Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,049 results · page 7 of 61
Sep 4, 2026The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated CVE-2026-82923 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads directory, that file write is remote code execution.
- What to do
- Update the plugin to the newest version.
Sep 4, 2026Divi Ajax Filter: Local File InclusionCVE-2026-11613 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. This vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
- Product
- Divi Ajax Filter
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update Divi Ajax Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddiviengine.comwordfence.com
Sep 3, 2026Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.CVE-2026-84834 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
- Affected
- up to 3.2.0
- What to do
- Affects up to 3.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.CVE-2026-84814 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.
- Affected
- up to 3.1.8.8
- What to do
- Affects up to 3.1.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.CVE-2026-84813 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
- Affected
- up to 2.8.174
- What to do
- Affects up to 2.8.174. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.CVE-2026-84768 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
- Affected
- up to 1.2.20
- What to do
- Affects up to 1.2.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.CVE-2026-84753 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
- Affected
- up to 1.31.0
- What to do
- Affects up to 1.31.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.CVE-2026-84238 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
- What to do
- Update the plugin to the newest version.
Sep 2, 2026WatchMan-Site7: Does not restrict access to its debugging consoleCVE-2026-77009 · WordPress plugins & themes · reported by WPScanCritical 9.9
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
- Product
- WatchMan-Site7
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update WatchMan-Site7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Embed HTML5 Game: Does not properly restrict who can upload files via the pluginCVE-2026-4357 · WordPress plugins & themes · reported by WPScanCritical 10
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
- Product
- Embed HTML5 Game
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Embed HTML5 Game to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload componentCVE-2025-9314 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component
- Product
- Developer Tools
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Developer Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.CVE-2026-81294 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.
- Affected
- up to 3.15.1
- What to do
- Affects up to 3.15.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.CVE-2026-81286 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026SigmaForms Pro – AI Generated Forms: Arbitrary file deletionCVE-2026-78657 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.
- Product
- SigmaForms Pro – AI Generated Forms
- Affected
- up to 1.4.11
- What to do
- Affects up to 1.4.11. Update SigmaForms Pro – AI Generated Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfeedback.bdthemes.comwordfence.com
Sep 2, 2026Booking for Appointments and Events Calendar – Amelia (Premium): Privilege EscalationCVE-2026-9055 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when the 'externalId' parameter is set to 0. This makes it possible for unauthenticated attackers to escalate their privileges to administrator by first elevating to the manager role, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
- Product
- Booking for Appointments and Events Calendar – Amelia (Premium)
- Affected
- 8.0 to 9.6.2
- What to do
- Affects 8.0 to 9.6.2. Update Booking for Appointments and Events Calendar – Amelia (Premium) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpamelia.comwordfence.com
Sep 1, 2026Nokri - Job Board: Privilege EscalationCVE-2026-18550 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.
- Product
- Nokri - Job Board
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Nokri - Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordnokriwp.comthemeforest.net
Aug 31, 2026WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode: Arbitrary file uploadCVE-2026-75865 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints in all versions up to, and including, 4.4.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 31, 2026Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.CVE-2026-82226 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.
- Affected
- up to 3.6.0.2
- What to do
- Affects up to 3.6.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.CVE-2026-81780 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Newspapers X: Improper Validation of Specified Quantity in InputCVE-2026-81779 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48.
- Product
- Newspapers X
- Affected
- up to 1.0.48
- What to do
- Affects up to 1.0.48. Update Newspapers X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.CVE-2026-81763 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
- Affected
- up to 3.8.2
- What to do
- Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.CVE-2026-81756 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
- Affected
- up to 5.1.24
- What to do
- Affects up to 5.1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.CVE-2026-81293 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
- Affected
- up to 5.5.81
- What to do
- Affects up to 5.5.81. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: Unrestricted Upload of File with Dangerous TypeCVE-2026-82970 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.
- Product
- WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update WP Cookie Notice for GDPR, CCPA & ePrivacy Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackeCVE-2026-66047 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin installation and activation, achieving PHP code execution as the web-server user.
- Fixed in
- 4.17.2
- What to do
- Update the plugin to 4.17.2 or newer.
Full record and what to do →NVD recordprofilepress.comwordpress.org
Aug 30, 2026MyHome Core: Authentication BypassCVE-2026-15980 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes it possible for unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators. Successful exploitation requires the MyHome theme to be configured in legacy/WPBakery mode with frontend registration and confirmation email enabled, and the target account must not already have the myhome_agent_confirmed user meta set.
