Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,732 results · page 83 of 815
Aug 20, 2026AI Agent by SiteGround: Authorization bypassCVE-2026-17153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images to the WordPress media library, bypassing the upload_files capability restriction that Contributors are normally subject to, as authenticated attackers with Contributor-level access or above can satisfy the endpoint's nonce and permission checks. The sg_ai_studio_gutenberg_nonce required by the endpoint is emitted to any user with block editor access — including Contributors — making the absent upload_files check the sole barrier to exploitation.
- Product
- AI Agent by SiteGround
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update AI Agent by SiteGround to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 2026Depicter — Popup & Slider Builder: Does not validate the type of a file uploaded through its import feature and does not remove a malformed uploadCVE-2026-15049 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.
- Product
- Depicter — Popup & Slider Builder
- Fixed in
- 4.8.0
- What to do
- Update Depicter — Popup & Slider Builder to 4.8.0 or newer.
Aug 20, 2026Royal Addons for Elementor: Does not correctly sanitise custom widget markup before writing it to a file that is later executedCVE-2026-13405 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1066
- What to do
- Update Royal Addons for Elementor to 1.7.1066 or newer.
Aug 19, 2026TrueBooker – Appointment Booking and Scheduler System: Authorization Bypass Through User-Controlled Key leading to Account TakeoverCVE-2026-18315 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
- Product
- TrueBooker – Appointment Booking and Scheduler System
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update TrueBooker – Appointment Booking and Scheduler System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Aug 19, 2026Elementor Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-32475 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.
- Product
- Elementor Pro
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 19, 2026Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode.CVE-2026-64851 · WordPress plugins & themes · reported by GitHubHigh 8.5
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
- Fixed in
- 6.2.2
- What to do
- Update the plugin to 6.2.2 or newer.
Aug 19, 2026Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.CVE-2026-73394 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.CVE-2026-73391 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.CVE-2026-73390 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.CVE-2026-73389 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.CVE-2026-73388 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Local File Inclusion in Resido <= 1.5 versions.CVE-2026-73387 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.CVE-2026-73386 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.CVE-2026-73385 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.CVE-2026-73384 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.CVE-2026-73364 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.CVE-2026-73363 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.CVE-2026-73354 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.CVE-2026-73347 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.CVE-2026-73185 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.CVE-2026-73184 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
- Affected
- up to 11.1.2
- What to do
- Affects up to 11.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.CVE-2026-73183 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.
- Affected
- up to 4.32
- What to do
- Affects up to 4.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.CVE-2026-73182 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.CVE-2026-66668 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.
- Affected
- up to 9.0.5.2
- What to do
- Affects up to 9.0.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.CVE-2026-66613 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.
- Affected
- up to 3.8.14
- What to do
- Affects up to 3.8.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.CVE-2026-66596 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.
- Affected
- up to 9.3.3
- What to do
- Affects up to 9.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.CVE-2026-61986 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.
- Affected
- up to 30.0.5
- What to do
- Affects up to 30.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.CVE-2026-32552 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.
- Affected
- up to 2.33.0
- What to do
- Affects up to 2.33.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026TranslatePress – Translate Multilingual sites with AI Translation: Unauthenticated Stored Cross-Site ScriptingCVE-2026-75981 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.
- Product
- TranslatePress – Translate Multilingual sites with AI Translation
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update TranslatePress – Translate Multilingual sites with AI Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2026WP Statistics – Simple, privacy-friendly Google Analytics alternative: Stored Cross-Site ScriptingCVE-2026-15780 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database.
- Product
- WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Affected
- up to 14.16.8
- What to do
- Affects up to 14.16.8. Update WP Statistics – Simple, privacy-friendly Google Analytics alternative to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Aug 19, 2026EWWW Image Optimizer: Stored Cross-Site ScriptingCVE-2026-15446 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is achieved by embedding a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content, which the plugin's bundled lazysizes ls.unveilhooks addon then uses to dynamically create and insert a script element into the DOM at page view time.
- Product
- EWWW Image Optimizer
- Affected
- up to 8.7.3
- What to do
- Affects up to 8.7.3. Update EWWW Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Aug 19, 2026SAML Single Sign On: Does not verify the signature of a SAML response before storing the certificate it carriesCVE-2026-19842 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.
