Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,600 results · page 7 of 32

Jul 1, 2026User Submitted Posts: Does not escape a submitted value before outputting it in an admin-configured display templateCVE-2026-11570 · WordPress plugins & themes · reported by WPScanMedium 4.2
The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.
Product
User Submitted Posts
Fixed in
20260608
What to do
Update User Submitted Posts to 20260608 or newer.
Full record and what to do →NVD record wpscan.com
Jun 29, 2026APCu Manager: Does not escape APCu object-cache keys before rendering them in an admin-area pageCVE-2026-10083 · WordPress plugins & themes · reported by WPScanHigh 7.5
The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Site Scripting vulnerability. When a persistent object cache is enabled, cache keys derived from unsanitised user input (e.g. a transient name created by another APCu Manager WordPress plugin before 4.5.0 from an unauthenticated request) are output without escaping and execute arbitrary JavaScript in the session of an administrator viewing the page.
Product
APCu Manager
Fixed in
4.5.0
What to do
Update APCu Manager to 4.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Jun 27, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not verify that the user performing a subscription action owns the targeted subscriptionCVE-2026-10820 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.16.17
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.16.17 or newer.
Full record and what to do →NVD record wpscan.com
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.CVE-2026-57659 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.CVE-2026-57658 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Administrator SQL Injection in Popup box <= 6.0.1 versions.CVE-2026-57631 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Popup box <= 6.0.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-57628 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP All Import <= 4.0.1 versions.
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-56071 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.
Affected
up to 1.53.1
What to do
Affects up to 1.53.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 24, 2026Site Kit by Google: Does not properly restrict a REST API write endpoint to administratorsCVE-2026-10753 · WordPress plugins & themes · reported by WPScanLow 2.7
The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access (such as Editors) to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0 setting that should only be modifiable by administrators.
Product
Site Kit by Google
Fixed in
1.176.0
What to do
Update Site Kit by Google to 1.176.0 or newer.
Full record and what to do →NVD record wpscan.com
Jun 20, 2026WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by senCVE-2020-37255 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wptimecapsule.com exploit-db.com
Jun 18, 2026User Admin Simplifier: Cross-Site Request ForgeryCVE-2026-11775 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the useradminsimplifier_options_page function. This makes it possible for unauthenticated attackers to reset and permanently delete any user's stored menu and admin-bar configuration via a forged request that triggers uas_save_admin_options() and overwrites the useradminsimplifier_options database entry via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
User Admin Simplifier
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update User Admin Simplifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 16, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege Escalation to AdministratorCVE-2026-8176 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
Affected
up to 5.5.1
What to do
Affects up to 5.5.1. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 16, 2026Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.CVE-2026-39437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.
Affected
up to 5.2.2
What to do
Affects up to 5.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.CVE-2025-60175 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.CVE-2025-15658 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.
Affected
up to 0.3.4
What to do
Affects up to 0.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WP Go Maps: Does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables routeCVE-2026-8385 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Go Maps WordPress plugin before 10.0.10 does not properly enforce the marker approval filter on the admin-ajax fallback for its datatables route, allowing unauthenticated visitors to retrieve marker records that the site owner has not approved for public display, including their title, category, address and description fields.
Product
WP Go Maps
Fixed in
10.0.10
What to do
Update WP Go Maps to 10.0.10 or newer.
Full record and what to do →NVD record wpscan.com
Jun 10, 2026Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler.CVE-2026-53738 · WordPress plugins & themes · reported by VulnCheckHigh 7.2
Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org vulncheck.com
Jun 10, 2026Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page.CVE-2026-53737 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.
Affected
up to 1.12.18
What to do
Affects up to 1.12.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org vulncheck.com
Jun 9, 2026WPForms: Does not verify the authenticity of incoming PayPal webhook events before processing themCVE-2026-4986 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.
Product
WPForms
Fixed in
1.10.0.5
What to do
Update WPForms to 1.10.0.5 or newer.
Full record and what to do →NVD record wpscan.com
Jun 7, 2026WordPress Plugin admin-word-count-column 2.2 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploitinCVE-2022-50953 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin admin-word-count-column 2.2 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting null byte injection in the path parameter. Attackers can send GET requests to download-csv.php with a crafted path parameter containing directory traversal sequences and null bytes to bypass file restrictions and read sensitive files like system configuration.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jun 5, 2026Admin Columns: PHP Object Injection leading to Remote Code ExecutionCVE-2026-7654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of `unserialize()` without an `allowed_classes` restriction in the `IdsToCollection::get_ids_from_string()` function, which processes attacker-controlled post meta values without proper validation. This makes it possible for authenticated attackers with Contributor-level access and above to inject a serialized PHP object into a post's custom meta field and trigger arbitrary code execution by exploiting a bundled POP gadget chain, resulting in remote code execution as the web server user.
