Vulnerability database

40,732 results · page 82 of 815

• Aug 20, 2026Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.CVE-2026-74014 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.

  Affected

  up to 3.2.1

  What to do

  Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.CVE-2026-74013 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.

  Affected

  up to 2.16.13

  What to do

  Affects up to 2.16.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.CVE-2026-74001 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.

  Affected

  up to 5.4.5

  What to do

  Affects up to 5.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.CVE-2026-73998 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.CVE-2026-73993 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

  Affected

  up to 1.7.9

  What to do

  Affects up to 1.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.CVE-2026-73992 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.

  Affected

  up to 1.5.57

  What to do

  Affects up to 1.5.57. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.CVE-2026-73402 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.

  Affected

  up to 6.3.2

  What to do

  Affects up to 6.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.CVE-2026-68566 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.

  Affected

  up to 6.0.2

  What to do

  Affects up to 6.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.CVE-2026-68564 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.

  Affected

  up to 3.1.4

  What to do

  Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-66682 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.

  Affected

  up to 10.4.0

  What to do

  Affects up to 10.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.CVE-2026-66680 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.

  Affected

  up to 3.9.72

  What to do

  Affects up to 3.9.72. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Subscriber Broken Authentication in Leyka <= 3.32.3 versions.CVE-2026-66677 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Subscriber Broken Authentication in Leyka <= 3.32.3 versions.

  Affected

  up to 3.32.3

  What to do

  Affects up to 3.32.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.CVE-2026-66673 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-66672 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.CVE-2026-66649 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

  Affected

  up to 2.5.8

  What to do

  Affects up to 2.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.CVE-2026-66647 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66616 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.

  Product

  Form Maker by 10Web

  Affected

  up to 1.15.49

  What to do

  Affects up to 1.15.49. Update Form Maker by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.CVE-2026-66615 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

  Affected

  up to 4.5.4

  What to do

  Affects up to 4.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.CVE-2026-66614 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.

  Affected

  up to 14.2.2

  What to do

  Affects up to 14.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.CVE-2026-66612 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.

  Affected

  up to 1.3.19

  What to do

  Affects up to 1.3.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.CVE-2026-66611 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.

  Affected

  up to 4.1.10

  What to do

  Affects up to 4.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.CVE-2026-66609 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

  Affected

  up to 5.12.3

  What to do

  Affects up to 5.12.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.CVE-2026-66607 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.

  Affected

  up to 1.4.8

  What to do

  Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.CVE-2026-66606 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.CVE-2026-66605 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

  Affected

  up to 1.4.13

  What to do

  Affects up to 1.4.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.CVE-2026-66604 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.

  Affected

  up to 2.8.173

  What to do

  Affects up to 2.8.173. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.CVE-2026-66601 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.

  Affected

  up to 3.39

  What to do

  Affects up to 3.39. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.CVE-2026-66600 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.

  Affected

  up to 3.39

  What to do

  Affects up to 3.39. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.CVE-2026-66598 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

  Affected

  up to 5.6.07

  What to do

  Affects up to 5.6.07. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.CVE-2026-66597 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

  Affected

  up to 6.5.1.4

  What to do

  Affects up to 6.5.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.CVE-2026-66595 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.

  Affected

  up to 5.5.80

  What to do

  Affects up to 5.5.80. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.CVE-2026-66594 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.CVE-2026-66593 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.

  Affected

  up to 2.184

  What to do

  Affects up to 2.184. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026rtMedia for WordPress, BuddyPress and bbPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-66592 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.

  Product

  rtMedia for WordPress, BuddyPress and bbPress

  Affected

  up to 4.7.11

  What to do

  Affects up to 4.7.11. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.CVE-2026-66590 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

  Affected

  up to 7.4

  What to do

  Affects up to 7.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66586 · WordPress plugins & themes · reported by PatchstackMedium 6.6

  Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.CVE-2026-66583 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

  Affected

  up to 1.57.0

  What to do

  Affects up to 1.57.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.CVE-2026-66582 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.CVE-2026-66581 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.

  Affected

  up to 3.8.14.1

  What to do

  Affects up to 3.8.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.CVE-2026-28150 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.CVE-2025-53999 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.

  Affected

  up to 5.2.2

  What to do

  Affects up to 5.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.CVE-2025-15689 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

  Affected

  up to 2.5.5

  What to do

  Affects up to 2.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated SQL Injection in Capella <= 2.5.5 versions.CVE-2025-15688 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

  Affected

  up to 2.5.5

  What to do

  Affects up to 2.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.CVE-2025-15637 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 20, 2026Events Made Easy: Local File InclusionCVE-2026-75963 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.

  Product

  Events Made Easy

  Affected

  up to 3.2.5

  What to do

  Affects up to 3.2.5. Update Events Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 20, 2026JSON Options: Does not have any capability check or nonce verification on one of its actionsCVE-2026-75860 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.

  Product

  JSON Options

  Affected

  up to 0.0.4

  What to do

  Affects up to 0.0.4. Update JSON Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 20, 2026Kirki: Does not properly validate the files contained in archives uploaded by users with the Editor roleCVE-2026-74992 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.

  Product

  Kirki

  Fixed in

  6.2.3

  What to do

  Update Kirki to 6.2.3 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 20, 2026GutenKit: Does not have a sufficient capability check on some of its REST API endpointsCVE-2026-19699 · WordPress plugins & themes · reported by WPScanLow 2.7

  The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

  Product

  GutenKit

  Fixed in

  2.5.0

  What to do

  Update GutenKit to 2.5.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 20, 2026GutenKit: Does not sanitise uploaded SVG files on all of the upload paths it enablesCVE-2026-19697 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.

  Product

  GutenKit

  Fixed in

  2.5.0

  What to do

  Update GutenKit to 2.5.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 20, 2026Admin and Site Enhancements (ASE): Does not sanitise uploaded SVG files on every route it accepts them throughCVE-2026-19615 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.

  Product

  Admin and Site Enhancements (ASE)

  Fixed in

  9.0.1

  What to do

  Update Admin and Site Enhancements (ASE) to 9.0.1 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.