Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

40,758 results · page 94 of 816

Aug 9, 2026Solace Extra: Does not perform capability or nonce checks in one of its AJAX actionsCVE-2026-16965 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.
Product
Solace Extra
Fixed in
1.6.1
What to do
Update Solace Extra to 1.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026Slim SEO: Does not restrict a post-meta preview feature to posts the user is allowed to editCVE-2026-16957 · WordPress plugins & themes · reported by WPScanLow 2.7
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types.
Product
Slim SEO
Fixed in
4.9.11
What to do
Update Slim SEO to 4.9.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026LWS Optimize: Does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboardCVE-2026-16032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
Product
LWS Optimize
Fixed in
4.1.2
What to do
Update LWS Optimize to 4.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026InfiniteWP Client: Does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installationsCVE-2026-15038 · WordPress plugins & themes · reported by WPScanCritical 9.8
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
Product
InfiniteWP Client
Fixed in
1.13.6
What to do
Update InfiniteWP Client to 1.13.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026AI Engine: Does not confine a caller-supplied file path before reading it and forwarding the contents to an external serviceCVE-2026-16955 · WordPress plugins & themes · reported by WPScanMedium 5
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
Product
AI Engine
Fixed in
3.6.6
What to do
Update AI Engine to 3.6.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026AI Engine: Does not verify ownership of a guest's uploaded chatbot files before deletionCVE-2026-16953 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a client-supplied session cookie value, so an unauthenticated attacker who obtains a victim's session identifier and file reference can delete that victim's uploaded files.
Product
AI Engine
Fixed in
3.6.4
What to do
Update AI Engine to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Solace Extra: Does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged usersCVE-2026-16948 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
Product
Solace Extra
Fixed in
1.6.1
What to do
Update Solace Extra to 1.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Download Monitor: Does not perform authorization checks on one of its download-logging AJAX actionsCVE-2026-16608 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Product
Download Monitor
Fixed in
5.2.6
What to do
Update Download Monitor to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16595 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16594 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16590 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Directory Kit: Does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-16589 · WordPress plugins & themes · reported by WPScanHigh 7.7
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
Product
WP Directory Kit
Fixed in
1.5.5
What to do
Update WP Directory Kit to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection: Does not perform any capability check on one of its REST API endpointsCVE-2026-16578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
Product
Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
Fixed in
1.4.0
What to do
Update Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: Does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpointsCVE-2026-16574 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.
Product
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
Fixed in
5.0.11
What to do
Update Dokan: AI Powered WooCommerce Multivendor Marketplace Solution to 5.0.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026WP Statistics: Does not perform a capability check on a set of dashboard analytics AJAX handlersCVE-2026-16562 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
Product
WP Statistics
Fixed in
14.16.10
What to do
Update WP Statistics to 14.16.10 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026YMC Filter: Does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged usersCVE-2026-16559 · WordPress plugins & themes · reported by WPScanMedium 6.8
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
Product
YMC Filter
Fixed in
3.12.9
What to do
Update YMC Filter to 3.12.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026YMC Filter: Does not sanitize and escape a layout builder setting before outputting it on a public endpointCVE-2026-16558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
Product
YMC Filter
Fixed in
3.12.8
What to do
Update YMC Filter to 3.12.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Link Library: Does not sanitise and escape a parameter before reflecting it back in a responseCVE-2026-16535 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action.
Product
Link Library
Fixed in
7.9.4
What to do
Update Link Library to 7.9.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Appointment Hour Booking: Does not validate a client-supplied booking price against the server-side configured service priceCVE-2026-16282 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.
Product
Appointment Hour Booking
Fixed in
1.5.88
What to do
Update Appointment Hour Booking to 1.5.88 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Newsletters: Does not strictly compare its API authentication keyCVE-2026-16269 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.
Product
Newsletters
Fixed in
4.16
What to do
Update Newsletters to 4.16 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Newsletters: Does not restrict the classes allowedCVE-2026-16267 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.
Product
Newsletters
Fixed in
4.16
What to do
Update Newsletters to 4.16 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026AI Copilot – Content Generator: Authorization bypassCVE-2026-14526 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create a new administrator-level user account and achieve full site takeover by saving and executing a malicious workflow containing a wp_create_user action node specifying role=administrator. This vulnerability is exploitable by unauthenticated attackers on any site where the [aiwu-form] shortcode or public chatbot is rendered on a frontend page, as the waic-nonce value is emitted into publicly accessible JavaScript (WAIC_DATA.waicNonce) on those pages, rendering the nonce check a non-functional authorization barrier.