- Product
- MyHome Core
- Affected
- up to 4.4.5
- What to do
- Affects up to 4.4.5. Update MyHome Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Aug 29, 2026Custom User Registration Fields for WooCommerce: Privilege EscalationCVE-2026-15369 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request in the af_reg_checkout_data_to_order_meta_data_block() function, persisting it in order meta, and then passing it directly to WP_User::add_role() in the af_reg_custom_order_processing_function() function (hooked to woocommerce_thankyou) without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator (or any other role slug) as the desired role. Note: The exploit requires the "User Role Selection" setting to be enabled.
- Product
- Custom User Registration Fields for WooCommerce
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Custom User Registration Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwoocommerce.comwordfence.com
Aug 29, 2026Sigma Forms Pro: Remote Code ExecutionCVE-2026-14494 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.
- Product
- Sigma Forms Pro
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Sigma Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfeedback.bdthemes.comwordfence.com
Aug 29, 2026爱采集数据采集和发布插件: Does not require a per-install secret for one of its unauthenticated endpointsCVE-2026-77012 · WordPress plugins & themes · reported by WPScanCritical 9.3
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the server, force it to issue arbitrary requests and retrieve the responses, and write attacker-supplied content outside the uploads directory.
- Product
- 爱采集数据采集和发布插件
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update 爱采集数据采集和发布插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026Total processing card payments for WooCommerce: Does not validate a user-supplied path before using it to build a server-side verification requestCVE-2026-16947 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disclosing the merchant's payment-gateway credentials) and to forge a success response that marks arbitrary WooCommerce orders as paid.
- Product
- Total processing card payments for WooCommerce
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update Total processing card payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026Uix UserCenter: Does not verify that the account being modified through an unauthenticated profile-update action belongs to the requesterCVE-2026-16259 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.
- Product
- Uix UserCenter
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Uix UserCenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2026MemberHero: Does not restrictCVE-2026-10522 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable by unauthenticated attackers to obtain administrator access and to take over existing accounts. No version that fully addresses the issue is available at the time of this advisory. Mitigation: deactivate and remove the MemberHero WordPress plugin through 6.9 until a version that fully resolves this issue is released. If the MemberHero WordPress plugin through 6.9 must stay active, disable public registration, restrict access to the registration functionality, and monitor the site for unexpected administrator accounts.
- Product
- MemberHero
- Affected
- up to 6.9
- What to do
- Affects up to 6.9. Update MemberHero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026GiveWP: Deserialization of Untrusted DataCVE-2026-82222 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.
- Product
- GiveWP
- Affected
- up to 4.16.7.1
- What to do
- Affects up to 4.16.7.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 28, 2026WPMU DEV Dashboard: Authentication BypassCVE-2026-76581 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
- Product
- WPMU DEV Dashboard
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update WPMU DEV Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpmudev.comwordfence.com
Aug 27, 2026Tutor LMS: Does not prevent request data from overwriting internal variables while rendering templatesCVE-2026-19092 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
- Product
- Tutor LMS
- Fixed in
- 4.0.6
- What to do
- Update Tutor LMS to 4.0.6 or newer.
Aug 27, 2026Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.CVE-2026-78292 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.CVE-2026-78288 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.CVE-2026-78286 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
- Affected
- up to 8.9.8
- What to do
- Affects up to 8.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.CVE-2026-78274 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
- Affected
- up to 2.0.11
- What to do
- Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.CVE-2026-78260 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
- Affected
- up to 8.4.6
- What to do
- Affects up to 8.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.CVE-2026-32566 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
- Affected
- up to 2.0.63
- What to do
- Affects up to 2.0.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.CVE-2026-32479 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.
- Affected
- up to 11.17
- What to do
- Affects up to 11.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Workeera: Does not restrictCVE-2026-77016 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server.
- Product
- Workeera
- Fixed in
- 1.0.6
- What to do
- Update Workeera to 1.0.6 or newer.
Aug 26, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Unrestricted File Type UploadCVE-2026-18080 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as `../helper.php`, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected `crm-attachments` directory and into `wp-content/uploads/`. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.
- Product
- ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
- Affected
- up to 1.17.8
- What to do
- Affects up to 1.17.8. Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 26, 2026Avada: Arbitrary File WriteCVE-2026-18431 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present.
- Product
- Avada
- Affected
- up to 7.16
- What to do
- Affects up to 7.16. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordavada.comwordfence.com
Aug 26, 2026TranslatePress – Translate Multilingual sites with AI Translation: Sensitive Information ExposureCVE-2026-19632 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.
- Product
- TranslatePress – Translate Multilingual sites with AI Translation
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update TranslatePress – Translate Multilingual sites with AI Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.CVE-2026-78267 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.CVE-2026-78265 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
- Affected
- up to 6.17.2
- What to do
- Affects up to 6.17.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.CVE-2026-78262 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
- Affected
- up to 4.0.6
- What to do
- Affects up to 4.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.CVE-2026-32563 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
- Affected
- up to 2.0.63
- What to do
- Affects up to 2.0.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.