Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,758 results · page 93 of 816
Aug 10, 2026Login & Register Forms: Does not verify that a password reset request comes from the account's ownerCVE-2026-18470 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 10, 2026Login & Register Forms: Does not enforce its password reset attempt limit against a server-derived valueCVE-2026-18469 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 10, 2026Login & Register Forms: Does not bind the password reset verification state to the account being reset or to the party that completed the verificationCVE-2026-18468 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 10, 2026FoodBoxBooker: Does not verify that the user account being updated belongs to the user making the requestCVE-2026-18200 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators.
- Product
- FoodBoxBooker
- Fixed in
- 1.0.8
- What to do
- Update FoodBoxBooker to 1.0.8 or newer.
Aug 10, 2026BricksForge: Does not verify the identity of the requesterCVE-2026-18030 · WordPress plugins & themes · reported by WPScanHigh 8.1
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their account. Exploitation requires the site to have a form using the BricksForge WordPress plugin before 3.1.8.8's password reset action in its update mode. The server-side current-password verification option for that action is disabled by default, so the vulnerable state is the default one once the action is used.
- Product
- BricksForge
- Fixed in
- 3.1.8.8
- What to do
- Update BricksForge to 3.1.8.8 or newer.
Aug 10, 2026File Manager: Does not perform any capability check on one of its file manager connector endpointsCVE-2026-17542 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
- Product
- File Manager
- Fixed in
- 6.9.1
- What to do
- Update File Manager to 6.9.1 or newer.
Aug 10, 2026File Manager: Does not have authorisation checks on one of its REST API routesCVE-2026-17541 · WordPress plugins & themes · reported by WPScanHigh 7.5
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
- Product
- File Manager
- Fixed in
- 6.9.1
- What to do
- Update File Manager to 6.9.1 or newer.
Aug 10, 2026File Manager: Does not properly authorise its file management commandsCVE-2026-17540 · WordPress plugins & themes · reported by WPScanHigh 8.8
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.
- Product
- File Manager
- Fixed in
- 6.9.1
- What to do
- Update File Manager to 6.9.1 or newer.
Aug 10, 2026Salon Booking System: Does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callbackCVE-2026-17023 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
- Product
- Salon Booking System
- Affected
- up to 10.30.33
- What to do
- Affects up to 10.30.33. Update Salon Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026Salon Booking System: Does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation stepsCVE-2026-17022 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
- Product
- Salon Booking System
- Fixed in
- 10.30.34
- What to do
- Update Salon Booking System to 10.30.34 or newer.
Aug 10, 2026Salon Booking System: Does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted bookingCVE-2026-17021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
- Product
- Salon Booking System
- Fixed in
- 10.30.34
- What to do
- Update Salon Booking System to 10.30.34 or newer.
Aug 10, 2026Salon Booking System: Does not verify that a requested booking belongs to the caller on one of its REST API endpointsCVE-2026-17020 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user (including a Subscriber or self-registered customer account) to disclose any customer's booking personal data such as name, email, phone number, address and private notes by enumerating booking identifiers.
- Product
- Salon Booking System
- Affected
- up to 10.31.0
- What to do
- Affects up to 10.31.0. Update Salon Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026JetEngine: Does not sanitise uploaded SVG files before storing and serving themCVE-2026-17019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting).
- Product
- JetEngine
- Fixed in
- 3.8.13.1
- What to do
- Update JetEngine to 3.8.13.1 or newer.
Aug 10, 2026CubeWP Framework: Does not perform a per-object read authorization checkCVE-2026-17018 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
- Product
- CubeWP Framework
- Affected
- up to 1.1.30
- What to do
- Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026Accept PayPal & Stripe with Subscriptions for WooCommerce: Does not validate the amount actually paid against the order total in its PayPal Data Transfer return handlerCVE-2026-17016 · WordPress plugins & themes · reported by WPScanLow 3.7
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled.
- Product
- Accept PayPal & Stripe with Subscriptions for WooCommerce
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Accept PayPal & Stripe with Subscriptions for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026Accept PayPal & Stripe with Subscriptions for WooCommerce: Does not verify that the PayPal accountCVE-2026-17012 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's.
- Product
- Accept PayPal & Stripe with Subscriptions for WooCommerce
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Accept PayPal & Stripe with Subscriptions for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026Saitama Addon Pack: Does not sanitise and escape certain post metadata values before outputting themCVE-2026-17010 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
- Product
- Saitama Addon Pack
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Saitama Addon Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026Squeeze: Does not validate the file type or extension of the per-size image data written by one of its attachment-update actionsCVE-2026-16985 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.
- Product
- Squeeze
- Fixed in
- 1.7.12
- What to do
- Update Squeeze to 1.7.12 or newer.
