Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,714entries in the database

984 results · page 9 of 20

Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.CVE-2026-39548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.
Affected
up to 9.0
What to do
Affects up to 9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.CVE-2025-69177 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.CVE-2025-69139 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions.
Affected
up to 3.7
What to do
Affects up to 3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.CVE-2025-58952 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 16, 2026Abandoned Contact Form 7: Unauthorized arbitrary post deletionCVE-2026-9187 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, which is registered to both the wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks. The handler takes a user-supplied recover_id parameter from $_POST and passes it directly to wp_delete_post() with the force-delete flag set to true, without verifying that the ID belongs to the plugin's own cf7af_data post type. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, or other content on the affected site by sending a single admin-ajax.
Product
Abandoned Contact Form 7
Affected
up to 2.2
What to do
Affects up to 2.2. Update Abandoned Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.CVE-2026-49066 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.
Affected
up to 6.0.0
What to do
Affects up to 6.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.CVE-2026-48965 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.
Affected
up to 4.8.6
What to do
Affects up to 4.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 12, 2026LWS Optimize – All-in-One Speed Booster & Cache Tools: Arbitrary File ReadCVE-2026-12089 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function trusting <link rel="stylesheet" href="..."> values harvested from page HTML and converting same-site URLs to absolute filesystem paths before reading them with file_get_contents()/Minify\CSS::add(), without enforcing that the resolved path stay within ABSPATH or have a .css extension. This makes it possible for authenticated attackers, with Editor-level access and above, to read arbitrary files.
Product
LWS Optimize – All-in-One Speed Booster & Cache Tools
Affected
up to 3.3.19
What to do
Affects up to 3.3.19. Update LWS Optimize – All-in-One Speed Booster & Cache Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2026Store Locator: Does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9060 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).
Product
Store Locator
Fixed in
1.6.6
What to do
Update Store Locator to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com
Jun 5, 2026All-In-One Security (AIOS) – Security and Firewall: Stored Cross-Site ScriptingCVE-2026-8438 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administra
Product
All-In-One Security (AIOS) – Security and Firewall
Affected
up to 5.4.7
What to do
Affects up to 5.4.7. Update All-In-One Security (AIOS) – Security and Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2026WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts thCVE-2019-25742 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execute when administrators view the property for approval, enabling cookie theft and session hijacking.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record fruitfulcode.com themeforest.net
Jun 2, 2026Google Plus One Bottom: Cross-Site Request ForgeryCVE-2026-9723 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.2. This is due to missing or incorrect nonce validation on the googlePlusOneAdmin function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the plusone-lang, plusone-callback, and plusone-url options stored in the database via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Google Plus One Bottom
Affected
up to 0.0.2
What to do
Affects up to 0.0.2. Update Google Plus One Bottom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2026rognone: Reflected Cross-Site ScriptingCVE-2026-1451 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'a' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
rognone
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update rognone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2026rognone: Reflected Cross-Site ScriptingCVE-2026-1450 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
rognone
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update rognone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 29, 2026OTP Login With Phone Number, OTP Verification: Authentication bypassCVE-2026-3655 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared against the victim's stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim's phone number in the same request.
Product
OTP Login With Phone Number, OTP Verification
Affected
up to 1.8.60
What to do
Affects up to 1.8.60. Update OTP Login With Phone Number, OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 25, 2026eMagicOne Store Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2.
Product
eMagicOne Store Manager
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update eMagicOne Store Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 20, 2026All in One SEO: Sensitive Information ExposureCVE-2026-5075 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and including, 4.9.7 due to sensitive internal option data being passed to wp_localize_script() in post editor contexts without effective masking for low-privilege users. This makes it possible for authenticated attackers, with contributor-level access and above, to view configured API/OAuth tokens and license-related values from page source.
Product
All in One SEO
Affected
up to 4.9.7
What to do
Affects up to 4.9.7. Update All in One SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 16, 2026the Brand component that: WordPress Theme Wibar 1.1.8 contains a stored cross-site scriptingCVE-2020-37235 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.
Product
the Brand component that
What to do
Update the Brand component that to the newest version.
Full record and what to do →NVD record demo.themeftc.com themeforest.net
May 15, 2026the FCKeditor component that: WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file uploadCVE-2021-47965 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows attackers to upload dangerous file types without validation. Attackers can upload arbitrary files through the filemanager upload endpoint to achieve remote code execution and complete system compromise.
