Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,831 results · page 7 of 37

Jul 22, 2026Product Addons and Product Options With Custom Fields: Does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inlineCVE-2026-12968 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.
Product
Product Addons and Product Options With Custom Fields
Fixed in
1.6.15
What to do
Update Product Addons and Product Options With Custom Fields to 1.6.15 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Directory TraversalCVE-2026-15457 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.0.13
What to do
Affects up to 6.0.13. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026Smart Custom Fields: Stored Cross-Site ScriptingCVE-2026-2594 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.7. This is due to insufficient input sanitization and output escaping of uploaded image attachment titles. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in 5.0.7.
Product
Smart Custom Fields
Affected
up to 5.0.7
What to do
Affects up to 5.0.7. Update Smart Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026SysBasics Customize My Account for WooCommerce – Live My Account Customizer: Stored Cross-Site ScriptingCVE-2026-15324 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_type' parameter in all versions up to, and including, 4.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SysBasics Customize My Account for WooCommerce – Live My Account Customizer
Affected
up to 4.4.14
What to do
Affects up to 4.4.14. Update SysBasics Customize My Account for WooCommerce – Live My Account Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026Customer Reviews for WooCommerce: Does not perform authenticationCVE-2026-12684 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
Product
Customer Reviews for WooCommerce
Fixed in
5.113.0
What to do
Update Customer Reviews for WooCommerce to 5.113.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 14, 2026Newsletters: Does not prevent deserialization of untrusted input that is stored through a public formCVE-2026-12583 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.
Product
Newsletters
Fixed in
4.15
What to do
Update Newsletters to 4.15 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026WP Customer Area: Stored Cross-Site ScriptingCVE-2026-7640 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Customer Area
Affected
up to 8.3.5
What to do
Affects up to 8.3.5. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2026Real Testimonials: Deserialization of Untrusted DataCVE-2026-59521 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through <= 3.1.15.
Product
Real Testimonials
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update Real Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Directorist: Deserialization of Untrusted DataCVE-2026-59518 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.
Product
Directorist
Affected
up to 8.8.2
What to do
Affects up to 8.8.2. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Grand Photography: Deserialization of Untrusted DataCVE-2026-57770 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.
Product
Grand Photography
Affected
up to 5.7.8
What to do
Affects up to 5.7.8. Update Grand Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026RT-Theme 18 | Extensions: Deserialization of Untrusted DataCVE-2026-57744 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
Product
RT-Theme 18 | Extensions
Affected
up to 2.5
What to do
Affects up to 2.5. Update RT-Theme 18 | Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026777: Deserialization of Untrusted DataCVE-2026-57738 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.
Product
777
Affected
up to 1.13.0
What to do
Affects up to 1.13.0. Update 777 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Kirki: Deserialization of Untrusted DataCVE-2026-57724 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.
Product
Kirki
Affected
up to 6.0.12
What to do
Affects up to 6.0.12. Update Kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Events Manager: Deserialization of Untrusted DataCVE-2026-57713 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.
Product
Events Manager
Affected
up to 7.3.6
What to do
Affects up to 7.3.6. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026WPJAM Basic: Deserialization of Untrusted DataCVE-2026-57371 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.
Product
WPJAM Basic
Affected
up to 7.0
What to do
Affects up to 7.0. Update WPJAM Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2026Majestic Support – The Leading-Edge Help Desk & Customer Support: Generic SQL InjectionCVE-2026-13262 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all versions up to, and including, 1.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a valid 'get-smart-reply' nonce, which any Subscriber-level user can obtain by creating a ticket via the public frontend and visiting the resulting ticket detail page, making this effectively exploitable by any authenticated user.
Product
Majestic Support – The Leading-Edge Help Desk & Customer Support
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Majestic Support – The Leading-Edge Help Desk & Customer Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026Import and export users and customers: Sensitive Information ExposureCVE-2026-15026 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via the email_template_selected. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the post_title and raw post_content of arbitrary posts regardless of status (draft, private, future, trash, password-protected) or post type (including non-public CPTs such as WooCommerce orders and internal CRM records) by enumerating post IDs. The required codection-security nonce is exposed as inline JavaScript on any wp-admin page when ?post_type=acui_email_template is appended to the URL, which is reachable by any authenticated user including Subscribers.
Product
Import and export users and customers
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_atCVE-2026-15285 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Plus Addons for Elementor plugin for WordPress was vulnerable to Authenticated (Contributor+) Stored Cross-Site Scripting via the Button widget's `custom_attributes` setting in versions up to and including 6.4.11. The `render` function in `modules/widgets/tp_button.php` passed the raw `custom_attributes` string through `tp_senitize_js_input()`. This filter is bypassable. The issue is patched in version 6.4.12.
Affected
up to 6.4.11
What to do
Affects up to 6.4.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder: Arbitrary file deletionCVE-2026-14372 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config).
Product
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Age Verification & Identity Verification by Token of Trust: Unauthorized accessCVE-2026-7558 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 4.0.2. This is due to the handle_export_table() function being registered on the WordPress 'init' hook, which fires for all requests, including those from unauthenticated visitors, without any capability check. This makes it possible for unauthenticated attackers to download a CSV file containing sensitive WooCommerce donation data, including order dates, order IDs, charitable donation amounts, and admin-only order edit URLs, simply by visiting any page on the site with the 'tot_export_table' GET parameter set to a numeric value (0–3).
Product
Age Verification & Identity Verification by Token of Trust
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Age Verification & Identity Verification by Token of Trust to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2026-13771 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, and including, 5.113.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Customer Reviews for WooCommerce
Affected
up to 5.113.0
What to do
Affects up to 5.113.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2026Backstage - Customizer Demo Access: Privilege EscalationCVE-2026-9842 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as `default_role`, leading to privilege escalation.
