Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

5,850 results · page 7 of 117

Aug 18, 2026Wise Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66636 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.
Product
Wise Chat
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Wise Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Ultimate Dashboard Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66621 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.
Product
Ultimate Dashboard Pro
Affected
up to 3.11.2
What to do
Affects up to 3.11.2. Update Ultimate Dashboard Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2026Epeken All Kurir for Woocommerce: Does not verify that a payment-confirmation request originates from the owner of the targeted orderCVE-2026-16739 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.
Product
Epeken All Kurir for Woocommerce
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Epeken All Kurir for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 13, 2026Samex - Clean, Minimal Shop WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28154 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.
Product
Samex - Clean, Minimal Shop WooCommerce
Affected
up to 2.5
What to do
Affects up to 2.5. Update Samex - Clean, Minimal Shop WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 12, 2026Wallet System for WooCommerce: Does not validate a user-supplied wallet amount against the customer's actual stored balance during checkoutCVE-2026-15045 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
Product
Wallet System for WooCommerce
Fixed in
2.7.10
What to do
Update Wallet System for WooCommerce to 2.7.10 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026the pageIntegritySubmission() method in src/integrity.lib.php that: Sucuri Security WordPress plugin through version 2.7.3 contains a path traversalCVE-2026-73033 · WordPress plugins & themes · reported by VulnCheckHigh 7
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.
Product
the pageIntegritySubmission() method in src/integrity.lib.php that
What to do
Update the pageIntegritySubmission() method in src/integrity.lib.php that to the newest version.
Full record and what to do →NVD record github.com vulncheck.com
Aug 10, 2026CheckView: Does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin beforeCVE-2026-18786 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.
Product
CheckView
Fixed in
2.3.2
What to do
Update CheckView to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026AutoNetTV Relay: Does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization taskCVE-2026-13600 · WordPress plugins & themes · reported by WPScanHigh 8.1
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
Product
AutoNetTV Relay
Fixed in
3.0.14
What to do
Update AutoNetTV Relay to 3.0.14 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection: Does not perform any capability check on one of its REST API endpointsCVE-2026-16578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
Product
Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
Fixed in
1.4.0
What to do
Update Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Event Booking Manager for WooCommerce (Pro): Does not validate the ticket price on the server during its native (non-WooCommerce) checkoutCVE-2026-16067 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.
Product
Event Booking Manager for WooCommerce (Pro)
Fixed in
5.0.3
What to do
Update Event Booking Manager for WooCommerce (Pro) to 5.0.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing thCVE-2026-13342 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
Product
Events Manager
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Popup Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28177 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.
Product
Popup Maker
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 5, 2026miniOrange 2FA: Does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factorCVE-2026-16036 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.
Product
miniOrange 2FA
Fixed in
6.2.7
What to do
Update miniOrange 2FA to 6.2.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
Product
Import and export users and customers
Fixed in
2.4.2
What to do
Update Import and export users and customers to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Simple Membership: Does not verify whether user creation failed during registration before using the returned valueCVE-2026-15930 · WordPress plugins & themes · reported by WPScanCritical 9.4
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
Product
Simple Membership
Fixed in
4.7.8
What to do
Update Simple Membership to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Import and export users and customers: Does not restrict the path of a file it reads and displays during a CSV importCVE-2025-15673 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
Product
Import and export users and customers
Fixed in
2.4.3
What to do
Update Import and export users and customers to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Everest Toolkit: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13158 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
Product
Everest Toolkit
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Everest Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 1, 2026Demo Import: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13157 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
Product
Demo Import
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026Link Library: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2026-18197 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4.
Product
Link Library
Fixed in
7.9.4
What to do
Update Link Library to 7.9.4 or newer.
Full record and what to do →NVD record tenable.com wordpress.org
Jul 27, 2026MemberGlut: Does not validate the role chosen during front-end registrationCVE-2026-12394 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
Product
MemberGlut
Fixed in
1.1.5
What to do
Update MemberGlut to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Dokan Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65492 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.
Product
Dokan Pro
Fixed in
5.0.7
What to do
Update Dokan Pro to 5.0.7 or newer.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026TheGem: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.
Product
TheGem
Fixed in
5.12.1.1
What to do
Update TheGem to 5.12.1.1 or newer.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Modula Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65475 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Product
Modula Image Gallery
Affected
up to 2.14.30
What to do
Affects up to 2.14.30. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Hubbub Lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27403 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.