- Product
- SAML Single Sign On
- Fixed in
- 5.4.7
- What to do
- Update SAML Single Sign On to 5.4.7 or newer.
Aug 19, 2026WPS Bidouille: Does not have proper authorisation checks in an AJAX actionCVE-2026-19782 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.
- Product
- WPS Bidouille
- Fixed in
- 1.33.5
- What to do
- Update WPS Bidouille to 1.33.5 or newer.
Aug 19, 2026Membership For WooCommerce: Does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a requestCVE-2026-19709 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated.
- Product
- Membership For WooCommerce
- Fixed in
- 3.1.2
- What to do
- Update Membership For WooCommerce to 3.1.2 or newer.
Aug 19, 2026KiviCare: Does not verify that the requesting user is entitled to the media file being servedCVE-2026-19417 · WordPress plugins & themes · reported by WPScanMedium 6.5
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.
- Product
- KiviCare
- Fixed in
- 4.5.4
- What to do
- Update KiviCare to 4.5.4 or newer.
Aug 19, 2026KiviCare: Does not verify that the requesting user owns the appointment being modifiedCVE-2026-19416 · WordPress plugins & themes · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
- Product
- KiviCare
- Fixed in
- 4.5.4
- What to do
- Update KiviCare to 4.5.4 or newer.
Aug 19, 2026Easy Appointments: Does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting userCVE-2026-19406 · WordPress plugins & themes · reported by WPScanLow 2.7
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.
- Product
- Easy Appointments
- Fixed in
- 4.0.1
- What to do
- Update Easy Appointments to 4.0.1 or newer.
Aug 19, 2026ProSolution WP Client: Does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pagesCVE-2026-19056 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.11
- What to do
- Update ProSolution WP Client to 2.0.11 or newer.
Aug 19, 2026ProSolution WP Client: Does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pagesCVE-2026-19055 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.11
- What to do
- Update ProSolution WP Client to 2.0.11 or newer.
Aug 19, 2026Broken Link Checker: Does not limitCVE-2026-18937 · WordPress plugins & themes · reported by WPScanCritical 9
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
- Product
- Broken Link Checker
- Fixed in
- 2.4.12
- What to do
- Update Broken Link Checker to 2.4.12 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18779 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18778 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in one of its AJAX actionsCVE-2026-18777 · WordPress plugins & themes · reported by WPScanMedium 5.3
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026TrueBooker: Does not have proper authorisation checks in some of its AJAX actionsCVE-2026-18776 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
- Product
- TrueBooker
- Fixed in
- 1.2.7
- What to do
- Update TrueBooker to 1.2.7 or newer.
Aug 19, 2026WP Maps: Does not perform a capability checkCVE-2026-18466 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.
- Product
- WP Maps
- Fixed in
- 4.9.8
- What to do
- Update WP Maps to 4.9.8 or newer.
Aug 19, 2026WP Directory Kit: Does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rowsCVE-2026-18231 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.
- Product
- WP Directory Kit
- Fixed in
- 1.5.7
- What to do
- Update WP Directory Kit to 1.5.7 or newer.
Aug 19, 2026JetEngine: Adds SVG to the site-wide list of allowed upload types without sanitising the file contentsCVE-2026-18202 · WordPress plugins & themes · reported by WPScanMedium 6.8
The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.
- Product
- JetEngine
- Fixed in
- 3.8.14
- What to do
- Update JetEngine to 3.8.14 or newer.
Aug 19, 2026W3 Total Cache: Does not properly validate the request path it uses to build cache file namesCVE-2026-18051 · WordPress plugins & themes · reported by WPScanCritical 10
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
- Product
- W3 Total Cache
- Fixed in
- 2.10.5
- What to do
- Update W3 Total Cache to 2.10.5 or newer.
Aug 19, 2026TabaPay Gateway: Does not validate the payment callback before establishing a session for the account associated with the referenced orderCVE-2026-18031 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
- Product
- TabaPay Gateway
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update TabaPay Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Animation Addons for Elementor: Does not validate a user-supplied value before using it to build the host of a server-side HTTP requestCVE-2026-17565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.
- Product
- Animation Addons for Elementor
- Fixed in
- 2.7.2
- What to do
- Update Animation Addons for Elementor to 2.7.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.