Product
Admin Columns
Affected
up to 7.0.18
What to do
Affects up to 7.0.18. Update Admin Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Hippoo Mobile App for WooCommerce: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-10580 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a {"password":"<new_password>"} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 29, 2026Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unauthorized accessCVE-2025-12714 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271. This makes it possible for unauthenticated attackers to modify several plugin settings including homepage title, meta description, breadcrumbs label, and social media metadata, which can have severe impact on SEO rankings and display malicious content across all site pages where breadcrumbs are used.
Product
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Affected
up to 1.0.271
What to do
Affects up to 1.0.271. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 29, 2026Frontend Admin by DynamiApps: Generic SQL InjectionCVE-2026-10039 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that the attacker also supply a valid 'orderby' parameter in the same request, as this is necessary to reach the vulnerable code path that processes and concatenates the 'order' value into the SQL query.
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.28
What to do
Affects up to 3.28.28. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2026Frontend Admin by DynamiApps: Unauthenticated privilege escalationCVE-2026-6226 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 3.29.2. This is due to insecure form submission handling that accepts arbitrary form definitions from user input instead of securely loading them from the backend. When $_POST['_acf_form'] is an array (rather than a form ID), the validate_form() function bypasses database lookup and directly processes the attacker-controlled structure. The create_record() function preserves attacker-supplied record data if present, and the user action's run() function falls back to attacker-controlled field definitions from $form['fields'] when legitimate fields cannot be found. The role field's pre_update_value() validation reads $field['role_options'] from this attacker-controlled definition, allowing an attacker to specify ['administrator'] as an allowed role and bypass the security check. This makes it possible for unauthenticated attackers to create administrator accounts by injecting a custom form configuration with a spoofed role field.
Product
Frontend Admin by DynamiApps
Affected
up to 3.29.2
What to do
Affects up to 3.29.2. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2026Frontend Admin by DynamiApps: Authorization bypassCVE-2026-7802 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite an administrator's user_pass, user_email, first_name, last_name, and other profile fields by supplying an arbitrary ?user_id= value, enabling full administrator account takeover via direct password replacement or email-redirect password reset. Exploitation requires the targeted Edit-User form to have its 'Roles' configuration setting left empty; when a non-empty roles list is configured, load_data() sets the user ID to 'none' for users whose roles fall outside the allowed list, preventing administrators from being targeted through that form.
Product
Frontend Admin by DynamiApps
Affected
up to 3.29.2
What to do
Affects up to 3.29.2. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Adminimize: Missing AuthorizationCVE-2026-49045 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Adminimize: from n/a through 1.11.11.
Product
Adminimize
Affected
up to 1.11.11
What to do
Affects up to 1.11.11. Update Adminimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026miniorange otp verification: Incorrect Privilege AssignmentCVE-2026-42731 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.
Product
miniorange otp verification
Affected
up to 5.4.9
What to do
Affects up to 5.4.9. Update miniorange otp verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026MinhNhut Link Gateway: Reflected Cross-Site ScriptingCVE-2026-3349 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MinhNhut Link Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter on the redirect page in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MinhNhut Link Gateway
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update MinhNhut Link Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026MinhNhut Link Gateway: Stored Cross-Site ScriptingCVE-2026-3348 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings (Description, Title, and other fields) in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the redirect page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
MinhNhut Link Gateway
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update MinhNhut Link Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2026Mail Mint: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-27349 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. This issue affects Mail Mint: from n/a through 1.19.5.
Product
Mail Mint
Affected
up to 1.19.5
What to do
Affects up to 1.19.5. Update Mail Mint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 15, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2026-6228 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing the UI restrictions in feadmin_get_user_roles(). When the form is subsequently submitted, the pre_update_value() function in class-role.php only validates that the submitted role exists in the form's role_options array (lines 107-110), but fails to verify that the current user has permission to assign that specific role. This makes it possible for unauthenticated attackers to first register as editors (via a public new_user form), then create an edit_user form with administrator in the allowed roles, and finally use that form to escalate their own privileges to administrato
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.36
What to do
Affects up to 3.28.36. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026Woo Commerce Minimum Weight: Cross-Site Request ForgeryCVE-2026-6932 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1. This is due to missing nonce verification on the settings update handler in edit-weight.php. This makes it possible for unauthenticated attackers to modify the minimum order weight setting by tricking a site administrator into clicking a link or visiting an attacker-controlled page containing a forged POST request.
Product
Woo Commerce Minimum Weight
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Woo Commerce Minimum Weight to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 10, 2026the page parameter of the admin settings interface: WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scriptingCVE-2022-50960 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the admin settings interface. Attackers can inject malicious scripts through the page parameter in class-sms-log-display.php to execute arbitrary JavaScript in administrator browsers.
Product
the page parameter of the admin settings interface
What to do
Update the page parameter of the admin settings interface to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 10, 2026WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploitiCVE-2022-50956 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in the open parameter. Attackers can supply file paths through the open GET parameter in dispatcher.php to include and read sensitive files accessible to the web server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 10, 2026WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submittiCVE-2021-47932 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 7, 2026WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: Arbitrary file deletionCVE-2026-7252 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduled_original_file_deletion function in all versions up to, and including, 4.5.2 This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is possible because 'original-file' is a public (non-protected) meta key — it does not begin with an underscore — allowing Authors to freely create or modify it on their own attachment posts via the standard Edit Media form or the REST API.
