Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,669 results · page 6 of 34
Aug 6, 2026WP Hotel Booking: Does not ensure that room quantities and the resulting order total are non-negativeCVE-2026-15149 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.
- Product
- WP Hotel Booking
- Fixed in
- 2.3.3
- What to do
- Update WP Hotel Booking to 2.3.3 or newer.
Aug 6, 2026Payment Gateway for Redsys & WooCommerce Lite: Does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking ordersCVE-2026-12584 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying.
- Product
- Payment Gateway for Redsys & WooCommerce Lite
- Fixed in
- 7.0.2
- What to do
- Update Payment Gateway for Redsys & WooCommerce Lite to 7.0.2 or newer.
Aug 6, 2026CoCart: Does not validate a user-supplied price value against the actual product priceCVE-2026-10524 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.
- Product
- CoCart
- Fixed in
- 4.9.0
- What to do
- Update CoCart to 4.9.0 or newer.
Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.CVE-2026-66686 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
- Affected
- up to 0.14
- What to do
- Affects up to 0.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.CVE-2026-66452 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.CVE-2026-65574 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.CVE-2026-28141 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX: Stored Cross-Site ScriptingCVE-2026-5158 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
- Affected
- up to 5.0.13
- What to do
- Affects up to 5.0.13. Update Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 6, 2026Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider: Stored Cross-Site ScriptingCVE-2026-18400 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, allowing Author-level users to set the malicious delay value via XML-RPC custom_fields when creating an ml-slider post.
- Product
- Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
- Affected
- up to 3.111.0
- What to do
- Affects up to 3.111.0. Update Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 6, 2026Drag and Drop Multiple File Upload for WooCommerce: Does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routineCVE-2026-16054 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.
- Product
- Drag and Drop Multiple File Upload for WooCommerce
- Fixed in
- 1.1.8
- What to do
- Update Drag and Drop Multiple File Upload for WooCommerce to 1.1.8 or newer.
Aug 5, 2026Contest Gallery: Does not route its front-end login through the standard WordPress authentication flowCVE-2026-16055 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
- Product
- Contest Gallery
- Fixed in
- 30.0.7
- What to do
- Update Contest Gallery to 30.0.7 or newer.
Aug 4, 2026Contest Gallery: Does not perform any capability or nonce check in one of its handlersCVE-2026-16056 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
- Product
- Contest Gallery
- Fixed in
- 30.0.7
- What to do
- Update Contest Gallery to 30.0.7 or newer.
Aug 3, 2026Classified Listing: Does not perform a capability check on an AJAX action that returns aggregated store revenue totalsCVE-2026-16276 · WordPress plugins & themes · reported by WPScanLow 2.7
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.
- Product
- Classified Listing
- Fixed in
- 5.4.4
- What to do
- Update Classified Listing to 5.4.4 or newer.
Aug 3, 2026Contest Gallery: Does not perform per-object capability or nonce checks in one of its post-deletion handlersCVE-2026-16057 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
- Product
- Contest Gallery
- Fixed in
- 30.0.7
- What to do
- Update Contest Gallery to 30.0.7 or newer.
Aug 2, 2026login-social: Does not validate password-reset requests against a reset key or the requester's identityCVE-2026-16261 · WordPress plugins & themes · reported by WPScanHigh 7.5
The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as any existing account, including administrators, and take over the site.
- Product
- login-social
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update login-social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026RT Mega Menu: Does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin pageCVE-2026-15385 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.
- Product
- RT Mega Menu
- Fixed in
- 1.5.2
- What to do
- Update RT Mega Menu to 1.5.2 or newer.
Aug 2, 2026Gallery for Google Photos: Does not properly restrict access to the stored third-party OAuth credentials of the connected accountCVE-2026-15236 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.
- Product
- Gallery for Google Photos
- Fixed in
- 1.2.1
- What to do
- Update Gallery for Google Photos to 1.2.1 or newer.
Aug 2, 2026Clever Mega Menu for Visual Composer: Does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadataCVE-2026-11872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.
- Product
- Clever Mega Menu for Visual Composer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Clever Mega Menu for Visual Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Stored Cross-Site ScriptingCVE-2026-16091 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress_rank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
- Affected
- up to 7.9.9.1
- What to do
- Affects up to 7.9.9.1. Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Stored Cross-Site ScriptingCVE-2026-16090 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in 'gamipress_achievement' in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping.
- Product
- GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
- Affected
- up to 7.9.9.1
- What to do
- Affects up to 7.9.9.1. Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Icegram Engage – Popups, Optins, CTAs & Lead Generation: Second-order SQL InjectionCVE-2026-16087 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting.
- Product
- Icegram Engage – Popups, Optins, CTAs & Lead Generation
- Affected
- up to 3.1.42
- What to do
- Affects up to 3.1.42. Update Icegram Engage – Popups, Optins, CTAs & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026HUSKY: Does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion pathCVE-2026-15244 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.
- Product
- HUSKY
- Fixed in
- 1.4.1
- What to do
- Update HUSKY to 1.4.1 or newer.
Aug 1, 2026Spectra Legacy: Does not validate or escape several block style attributes before using them to build the CSS it outputs on the front endCVE-2026-10827 · WordPress plugins & themes · reported by WPScanLow 3.5
The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.
