Privilege EscalationCVE-2026-15142 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 12.8.6. This is due to improper capability handling in the allow_attachment_actions() function, which can treat a target user ID as a media attachment ID during user capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit an administrator account and escalate their privileges to Administrator when the targeted user ID matches the ID of an existing media attachment.
- Product
- Real Estate Manager Pro
- Affected
- up to 12.8.6
- What to do
- Affects up to 12.8.6. Update Real Estate Manager Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwp-rem.comwordfence.com
Aug 15, 2026Wholesale Market: Privilege escalationCVE-2026-14279 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.
- Product
- Wholesale Market
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Wholesale Market to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 15, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Stored Cross-Site ScriptingCVE-2026-15948 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with host-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The tfhb_host role required to exploit this vulnerability can be self-assigned by any visitor via the plugin's public Signup shortcode, making this effectively exploitable by unauthenticated users who complete the registration flow.
- Product
- Hydra Booking — Appointment Scheduling & Booking Calendar
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Hydra Booking — Appointment Scheduling & Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026Booking calendar, Appointment Booking System: Authorization bypassCVE-2026-8840 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional booking emails by writing attacker-supplied payment status and transaction data directly into the payments table. The auto-approval of reservations is only triggered when the 'enable_psuccess_approval' site option is enabled, but payment status manipulation and email dispatch are exploitable regardless of that setting.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.36
- What to do
- Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026Propovoice: All-in-One Client Management System: Privilege EscalationCVE-2026-15312 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.
- Product
- Propovoice: All-in-One Client Management System
- Affected
- up to 1.7.8
- What to do
- Affects up to 1.7.8. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026bLoyal: Loyalty & Promotions by bLoyal: Privilege EscalationCVE-2026-15001 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without any capability or nonce checks, and the `bloyal_customer_auto_login` function unconditionally trusting the `Customer.ExternalId` value returned by whichever API URL is stored in the plugin's options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's bLoyal Loyalty Engine API URL (`bloyal_custom_loyaltyengine_api_url`) and the `is_bloyal_custom_api_url` flag via the unprotected AJAX actions, then trigger the unauthenticated `/cart` REST route to cause `bloyal_customer_auto_login` to fetch customer data from an attacker-controlled endpoint and call `wp_set_auth_cookie()` with an attacker-supplied `Customer.ExternalId`, thereby authenticating as any WordPress user including the site Administrator.
- Product
- bLoyal: Loyalty & Promotions by bLoyal
- Affected
- up to 3.1.611.78
- What to do
- Affects up to 3.1.611.78. Update bLoyal: Loyalty & Promotions by bLoyal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026Online Booking & Scheduling Calendar for WordPress by vcita: Stored Cross-Site ScriptingCVE-2026-14433 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: Generic SQL InjectionCVE-2026-16810 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.