Product
the FCKeditor component that
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update the FCKeditor component that to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
May 14, 2026WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan: Unauthorized modification of dataCVE-2026-3829 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple_basic_get_requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.
Product
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
Affected
up to 7.8.5.10
What to do
Affects up to 7.8.5.10. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 10, 2026WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploitiCVE-2022-50956 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in the open parameter. Attackers can supply file paths through the open GET parameter in dispatcher.php to include and read sensitive files accessible to the web server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 8, 2026OttoKit: All-in-One Automation Platform: Does not properly sanitize user input before using it in a SQL statementCVE-2026-4935 · WordPress plugins & themes · reported by WPScanHigh 8.6
The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
Product
OttoKit: All-in-One Automation Platform
Fixed in
1.1.23
What to do
Update OttoKit: All-in-One Automation Platform to 1.1.23 or newer.
Full record and what to do →NVD record wpscan.com
May 6, 2026All-in-One WP Migration Unlimited Extension: Missing AuthorizationCVE-2026-5753 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due to the 'Ai1wmve_Schedules_Controller::save' handler for 'admin_post_ai1wm_schedule_event_save' not verifying user capabilities before saving schedule data. This makes it possible for authenticated attackers, with subscriber-level access and above, to create scheduled export jobs and send backup notifications to attacker-controlled email addresses. Because such notifications include the random backup filename, full site backups can subsequently be downloaded from the target site, resulting in sensitive information exposure.
Product
All-in-One WP Migration Unlimited Extension
Affected
up to 2.83
What to do
Affects up to 2.83. Update All-in-One WP Migration Unlimited Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record help.servmask.com wordfence.com
Apr 24, 2026HubSpot All-In-One Marketing - Forms, Popups, Live Chat: Sensitive Information ExposureCVE-2025-11762 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks.
Product
HubSpot All-In-One Marketing - Forms, Popups, Live Chat
Affected
up to 11.3.32
What to do
Affects up to 11.3.32. Update HubSpot All-In-One Marketing - Forms, Popups, Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Apr 16, 2026Email Encoder – Protect Email Addresses and Phone Numbers: Stored Cross-Site ScriptingCVE-2026-2840 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Email Encoder – Protect Email Addresses and Phone Numbers
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update Email Encoder – Protect Email Addresses and Phone Numbers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2026OneSignal – Web Push Notifications: Authorization bypassCVE-2026-3155 · WordPress plugins & themes · reported by WordfenceLow 3.1
The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete OneSignal metadata for arbitrary posts.
Product
OneSignal – Web Push Notifications
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update OneSignal – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 8, 2026The Moneytizer: Missing AuthorizationCVE-2026-39685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Moneytizer: from n/a through <= 10.0.10.
Product
The Moneytizer
Affected
up to 10.0.10
What to do
Affects up to 10.0.10. Update The Moneytizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026TechOne: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39625 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affects TechOne: from n/a through <= 3.0.3.
Product
TechOne
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update TechOne to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026VK All in One Expansion Unit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39483 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidekazu Ishikawa VK All in One Expansion Unit vk-all-in-one-expansion-unit allows Stored XSS.This issue affects VK All in One Expansion Unit: from n/a through <= 9.113.3.
Product
VK All in One Expansion Unit
Affected
up to 9.113.3
What to do
Affects up to 9.113.3. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Abandoned Cart Recovery for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Stored XSS.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.10.
Product
Abandoned Cart Recovery for WooCommerce
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update Abandoned Cart Recovery for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Petitioner: Missing AuthorizationCVE-2026-32514 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anton Voytenko Petitioner petitioner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Petitioner: from n/a through <= 0.7.3.
Product
Petitioner
Affected
up to 0.7.3
What to do
Affects up to 0.7.3. Update Petitioner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WZone: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-27040 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team WZone woozone allows Path Traversal.This issue affects WZone: from n/a through <= 14.0.31.
Product
WZone
Affected
up to 14.0.31
What to do
Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WZone: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27039 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This issue affects WZone: from n/a through <= 14.0.31.
Product
WZone
Affected
up to 14.0.31
What to do
Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Education Zone: Missing AuthorizationCVE-2026-25009 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8.
