Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

24,209 results · page 66 of 485

Aug 6, 2026Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.CVE-2026-65571 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
Affected
up to 1.2.11.1
What to do
Affects up to 1.2.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.CVE-2026-65570 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
Affected
up to 1.8.70
What to do
Affects up to 1.8.70. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.CVE-2026-65569 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.CVE-2026-65565 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
Affected
up to 5.2.3.3
What to do
Affects up to 5.2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.CVE-2026-65560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
Affected
up to 2.5.48
What to do
Affects up to 2.5.48. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.CVE-2026-65559 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.CVE-2026-65556 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
Affected
up to 3.1.43
What to do
Affects up to 3.1.43. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.CVE-2026-65554 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.CVE-2026-65553 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.CVE-2026-65552 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.CVE-2026-65549 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
Affected
up to 3.2.10
What to do
Affects up to 3.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.CVE-2026-65548 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.
Affected
up to 28.4.2
What to do
Affects up to 28.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.CVE-2026-65547 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.CVE-2026-65546 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
Affected
up to 3.1.3.1
What to do
Affects up to 3.1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.CVE-2026-65545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.CVE-2026-65544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
Affected
up to 7.14.5
What to do
Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.CVE-2026-65543 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.CVE-2026-65542 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
Affected
up to 7.14.5
What to do
Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.CVE-2026-65541 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.CVE-2026-65523 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.CVE-2026-65520 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.CVE-2026-65517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.CVE-2026-65515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
Affected
up to 2.35.0
What to do
Affects up to 2.35.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
Affected
up to 1.6.12.10
What to do
Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.CVE-2026-65509 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
Affected
up to 7.5.1
What to do
Affects up to 7.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65508 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
Affected
up to 1.6.12.10
What to do
Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.CVE-2026-65507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.CVE-2026-65504 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.CVE-2026-65502 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.
Affected
up to 8.7.13
What to do
Affects up to 8.7.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.CVE-2026-61982 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.CVE-2026-61964 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
Affected
up to 5.2.9
What to do
Affects up to 5.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.CVE-2026-61963 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
Affected
up to 3.38
What to do
Affects up to 3.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.CVE-2026-61961 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
Affected
up to 4.5.6
What to do
Affects up to 4.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.CVE-2026-61959 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
Affected
up to 6.4.24
What to do
Affects up to 6.4.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.CVE-2026-32548 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.
Affected
up to 4.6.2
What to do
Affects up to 4.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.CVE-2026-32469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.
Affected
up to 7.6.0
What to do
Affects up to 7.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.CVE-2026-28180 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.
Affected
up to 8.9.0
What to do
Affects up to 8.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.CVE-2026-28179 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
Affected
up to 1.33.0
What to do
Affects up to 1.33.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.CVE-2026-28178 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Popup Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28177 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.
Product
Popup Maker
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.CVE-2026-28172 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.CVE-2026-28169 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
Affected
up to 2.52.0
What to do
Affects up to 2.52.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.CVE-2026-28146 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.
Affected
up to 2.0.14
What to do
Affects up to 2.0.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.CVE-2026-28143 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
Affected
up to 1.56.0
What to do
Affects up to 1.56.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.CVE-2026-28141 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.CVE-2026-28140 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.
Affected
up to 3.6.4.1
What to do
Affects up to 3.6.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.CVE-2026-28139 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
Affected
up to 4.14.4
What to do
Affects up to 4.14.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Contributor Privilege Escalation in Forminator <= 1.56.0 versions.CVE-2026-28111 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor Privilege Escalation in Forminator <= 1.56.0 versions.
Affected
up to 1.56.0
What to do
Affects up to 1.56.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.CVE-2026-28082 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.
Affected
up to 3.8.13.1
What to do
Affects up to 3.8.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.CVE-2026-28005 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
Affected
up to 1.5.19
What to do
Affects up to 1.5.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.