Aug 10, 2026Term Pages: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-16949 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Term Pages
- Fixed in
- 2.0.0
- What to do
- Update Term Pages to 2.0.0 or newer.
Aug 10, 2026Single Sign On For TNG: Does not properly validate a password reset requestCVE-2026-16299 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
- Product
- Single Sign On For TNG
- Fixed in
- 2.2.0
- What to do
- Update Single Sign On For TNG to 2.2.0 or newer.
Aug 10, 2026FoodBoxBooker: Does not properly validate the password reset requestCVE-2026-16298 · WordPress plugins & themes · reported by WPScanCritical 9.8
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
- Product
- FoodBoxBooker
- Fixed in
- 1.0.7
- What to do
- Update FoodBoxBooker to 1.0.7 or newer.
Aug 10, 2026Arvow AI SEO Writer: Does not properly restrict access to one of its REST endpointsCVE-2026-16257 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can be bypassed by unauthenticated users through type juggling when the Arvow AI SEO Writer WordPress plugin before 1.5.4 has not been configured, allowing them to create arbitrary posts and pages and to disclose author account and taxonomy information.
- Product
- Arvow AI SEO Writer
- Fixed in
- 1.5.4
- What to do
- Update Arvow AI SEO Writer to 1.5.4 or newer.
Aug 10, 2026MotoPress Hotel Booking: Does not verify record ownership before updating customer recordsCVE-2026-15238 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
- Product
- MotoPress Hotel Booking
- Fixed in
- 6.2.3
- What to do
- Update MotoPress Hotel Booking to 6.2.3 or newer.
Aug 10, 2026MotoPress Hotel Booking: Does not perform any authorization or ownership check on a REST endpoint that creates payment recordsCVE-2026-15237 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
- Product
- MotoPress Hotel Booking
- Fixed in
- 6.2.3
- What to do
- Update MotoPress Hotel Booking to 6.2.3 or newer.
Aug 10, 2026Pinpoint Booking System: Does not validate the booking price on the server sideCVE-2026-15229 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.
- Product
- Pinpoint Booking System
- Affected
- up to 2.9.9.7.1
- What to do
- Affects up to 2.9.9.7.1. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 10, 2026s2Member: Does not escape several shortcode attributes before outputting them inside an inline script contextCVE-2026-15047 · WordPress plugins & themes · reported by WPScanMedium 6.8
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
- Product
- s2Member
- Fixed in
- 260805
- What to do
- Update s2Member to 260805 or newer.
Aug 10, 2026Customer Reviews for WooCommerce: Does not perform nonce or capability checks on several settings-related AJAX actionsCVE-2026-14941 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
- Product
- Customer Reviews for WooCommerce
- Fixed in
- 5.116.0
- What to do
- Update Customer Reviews for WooCommerce to 5.116.0 or newer.
Aug 10, 2026Podcast Player: Does not validate the destination of a server-side request built from user-supplied inputCVE-2026-14860 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
- Product
- Podcast Player
- Fixed in
- 8.3.1
- What to do
- Update Podcast Player to 8.3.1 or newer.
Aug 10, 2026Autopay: Does not perform any capability or nonce check before saving a styling option from a public requestCVE-2026-14293 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page.
- Product
- Autopay
- Fixed in
- 5.0.1
- What to do
- Update Autopay to 5.0.1 or newer.
Aug 10, 2026vitepos: Does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpointsCVE-2026-14238 · WordPress plugins & themes · reported by WPScanMedium 4.1
The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
- Product
- vitepos
- Fixed in
- 3.6.0
- What to do
- Update vitepos to 3.6.0 or newer.
Aug 10, 2026vitepos WordPress plugin before 3.6.0, Vitepos: Do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability bCVE-2026-14237 · WordPress plugins & themes · reported by WPScanHigh 7.2
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
- Product
- vitepos WordPress plugin before 3.6.0, Vitepos
- Fixed in
- 3.6.0
- What to do
- Update vitepos WordPress plugin before 3.6.0, Vitepos to 3.6.0 or newer.
Aug 10, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) is related to the customer whose record is being accessedCVE-2026-14211 · WordPress plugins & themes · reported by WPScanLow 3.8
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any customer by enumerating sequential identifiers.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.7
- What to do
- Update Booking for Appointments and Events Calendar to 9.7 or newer.
Aug 10, 2026HT Contact Form: Does not perform any authorization check on the endpoint that returns a saved form draftCVE-2026-14206 · WordPress plugins & themes · reported by WPScanHigh 7.5
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
- Product
- HT Contact Form
- Fixed in
- 2.9.3
- What to do
- Update HT Contact Form to 2.9.3 or newer.
Aug 10, 2026Advanced Excerpt: Does not sanitise and escape one of its settings before outputting it on the front end of the siteCVE-2026-13701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
- Product
- Advanced Excerpt
- Fixed in
- 4.5
- What to do
- Update Advanced Excerpt to 4.5 or newer.