Product
Education Zone
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Education Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 23, 2026trx_addons: Does not correctly validate file types in one of its AJAX actionCVE-2026-1969 · WordPress plugins & themes · reported by WPScanMedium 5.3
The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448
Product
trx_addons
Fixed in
2.38.5
What to do
Update trx_addons to 2.38.5 or newer.
Full record and what to do →NVD record wpscan.com
Mar 13, 2026Business One Page: Missing AuthorizationCVE-2026-32340 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Business One Page business-one-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business One Page: from n/a through <= 1.3.2.
Product
Business One Page
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Business One Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026immonex Kickstart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-31918 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in immonex immonex Kickstart immonex-kickstart allows Stored XSS.This issue affects immonex Kickstart: from n/a through <= 1.13.0.
Product
immonex Kickstart
Affected
up to 1.13.0
What to do
Affects up to 1.13.0. Update immonex Kickstart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2026divi-booster: Does not have authorization and CSRF checks in one of its fixing functionCVE-2026-2626 · WordPress plugins & themes · reported by WPScanHigh 8.1
The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the use of unserialize() on the data, this could be further exploited when combined with a PHP gadget chain to achieve PHP Object Injection
Product
divi-booster
Fixed in
5.0.2
What to do
Update divi-booster to 5.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Mar 5, 2026Page and Post Clone: SQL InjectionCVE-2026-2893 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to, and including, 6.3. This is due to insufficient escaping on the user-supplied meta_key value and insufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious payload is stored as a post meta key and executed when the post is cloned.
Product
Page and Post Clone
Affected
up to 6.3
What to do
Affects up to 6.3. Update Page and Post Clone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Welldone: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28118 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Welldone welldone allows PHP Local File Inclusion.This issue affects Welldone: from n/a through <= 2.4.
Product
Welldone
Affected
up to 2.4
What to do
Affects up to 2.4. Update Welldone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026AllInOne - Banner Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28112 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows Reflected XSS.This issue affects AllInOne - Banner Rotator: from n/a through <= 3.8.
Product
AllInOne - Banner Rotator
Affected
up to 3.8
What to do
Affects up to 3.8. Update AllInOne - Banner Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026LambertGroup - AllInOne - Banner with Playlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28110 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.
Product
LambertGroup - AllInOne - Banner with Playlist
Affected
up to 3.8
What to do
Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026LambertGroup - AllInOne - Content Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28109 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Reflected XSS.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.
Product
LambertGroup - AllInOne - Content Slider
Affected
up to 3.8
What to do
Affects up to 3.8. Update LambertGroup - AllInOne - Content Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026LambertGroup - AllInOne - Banner with Thumbnails: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28108 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Reflected XSS.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.
Product
LambertGroup - AllInOne - Banner with Thumbnails
Affected
up to 3.8
What to do
Affects up to 3.8. Update LambertGroup - AllInOne - Banner with Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Gamezone: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28090 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Gamezone gamezone allows PHP Local File Inclusion.This issue affects Gamezone: from n/a through <= 1.1.11.
Product
Gamezone
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update Gamezone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Legal Stone: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28054 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Legal Stone legal-stone allows PHP Local File Inclusion.This issue affects Legal Stone: from n/a through <= 1.2.11.
Product
Legal Stone
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update Legal Stone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026MoneyFlow: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28028 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX MoneyFlow moneyflow allows PHP Local File Inclusion.This issue affects MoneyFlow: from n/a through <= 1.0.
Product
MoneyFlow
Affected
up to 1.0
What to do
Affects up to 1.0. Update MoneyFlow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026DroneX: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28009 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX DroneX dronex allows PHP Local File Inclusion.This issue affects DroneX: from n/a through <= 1.1.12.
Product
DroneX
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update DroneX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Buzz Stone | Magazine & Viral Blog: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27339 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Buzz Stone | Magazine & Viral Blog WordPress Theme buzzstone allows PHP Local File Inclusion.This issue affects Buzz Stone | Magazine & Viral Blog WordPress Theme: from n/a through <= 1.0.2.
Product
Buzz Stone | Magazine & Viral Blog
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Buzz Stone | Magazine & Viral Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Car Zone: Deserialization of Untrusted DataCVE-2026-27338 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
Product
Car Zone
Affected
up to 3.7
What to do
Affects up to 3.7. Update Car Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.