- Product
- Spectra Legacy
- Fixed in
- 2.20.0
- What to do
- Update Spectra Legacy to 2.20.0 or newer.
Jul 31, 2026Realtyna Organic IDX: Arbitrary File UploadCVE-2026-16236 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Realtyna Organic IDX
- Affected
- up to 5.3.0
- What to do
- Affects up to 5.3.0. Update Realtyna Organic IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2026JS Help Desk: Does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handlerCVE-2026-14928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
- Product
- JS Help Desk
- Fixed in
- 3.1.4
- What to do
- Update JS Help Desk to 3.1.4 or newer.
Jul 31, 2026Realtyna Organic IDX plugin + WPL Real Estate: Arbitrary File UploadCVE-2026-14483 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.
- Product
- Realtyna Organic IDX plugin + WPL Real Estate
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update Realtyna Organic IDX plugin + WPL Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2026GiveWP: Does not restrict the set of available payment gateways to those enabled by the administratorCVE-2026-14317 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.
- Product
- GiveWP
- Fixed in
- 4.16.3
- What to do
- Update GiveWP to 4.16.3 or newer.
Jul 31, 2026ElementsKit Elementor Addons: Does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front endCVE-2026-13393 · WordPress plugins & themes · reported by WPScanLow 3.5
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.
- Product
- ElementsKit Elementor Addons
- Fixed in
- 3.10.01
- What to do
- Update ElementsKit Elementor Addons to 3.10.01 or newer.
Jul 31, 2026miniOrange 2FA: Does not validate the submitted one-time password against the targeted user's stored secretCVE-2026-12695 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.
- Product
- miniOrange 2FA
- Fixed in
- 6.2.6
- What to do
- Update miniOrange 2FA to 6.2.6 or newer.
Jul 29, 2026PayU CommercePro: Does not verify the payment-gateway signature before applying order modificationsCVE-2026-13692 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.
- Product
- PayU CommercePro
- Fixed in
- 3.9.0
- What to do
- Update PayU CommercePro to 3.9.0 or newer.
Jul 28, 2026Plugin Organizer: SQL InjectionCVE-2026-15304 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Plugin Organizer
- Affected
- up to 10.2.4
- What to do
- Affects up to 10.2.4. Update Plugin Organizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Stored Cross-Site ScriptingCVE-2026-15730 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied at post save does not neutralize this payload because only the inert shortcode text is stored in post_content; the dangerous HTML is synthesized at render time by the shortcode handler, entirely bypassing save-time sanitization.
- Product
- GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
- Affected
- up to 7.9.9.1
- What to do
- Affects up to 7.9.9.1. Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.CVE-2026-65447 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
- Affected
- up to 30.0.6
- What to do
- Affects up to 30.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.CVE-2026-66448 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.CVE-2026-66434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.
- Affected
- up to 3.33
- What to do
- Affects up to 3.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.CVE-2026-65433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.CVE-2026-59559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.CVE-2026-59538 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.
- Affected
- up to 7.9.7
- What to do
- Affects up to 7.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Realtyna Organic IDX plugin + WPL Real Estate: Does not validate the type of uploaded filesCVE-2026-13714 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
- Product
- Realtyna Organic IDX plugin + WPL Real Estate
- Fixed in
- 5.3.0
- What to do
- Update Realtyna Organic IDX plugin + WPL Real Estate to 5.3.0 or newer.
Jul 27, 2026Events Calendar: Does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status valueCVE-2026-13390 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
- Product
- Events Calendar
- Fixed in
- 6.16.5.1
- What to do
- Update Events Calendar to 6.16.5.1 or newer.
Jul 27, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX actionCVE-2026-12982 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
- Product
- Document Gallery
- Fixed in
- 5.1.1
- What to do
- Update Document Gallery to 5.1.1 or newer.
Jul 27, 2026Clover Payment Gateway by Zaytech for WooCommerce: Does not verify that an approved external payment record actually belongs to the WooCommerce order being completedCVE-2026-12493 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).
- Product
- Clover Payment Gateway by Zaytech for WooCommerce
- Fixed in
- 1.3.6
- What to do
- Update Clover Payment Gateway by Zaytech for WooCommerce to 1.3.6 or newer.
Jul 23, 2026Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.CVE-2026-65519 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
- Affected
- up to 2.7.7.29
- What to do
- Affects up to 2.7.7.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Modula Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65475 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
- Product
- Modula Image Gallery
- Affected
- up to 2.14.30
- What to do
- Affects up to 2.14.30. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.CVE-2026-65460 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.CVE-2026-59547 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
- Affected
- up to 9.1.4
- What to do
- Affects up to 9.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.CVE-2026-57696 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.CVE-2026-24628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
- Affected
- up to 1.16.3
- What to do
- Affects up to 1.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more: Arbitrary file uploadsCVE-2026-14282 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more
- Affected
- up to 1.12.2
- What to do
- Affects up to 1.12.2. Update GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 22, 2026Timetics: Does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gatewaysCVE-2026-14322 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.
- Product
- Timetics
- Fixed in
- 1.0.57
- What to do
- Update Timetics to 1.0.57 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.