Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,853 results · page 8 of 38

Jul 28, 2026SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery: Time-based SQL InjectionCVE-2026-15670 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
Affected
up to 3.9.7
What to do
Affects up to 3.9.7. Update SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery: Authentication Bypass leading to Account TakeoverCVE-2026-15014 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.
Product
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
Affected
up to 3.9.7
What to do
Affects up to 3.9.7. Update SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Advanced Form Integration — Connect Forms to 200+ Apps: Authorization bypassCVE-2026-16587 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the site's stored MailUp OAuth tokens in the adfoin_mailup_keys option with attacker-controlled tokens, hijacking future form-submission data to a MailUp account they control or nulling the tokens to break the integration entirely. This is exploitable by any authenticated user who can reach /wp-admin/profile.php, as admin_init fires for all logged-in users visiting any wp-admin page.
Product
Advanced Form Integration — Connect Forms to 200+ Apps
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Advanced Form Integration — Connect Forms to 200+ Apps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots: Arbitrary file deletionCVE-2026-16585 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The prefix check intended to restrict deletion to the uploads directory can be bypassed by crafting a URL that begins with the legitimate uploads base URL but embeds ../ traversal sequences in the path portion, as the normalize_sticker function only applies esc_url_raw(), which does not strip ../ sequences, allowing the traversal payload to be stored verbatim in WordPress options.
Product
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
Affected
up to 2.15.19
What to do
Affects up to 2.15.19. Update Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before reflecting it back in an admin pageCVE-2026-14870 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Database for Contact Form 7, WPforms, Elementor forms
Fixed in
1.5.3
What to do
Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.CVE-2026-65446 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.
Affected
up to 2.4.18
What to do
Affects up to 2.4.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.CVE-2026-59537 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.
Affected
up to 2.10.22
What to do
Affects up to 2.10.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Masteriyo LMS: Does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessionsCVE-2026-13332 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
Product
Masteriyo LMS
Fixed in
2.3.1
What to do
Update Masteriyo LMS to 2.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 25, 2026Fluent Forms Pro Add On Pack: PHP Object InjectionCVE-2026-15962 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.
Product
Fluent Forms Pro Add On Pack
Affected
up to 6.2.6
What to do
Affects up to 6.2.6. Update Fluent Forms Pro Add On Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fluentforms.com wordfence.com
Jul 25, 2026WPForms Pro: Arbitrary File UploadCVE-2026-10818 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
WPForms Pro
Affected
up to 1.10.1.1
What to do
Affects up to 1.10.1.1. Update WPForms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpforms.com wordfence.com
Jul 24, 2026Ninja Forms – The Contact Form Builder That Grows With You: Generic SQL InjectionCVE-2026-15663 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the 'settings' object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.14.9
What to do
Affects up to 3.14.9. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026VikBooking Hotel Booking Engine & PMS: Stored Cross-Site ScriptingCVE-2026-15401 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vbfX custom-field value is stored via the public-facing saveorder task, which has no capability or authentication check enforced by default, enabling fully unauthenticated submission of malicious payloads.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026VikBooking Hotel Booking Engine & PMS: Reflected Cross-Site ScriptingCVE-2026-15346 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.CVE-2026-65532 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
Affected
up to 7.2.2
What to do
Affects up to 7.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.CVE-2026-65463 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.CVE-2026-61947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.CVE-2026-59542 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.
Affected
up to 2.4.18
What to do
Affects up to 2.4.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.CVE-2026-59540 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.CVE-2026-59513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.CVE-2026-57784 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
Affected
up to 3.3.26
What to do
Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.CVE-2026-57427 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026ARforms: Stored Cross-Site ScriptingCVE-2026-12421 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ARforms
Affected
up to 7.2.1
What to do
Affects up to 7.2.1. Update ARforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrCVE-2026-65052 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to byCVE-2026-65051 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026the render callback of the `ninja-forms/submissions-table` Gutenberg block that: Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorizationCVE-2026-65050 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
Product
the render callback of the `ninja-forms/submissions-table` Gutenberg block that
What to do
Update the render callback of the `ninja-forms/submissions-table` Gutenberg block that to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to triCVE-2026-65049 · WordPress plugins & themes · reported by VulnCheckHigh 8.4
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable FieldsetCVE-2026-65048 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.
Affected
up to 3.14.9
What to do
Affects up to 3.14.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 21, 2026Tutor LMS Elementor Addons: Missing AuthorizationCVE-2026-1372 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.
Product
Tutor LMS Elementor Addons
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Tutor LMS Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2026Academy LMS: Does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlersCVE-2026-14184 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
Product
Academy LMS
Fixed in
3.8.1
What to do
Update Academy LMS to 3.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Stored Cross-Site ScriptingCVE-2026-15782 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the OptinMonster plugin to be installed and configured with an active inline campaign that outputs matching #om-{id} markup on the target page, as the WPForms handler only fires when OptinMonster emits its 'om.Campaign.load' event.
