Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

24,230 results · page 89 of 485

Jun 26, 2026Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.CVE-2026-57430 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.CVE-2026-57325 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.CVE-2026-57324 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.CVE-2026-57323 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026weDevs weMail wemail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.
Product
weDevs weMail wemail
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update weDevs weMail wemail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.CVE-2026-57321 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.CVE-2026-57319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.CVE-2026-57318 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.CVE-2026-57317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.CVE-2026-57316 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.CVE-2026-57315 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.CVE-2026-57314 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.CVE-2026-57313 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.CVE-2026-57312 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.CVE-2026-56072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.CVE-2026-56070 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.CVE-2026-56069 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.CVE-2026-56068 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.CVE-2026-56067 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.CVE-2026-56066 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber SQL Injection in Tourfic <= 2.22.5 versions.CVE-2026-56064 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Tourfic <= 2.22.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-56063 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.CVE-2026-56062 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.CVE-2026-56061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.CVE-2026-56060 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.CVE-2026-56059 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.CVE-2026-56058 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.CVE-2026-56057 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.CVE-2026-56055 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.CVE-2026-56048 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.CVE-2026-56047 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.CVE-2026-56046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.CVE-2026-56045 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.CVE-2026-56044 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.CVE-2026-56043 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.CVE-2026-56041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.CVE-2026-56040 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.CVE-2026-56039 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.CVE-2026-56038 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.CVE-2026-56036 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.CVE-2026-56035 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.CVE-2026-56034 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.CVE-2026-56033 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.CVE-2026-56032 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.CVE-2026-56031 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.CVE-2026-56030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.CVE-2026-56029 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions.CVE-2026-56028 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions.
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.CVE-2026-56027 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.CVE-2026-56026 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.