Updated 21 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

549new WordPress flaws this week

391,964entries in the database

40,758 results · page 85 of 816

Aug 18, 2026PublishPress Series: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27365 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.
Product
PublishPress Series
Affected
up to 2.17.0
What to do
Affects up to 2.17.0. Update PublishPress Series to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Draft List: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66603 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4.
Product
Draft List
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Draft List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026HashBar – WordPress Notification Bar: Cross-Site Request Forgery (CSRF)CVE-2026-66602 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.
Product
HashBar – WordPress Notification Bar
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated SQL Injection in Readabler < 2.0.18 versions.CVE-2026-74015 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026TaxoPress: Deserialization of Untrusted DataCVE-2026-74012 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0.
Product
TaxoPress
Affected
up to 3.51.0
What to do
Affects up to 3.51.0. Update TaxoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.CVE-2026-74009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
Affected
up to 4.8.7
What to do
Affects up to 4.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Shortcodes and extra features for Phlox: Insertion of Sensitive Information Into Sent DataCVE-2026-74008 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.
Product
Shortcodes and extra features for Phlox
Affected
up to 2.17.24
What to do
Affects up to 2.17.24. Update Shortcodes and extra features for Phlox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.CVE-2026-74007 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.
Affected
up to 1.16.20
What to do
Affects up to 1.16.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.CVE-2026-74006 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.CVE-2026-74004 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.
Affected
up to 6.0
What to do
Affects up to 6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.CVE-2026-74003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.CVE-2026-73997 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.CVE-2026-73996 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Subscriber Broken Authentication in User Registration <= 5.2.6 versions.CVE-2026-73995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Authentication in User Registration <= 5.2.6 versions.
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.CVE-2026-73994 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
Affected
up to 1.8.11.3
What to do
Affects up to 1.8.11.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.CVE-2026-73404 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
Affected
up to 3.7.41
What to do
Affects up to 3.7.41. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.CVE-2026-73400 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
Affected
up to 2.4.11
What to do
Affects up to 2.4.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.CVE-2026-73399 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.CVE-2026-73398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.CVE-2026-73397 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.CVE-2026-73396 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.CVE-2026-73395 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.
Affected
up to 3.2.36
What to do
Affects up to 3.2.36. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.CVE-2026-73393 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.
Affected
up to 10.46
What to do
Affects up to 10.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.CVE-2026-73383 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
Affected
up to 6.6.47
What to do
Affects up to 6.6.47. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Site Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-73382 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.
Product
Site Reviews
Affected
up to 8.2.0
What to do
Affects up to 8.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73381 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
Affected
up to 1.13.0
What to do
Affects up to 1.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
Affected
up to 1.13.0
What to do
Affects up to 1.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-73379 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.CVE-2026-73378 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73377 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73376 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73375 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.CVE-2026-73367 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.CVE-2026-73366 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
Affected
up to 1.13.0
What to do
Affects up to 1.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.CVE-2026-73365 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.CVE-2026-73362 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.CVE-2026-73361 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
Affected
up to 3.4.18
What to do
Affects up to 3.4.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.CVE-2026-73360 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
Affected
up to 3.5.8
What to do
Affects up to 3.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.CVE-2026-73359 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
Affected
up to 4.3.9
What to do
Affects up to 4.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.CVE-2026-73358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
Affected
up to 2.9.53
What to do
Affects up to 2.9.53. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.CVE-2026-73356 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
Affected
up to 2.5.12
What to do
Affects up to 2.5.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.CVE-2026-73355 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
Affected
up to 2.9.53
What to do
Affects up to 2.9.53. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.CVE-2026-73352 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
Affected
up to 4.16.5.1
What to do
Affects up to 4.16.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.CVE-2026-73351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
Affected
up to 7.8.1
What to do
Affects up to 7.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.CVE-2026-73350 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73348 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.CVE-2026-73345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
Affected
up to 3.0.18
What to do
Affects up to 3.0.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.CVE-2026-73343 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.CVE-2026-73342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
Affected
up to 2.4.31
What to do
Affects up to 2.4.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.CVE-2026-73341 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
Affected
up to 6.0.9.7
What to do
Affects up to 6.0.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.