Product
WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance
Affected
up to 4.5.2
What to do
Affects up to 4.5.2. Update WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 7, 2026Forminator Forms: Missing AuthorizationCVE-2026-6214 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration, unlike the parallel listen_for_csv_export() function which correctly verifies user permissions. This makes it possible for authenticated attackers with subscriber-level access to configure a scheduled export job that emails all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.
Product
Forminator Forms
Affected
up to 1.53.0
What to do
Affects up to 1.53.0. Update Forminator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 6, 2026Forminator Forms: Missing AuthorizationCVE-2026-6222 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()` method in `Forminator_Admin_Module_Edit_Page` (admin/abstracts/class-admin-module-edit-page.php) dispatching sensitive module-management actions — including export, delete, clone, delete-entries, publish/draft, and bulk variants — after only a nonce check, without ever verifying that the current user holds the `manage_forminator_modules` capability. The nonce used (`forminator_form_request`) is unconditionally embedded in the global `forminatorData` JavaScript object and localized on every Forminator admin page, including Templates and Reports pages accessible to users who explicitly lack module-management permissions. Because `processRequest()` is invoked during the `admin_menu` action hook — which fires before WordPress enforces page-level capability checks — a user whose Forminator role is restricted to Templates or Reports can craft a valid POST request targeting any published module and successfully trigger the vulnerable actions. This makes it possible for authenticated attackers with subscriber-level access (or any cus
Product
Forminator Forms
Affected
up to 1.51.1
What to do
Affects up to 1.51.1. Update Forminator Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 5, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Path TraversalCVE-2026-5192 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires a publicly accessible form with a File Upload field where Save and Continue is enabled in that form's Behavior settings and the Save and Continue email notification is configured to attach uploaded files in Email Notifications.
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Affected
up to 1.52.1
What to do
Affects up to 1.52.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 5, 2026Forminator: Authorization bypassCVE-2026-2729 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly verifying that a user is authorized to perform an action when processing attacker-supplied Stripe PaymentIntent identifiers in the public payment flow. This makes it possible for unauthenticated attackers to submit high-value paid forms as completed by reusing a previously succeeded low-value Stripe PaymentIntent, resulting in underpayment/payment bypass conditions.
Product
Forminator
Affected
up to 1.52.0
What to do
Affects up to 1.52.0. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2026CMP – Coming Soon & Maintenance Plugin by NiteoThemes: Arbitrary file upload and remote code executionCVE-2026-6518 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (`wp-content/plugins/cmp-premium-themes/`), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.
Product
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
Affected
up to 4.1.16
What to do
Affects up to 4.1.16. Update CMP – Coming Soon & Maintenance Plugin by NiteoThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2026Mini Ajax Cart for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-6370 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.
Product
Mini Ajax Cart for WooCommerce
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Mini Ajax Cart for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2026YITH WooCommerce Wishlist: Does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operationsCVE-2026-4432 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YITH WooCommerce Wishlist WordPress plugin before 4.13.0 does not properly validate wishlist ownership in the save_title() AJAX handler before allowing wishlist renaming operations. The function only checks for a valid nonce, which is publicly exposed in the page source of the /wishlist/ page, making it possible for unauthenticated attackers to rename any wishlist belonging to any user on the site.
Product
YITH WooCommerce Wishlist
Fixed in
4.13.0
What to do
Update YITH WooCommerce Wishlist to 4.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Apr 8, 2026Uminex: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39629 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affects Uminex: from n/a through <= 1.0.9.
Product
Uminex
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Uminex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Server-Side Request Forgery (SSRF)CVE-2026-39464 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Server Side Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.
Product
Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
Affected
up to 6.19.8
What to do
Affects up to 6.19.8. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 7, 2026Under Construction, Coming Soon & Maintenance Mode: Cross-Site Request Forgery (CSRF)CVE-2026-34896 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue affects Under Construction, Coming Soon & Maintenance Mode: from n/a through 2.1.1.
Product
Under Construction, Coming Soon & Maintenance Mode
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Under Construction, Coming Soon & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2026Minify HTML: Cross-Site Request ForgeryCVE-2026-3191 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Minify HTML
Affected
up to 2.1.12
What to do
Affects up to 2.1.12. Update Minify HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 28, 2026Restaurant Cafeteria: Exposes insecure admin-ajax actions without nonce or capability checksCVE-2025-15445 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including Restaurant Cafeteria WordPress theme through 0.4.6_mods, pages, menus, and front page settings.
Product
Restaurant Cafeteria
Affected
up to 0.4.6
What to do
Affects up to 0.4.6. Update Restaurant Cafeteria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 26, 2026Frontend Admin by DynamiApps: PHP Object InjectionCVE-2026-3328 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Product
Frontend Admin by DynamiApps
Affected
up to 3.28.31
What to do
Affects up to 3.28.31. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.