Aug 10, 2026AutoNetTV Relay: Does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization taskCVE-2026-13600 · WordPress plugins & themes · reported by WPScanHigh 8.1
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
- Product
- AutoNetTV Relay
- Fixed in
- 3.0.14
- What to do
- Update AutoNetTV Relay to 3.0.14 or newer.
Aug 10, 2026Eventin: Does not properly validate a template path setting before using it to include a local fileCVE-2026-13170 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
- Product
- Eventin
- Fixed in
- 4.1.20
- What to do
- Update Eventin to 4.1.20 or newer.
Aug 10, 2026LearnPress: Does not validate a user-supplied URL before the server fetches itCVE-2026-12971 · WordPress plugins & themes · reported by WPScanLow 2.2
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.
- Product
- LearnPress
- Fixed in
- 4.4.4
- What to do
- Update LearnPress to 4.4.4 or newer.
Aug 9, 2026PiWeb Cancel order / Refund request for WooCommerce: Does not have authorization or ownership checksCVE-2026-18603 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clear and repopulate a logged in user's cart via a crafted link.
- Product
- PiWeb Cancel order / Refund request for WooCommerce
- Fixed in
- 1.3.4.34
- What to do
- Update PiWeb Cancel order / Refund request for WooCommerce to 1.3.4.34 or newer.
Aug 9, 2026WP Directory Kit: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-18473 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 9, 2026WP MAPS PRO: Does not perform a capability check in one of its AJAX actionsCVE-2026-18465 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.
- Product
- WP MAPS PRO
- Fixed in
- 6.1.3
- What to do
- Update WP MAPS PRO to 6.1.3 or newer.
Aug 9, 2026WP MAPS PRO: Does not perform a capability check in one of its AJAX actionsCVE-2026-18464 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not restrict the operation it dispatches, allowing unauthenticated attackers to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
- Product
- WP MAPS PRO
- Fixed in
- 6.1.3
- What to do
- Update WP MAPS PRO to 6.1.3 or newer.
Aug 9, 2026WPC Order Tip for WooCommerce: Does not perform authorisation or nonce checks in one of its reporting featuresCVE-2026-18357 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates.
- Product
- WPC Order Tip for WooCommerce
- Fixed in
- 3.3.1
- What to do
- Update WPC Order Tip for WooCommerce to 3.3.1 or newer.
Aug 9, 2026Create: Does not perform an authorization check before rendering content over one of its public REST API routesCVE-2026-18037 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.
- Product
- Create
- Fixed in
- 2.5.4
- What to do
- Update Create to 2.5.4 or newer.
Aug 9, 2026WP Data Access: Does not validate the column names it accepts on one of its unauthenticated AJAX actionsCVE-2026-18032 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected front-end form is bound to, including user password hashes where that table is the users table.
- Product
- WP Data Access
- Fixed in
- 5.5.79
- What to do
- Update WP Data Access to 5.5.79 or newer.
Aug 9, 2026Iptanus File Upload: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-17044 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users.
- Product
- Iptanus File Upload
- Fixed in
- 5.1.8
- What to do
- Update Iptanus File Upload to 5.1.8 or newer.
Aug 9, 2026CubeWP Framework: Does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX actionCVE-2026-17017 · WordPress plugins & themes · reported by WPScanHigh 8.1
The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.
- Product
- CubeWP Framework
- Fixed in
- 1.1.31
- What to do
- Update CubeWP Framework to 1.1.31 or newer.
Aug 9, 2026WP Photo Album Plus: Does not perform any capability or nonce check on one of its public REST endpoint actionsCVE-2026-17014 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores.
- Product
- WP Photo Album Plus
- Fixed in
- 9.2.07.002
- What to do
- Update WP Photo Album Plus to 9.2.07.002 or newer.
Aug 9, 2026Nexter Blocks: Does not restrict who can save global CSS through one of its REST endpointsCVE-2026-17011 · WordPress plugins & themes · reported by WPScanLow 3.8
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
- Product
- Nexter Blocks
- Fixed in
- 5.0.2
- What to do
- Update Nexter Blocks to 5.0.2 or newer.
Aug 9, 2026Create: Does not perform an authorization check before returning content over one of its REST API routesCVE-2026-16992 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.
- Product
- Create
- Fixed in
- 2.5.4
- What to do
- Update Create to 2.5.4 or newer.
Aug 9, 2026GeoDirectory: Does not perform any authorization checkCVE-2026-16988 · WordPress plugins & themes · reported by WPScanHigh 7.5
The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.
- Product
- GeoDirectory
- Fixed in
- 2.8.169
- What to do
- Update GeoDirectory to 2.8.169 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.