Product
Backstage - Customizer Demo Access
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Backstage - Customizer Demo Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 6, 2026Ultimate Member: Does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profilesCVE-2026-11766 · WordPress plugins & themes · reported by WPScanHigh 8
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
Product
Ultimate Member
Fixed in
2.12.0
What to do
Update Ultimate Member to 2.12.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 2, 2026Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.CVE-2026-57687 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.CVE-2026-57358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Themify Popup: Deserialization of Untrusted DataCVE-2026-56037 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.
Product
Themify Popup
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Themify Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026ARMember Premium: Deserialization of Untrusted DataCVE-2026-27060 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6.
Product
ARMember Premium
Fixed in
7.6
What to do
Update ARMember Premium to 7.6 or newer.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Authorization bypassCVE-2026-12472 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.0.11
What to do
Affects up to 6.0.11. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Sensitive Information ExposureCVE-2026-12122 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.0.11
What to do
Affects up to 6.0.11. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026Custom Payment Gateways for WooCommerce: Stored Cross-Site ScriptingCVE-2026-7517 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable by unauthenticated guest users submitting a crafted checkout POST request, requiring no custom input fields to be configured in the plugin.
Product
Custom Payment Gateways for WooCommerce
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Custom Payment Gateways for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2026RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: Authentication BypassCVE-2026-9242 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN `callback` handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data — including `payment_status` and the `custom` field encoding the target `user_id` — before PayPal IPN validation is performed, meaning the database remains poisoned even when validation subsequently fails. This makes it possible for unauthenticated attackers to authenticate as any WordPress user, including administrators, by submitting a forged IPN request that overwrites a payment log entry's `user_id` with that of a target account, then visiting the success return URL with a legitimately obtained security hash to cause the plugin to issue real WordPress authentication cookies for the targeted account.
Product
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Affected
up to 6.0.8.6
What to do
Affects up to 6.0.8.6. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.CVE-2026-56043 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.CVE-2026-56027 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-1869 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 25, 2026Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.CVE-2026-56042 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.CVE-2026-56023 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 24, 2026MP Customize Login Page: Cross-Site Request Forgery (CSRF)CVE-2026-6292 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a completely broken nonce validation in the enter_mpclp_login_options() function, which contains an inverted check (if wp_verify_nonce(...) { return false; }) and is missing the required action parameter for wp_verify_nonce(). As a result, the nonce check is effectively dead code: it never blocks malicious requests because a CSRF-supplied empty/invalid nonce always returns false, satisfying the inverted condition to continue execution. Furthermore, the settings-update handler is hooked on init without any capability check. This makes it possible for unauthenticated attackers to modify all plugin setting, including login page background, logo URL, image dimensions, button colors, and login message, by tricking a logged-in administrator into submitting a crafted request.
Product
MP Customize Login Page
Affected
up to 1.0
What to do
Affects up to 1.0. Update MP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 24, 2026Post Duplicator: Does not safely handle custom meta-data during post duplicationCVE-2026-10749 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.
Product
Post Duplicator
Fixed in
3.0.15
What to do
Update Post Duplicator to 3.0.15 or newer.
Full record and what to do →NVD record wpscan.com
Jun 18, 2026SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager: Reflected Cross-Site ScriptingCVE-2026-12137 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Because the vulnerable plugin_options_page() function is only rendered within the WordPress admin dashboard, successful exploitation requires the targeted victim to be logged in with Shop Manager-level access or higher.
Product
SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2026Customize My Account For Woocommerce: Stored Cross-Site ScriptingCVE-2026-12136 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Customize My Account For Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sysbasics_user_avatar' shortcode in versions up to, and including, 4.3.6. This is due to insufficient input sanitization and output escaping on user supplied attributes (min_height, min_width, max_height, max_width) in the wcmamtx_get_avatar_default() function, which are concatenated unescaped into the get_avatar() extra_attr style attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Customize My Account For Woocommerce
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update Customize My Account For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2026Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Stored Cross-Site ScriptingCVE-2026-11358 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2026Entrepreneur - Booking for Small Businesses: Deserialization of Untrusted DataCVE-2025-69130 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection. This issue affects Entrepreneur - Booking for Small Businesses WordPress Theme: from n/a before 3.1.5.
Product
Entrepreneur - Booking for Small Businesses
Fixed in
3.1.5
What to do
Update Entrepreneur - Booking for Small Businesses to 3.1.5 or newer.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Creatify: Deserialization of Untrusted DataCVE-2025-60236 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.
Product
Creatify
Affected
up to 1.5
What to do
Affects up to 1.5. Update Creatify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026The Hospital: Deserialization of Untrusted DataCVE-2025-60231 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1.
Product
The Hospital
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update The Hospital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026The Barber Shop: Deserialization of Untrusted DataCVE-2025-60230 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.
Product
The Barber Shop
Affected
up to 1.9
What to do
Affects up to 1.9. Update The Barber Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Lagom: Deserialization of Untrusted DataCVE-2025-60229 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.
Product
Lagom
Affected
up to 2.0
What to do
Affects up to 2.0. Update Lagom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.CVE-2026-27410 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 versions.CVE-2026-25470 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.47 versions.
Affected
up to 2.0.47
What to do
Affects up to 2.0.47. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Fusion Builder: Deserialization of Untrusted DataCVE-2026-12256 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
Product
Fusion Builder
Affected
up to 3.15.3
What to do
Affects up to 3.15.3. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026ThemeREX Addons: Deserialization of Untrusted DataCVE-2025-60205 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.
Product
ThemeREX Addons
Affected
up to 2.36.1.1
What to do
Affects up to 2.36.1.1. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.