Product
Hubbub Lite
Affected
up to 1.36.3
What to do
Affects up to 1.36.3. Update Hubbub Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan: Directory TraversalCVE-2026-15786 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks. This is only exploitable when the premium version of the software is enabled and active.
Product
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
Affected
up to 7.8.6.6
What to do
Affects up to 7.8.6.6. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026security-ninja-premium: Does not verify the second authentication factor in one of its two-factor authentication code pathsCVE-2026-14291 · WordPress plugins & themes · reported by WPScanHigh 7.5
The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.
Product
security-ninja-premium
Fixed in
5.290
What to do
Update security-ninja-premium to 5.290 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to byCVE-2026-65051 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026bpost-shipping-platform: Does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submissionCVE-2026-8082 · WordPress plugins & themes · reported by WPScanHigh 7.5
The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.
Product
bpost-shipping-platform
Fixed in
3.2.3
What to do
Update bpost-shipping-platform to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026User Registration & Membership: Does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user roleCVE-2026-11961 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.
Product
User Registration & Membership
Fixed in
5.2.3
What to do
Update User Registration & Membership to 5.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026FunnelKit: Does not validate a user-supplied path before deleting a file during a template-import operationCVE-2026-12979 · WordPress plugins & themes · reported by WPScanMedium 5.5
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).
Product
FunnelKit
Fixed in
3.15.0.6
What to do
Update FunnelKit to 3.15.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Jul 14, 2026WP 2FA: Does not verify that the email address supplied during two-factor authentication setup belongs to the userCVE-2026-12988 · WordPress plugins & themes · reported by WPScanMedium 6.4
The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.
Product
WP 2FA
Fixed in
3.1.1.2
What to do
Update WP 2FA to 3.1.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026ICS Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-59516 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Room 34 Creative Services, LLC ICS Calendar ics-calendar allows Reflected XSS.This issue affects ICS Calendar: from n/a through <= 12.1.1.
Product
ICS Calendar
Affected
up to 12.1.1
What to do
Affects up to 12.1.1. Update ICS Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Funnel Builder by FunnelKit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57816 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.15.0.8.
Product
Funnel Builder by FunnelKit
Affected
up to 3.15.0.8
What to do
Affects up to 3.15.0.8. Update Funnel Builder by FunnelKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Forminator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57814 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through <= 1.55.0.1.
Product
Forminator
Affected
up to 1.55.0.1
What to do
Affects up to 1.55.0.1. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Speaker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57783 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue affects Speaker: from n/a through <= 4.1.13.
Product
Speaker
Affected
up to 4.1.13
What to do
Affects up to 4.1.13. Update Speaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Envision Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57780 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-builder allows DOM-Based XSS.This issue affects Envision Page Builder: from n/a through <= 0.22.
Product
Envision Page Builder
Affected
up to 0.22
What to do
Affects up to 0.22. Update Envision Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026RT-Theme 18 | Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57745 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
Product
RT-Theme 18 | Extensions
Affected
up to 2.5
What to do
Affects up to 2.5. Update RT-Theme 18 | Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026AcyMailing SMTP Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57741 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Stored XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.
Product
AcyMailing SMTP Newsletter
Affected
up to 10.11.0
What to do
Affects up to 10.11.0. Update AcyMailing SMTP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.
Product
tagDiv Composer
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026tagDiv Cloud Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57733 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through <= 3.9.4.
Product
tagDiv Cloud Library
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update tagDiv Cloud Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026tagDiv Opt-In Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57732 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows DOM-Based XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.4.
Product
tagDiv Opt-In Builder
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update tagDiv Opt-In Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Flatsome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57728 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This issue affects Flatsome: from n/a through <= 3.20.5.
Product
Flatsome
Affected
up to 3.20.5
What to do
Affects up to 3.20.5. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Kirki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57725 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.
Product
Kirki
Affected
up to 6.0.11
What to do
Affects up to 6.0.11. Update Kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 2.0.12.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 2.0.12
What to do
Affects up to 2.0.12. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Fluent CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57715 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.
Product
Fluent CRM
Affected
up to 3.1.7
What to do
Affects up to 3.1.7. Update Fluent CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57712 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.
Product
WPZOOM Portfolio
Affected
up to 1.4.29
What to do
Affects up to 1.4.29. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026SupportCandy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57711 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.
Product
SupportCandy
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Contact Form Entries: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57708 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Contact Form Entries contact-form-entries allows Reflected XSS.This issue affects Contact Form Entries: from n/a through <= 1.5.2.
Product
Contact Form Entries
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Contact Form Entries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.