Product
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Affected
up to 2.0.0.1
What to do
Affects up to 2.0.0.1. Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 20, 2026Tag Groups is the Advanced Way to Display Your Taxonomy Terms: Does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content typeCVE-2026-9833 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
Product
Tag Groups is the Advanced Way to Display Your Taxonomy Terms
Fixed in
2.2.0
What to do
Update Tag Groups is the Advanced Way to Display Your Taxonomy Terms to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026SlimStat Analytics: Does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reportsCVE-2026-12592 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.
Product
SlimStat Analytics
Fixed in
5.5.0
What to do
Update SlimStat Analytics to 5.5.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026HubSpot All-In-One Marketing – Forms, Popups, Live Chat: Sensitive Information ExposureCVE-2026-9656 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wp_localize_script() / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's plaintext HubSpot OAuth refresh token exposed via the window.leadinConfig JavaScript object, which can then be used to access or modify data in the connected HubSpot tenant. Although the refresh token is stored at rest with AES-256-CTR encryption, decryption occurs server-side before the plaintext value is passed to wp_localize_script(), rendering the at-rest encryption ineffective against this exposure path.
Product
HubSpot All-In-One Marketing – Forms, Popups, Live Chat
Affected
up to 11.3.62
What to do
Affects up to 11.3.62. Update HubSpot All-In-One Marketing – Forms, Popups, Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Royal Addons for Elementor: Does not check the post status of menu items or the templates they reference in one of its REST endpointsCVE-2026-13402 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
Product
Royal Addons for Elementor
Fixed in
1.7.1063
What to do
Update Royal Addons for Elementor to 1.7.1063 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026NEX-Forms: Does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboardCVE-2026-10525 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.
Product
NEX-Forms
Fixed in
9.2.3
What to do
Update NEX-Forms to 9.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026Ninja Forms - Excel Export: Stored Cross-Site ScriptingCVE-2026-15161 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() AJAX handler storing the raw $_POST['filter'] array into a WordPress option via update_option() without any capability check, nonce verification, or input sanitization, combined with the get_filter_row() method on the admin Excel Export screen concatenating the stored filter values (field_key, condition, value) directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms - Excel Export
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Ninja Forms - Excel Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-13765 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including questions belonging to paid courses the attacker is not enrolled in.
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Stored Cross-Site ScriptingCVE-2026-15395 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to, and including, 2.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form-submission nonce is publicly available on any page containing the form shortcode, making this exploitable by fully unauthenticated attackers without any precondition beyond the form being published.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Affected
up to 2.4.18
What to do
Affects up to 2.4.18. Update Kali Forms — Contact Form & Drag-and-Drop Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Ninja Forms - Excel Export: Directory TraversalCVE-2026-15160 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.
Product
Ninja Forms - Excel Export
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Ninja Forms - Excel Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Ninja Forms - Excel Export: Insecure Direct Object ReferenceCVE-2026-15159 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate any Ninja Forms form ID and download all stored submission data — including names, email addresses, phone numbers, physical addresses, and any other PII collected by site forms — as a downloadable XLSX file.
Product
Ninja Forms - Excel Export
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Ninja Forms - Excel Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 16, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-15022 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via the wp_ajax_tutor_quiz_abandon handler, but the injected SQL executes only when a privileged user or Tutor REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, making this a second-order (stored) injection chain.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 15, 2026Gravity Forms: Directory TraversalCVE-2026-12997 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly accessible), which allows the unauthenticated attacker to reach the process_send_resume_link endpoint and supply an arbitrary recipient email address to receive the traversal-retrieved file as a notification attachment.
Product
Gravity Forms
Affected
up to 2.10.4
What to do
Affects up to 2.10.4. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gravityforms.com wordfence.com
Jul 15, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not perform a per-object capability check in its post-duplication AJAX actionCVE-2026-11580 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by other Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.17
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.17 or newer.
Full record and what to do →NVD record wpscan.com
Jul 15, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Does not verify that a file upload is made against an existing form configured with a file-upload fieldCVE-2026-11579 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload files to the WordPress Media Library; the uploads are limited to WordPress's default-allowed MIME types, so this does not lead to code execution.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Fixed in
2.4.17
What to do
Update Kali Forms — Contact Form & Drag-and-Drop Builder to 2.4.17 or newer.
Full record and what to do →NVD record wpscan.com
Jul 14, 2026Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Insecure Direct Object ReferenceCVE-2026-9341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.
Product
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 14, 2026SureForms: Does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amountCVE-2026-11567 · WordPress plugins & themes · reported by WPScanMedium 5.9
The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
Product
SureForms
Fixed in
2.11.1
What to do
Update SureForms to 2.11.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2026-57694 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.
Product
Tutor LMS
Affected
up to 3.9.13
What to do
Affects up to 3.9.13. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.2.2.
Product
NEX-Forms
Affected
up to 9.2.2
What to do
Affects up to 9.2.2. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026CRM Perks Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57421 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms: from n/a through <= 1.1.7.
Product
CRM Perks Forms
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026Advanced Forms: Missing AuthorizationCVE-2026-57378 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Forms: from n/a through <= 1.9.3.7.
Product
Advanced Forms
Affected
up to 1.9.3.7
What to do
Affects up to 1.9.3.7. Update Advanced Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.