Product
AI Copilot – Content Generator
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update AI Copilot – Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 8, 2026Easy Accordion: Stored Cross-Site ScriptingCVE-2026-18988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Accordion
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Easy Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 7, 2026WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.CVE-2026-64638 · WordPress plugins & themes · reported by support@hackerone.comHigh 8.9
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record hackerone.com wordpress.org
Aug 7, 2026The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post contentCVE-2026-48093 · WordPress plugins & themes · reported by GitHubMedium 6.5
The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Aug 7, 2026The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping CVE-2026-48094 · WordPress plugins & themes · reported by GitHubMedium 5.3
The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp->request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin's sharing link is displayed. WordPress's security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `"`, `<`, `>` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Aug 7, 2026Simple CAPTCHA with Cloudflare Turnstile: Does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integrationCVE-2026-15239 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
Product
Simple CAPTCHA with Cloudflare Turnstile
Fixed in
1.42.0
What to do
Update Simple CAPTCHA with Cloudflare Turnstile to 1.42.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscriptions for WooCommerce: Does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the orCVE-2026-15211 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
Product
Subscriptions for WooCommerce
Fixed in
2.0.1
What to do
Update Subscriptions for WooCommerce to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026WP Events Manager: Does not verify that an incoming payment notification originates from the site's configured merchant accountCVE-2026-15148 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings.
Product
WP Events Manager
Fixed in
2.2.5
What to do
Update WP Events Manager to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026WP Maps: Does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatchesCVE-2026-16265 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it dispatches, allowing users with a Subscriber account to trigger uncontrolled recursion that exhausts server resources, resulting in a Denial of Service.
Product
WP Maps
Fixed in
4.9.7
What to do
Update WP Maps to 4.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026WP Maps: Does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusionCVE-2026-16263 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.
Product
WP Maps
Fixed in
4.9.7
What to do
Update WP Maps to 4.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Estatik Real Estate: Does not bind its OAuth social login flow to the initiating user sessionCVE-2026-16262 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.
Product
Estatik Real Estate
Fixed in
4.3.3
What to do
Update Estatik Real Estate to 4.3.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Ajax Search Lite: Does not prevent the deserialization of untrusted inputCVE-2026-16258 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.
Product
Ajax Search Lite
Fixed in
4.14.5
What to do
Update Ajax Search Lite to 4.14.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026MStore API: Does not perform authorization or purchase-ownership checks on its REST product-review creation routeCVE-2026-16041 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Product
MStore API
Fixed in
4.21.0
What to do
Update MStore API to 4.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026MStore API: Does not restrict its vendor-orders endpoint to the caller's own ordersCVE-2026-16039 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
Product
MStore API
Fixed in
4.21.0
What to do
Update MStore API to 4.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026MStore API: Does not verify the payment with the payment gateway before marking an orderCVE-2026-16038 · WordPress plugins & themes · reported by WPScanCritical 9.1
The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.
Product
MStore API
Fixed in
4.21.0
What to do
Update MStore API to 4.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026MStore API: Does not correctly verify the cryptographic signature of the token used to authenticate its phone-based loginCVE-2026-16030 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Product
MStore API
Fixed in
4.21.0
What to do
Update MStore API to 4.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Meow Gallery: Does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleriesCVE-2026-15386 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor (including administrators) who views a post containing such a gallery.
Product
Meow Gallery
Fixed in
5.5.2
What to do
Update Meow Gallery to 5.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Content Views: Does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL queryCVE-2026-15361 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
Product
Content Views
Fixed in
4.5
What to do
Update Content Views to 4.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Templately: Does not have an authorisation check on one of its request handlersCVE-2026-15359 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site's cloud template library to attacker-controlled content.
Product
Templately
Fixed in
3.7.1
What to do
Update Templately to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026BNE Testimonials: Does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline scriptCVE-2026-15245 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.
Product
BNE Testimonials
Fixed in
2.0.8.2
What to do
Update BNE Testimonials to 2.0.8.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscriptions for WooCommerce: Does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2CVE-2026-15215 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.
Product
Subscriptions for WooCommerce
Fixed in
2.0.1
What to do
Update Subscriptions for WooCommerce to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscriptions for WooCommerce: Does not verify that the requester owns the subscription being viewed before rendering its detailsCVE-2026-15214 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
Product
Subscriptions for WooCommerce
Fixed in
2.0.1
What to do
Update Subscriptions for WooCommerce to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Comments: Does not properly escape a user-supplied URL before outputting it inside an HTML attributeCVE-2026-15032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
Product
Comments
Fixed in
7.6.60
What to do
Update Comments to 7.6.60 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content: Does not restrict REST API access to authenticated usersCVE-2026-14943 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8.
Product
Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content
Fixed in
2.8.4
What to do
Update Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content to 2.8.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscribe2: Does not properly escape a user-supplied value before reflecting it into a public subscription formCVE-2026-14331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
Product
Subscribe2
Fixed in
10.46
What to do
Update Subscribe2 to 10.46 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026WP Events Manager: Does not validate the requested quantityCVE-2026-14205 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.
Product
WP Events Manager
Fixed in
2.2.5
What to do
Update WP Events Manager to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026TrueBooker – Appointment Booking and Scheduler System: Authorization bypassCVE-2026-14365 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to change the password of arbitrary user accounts, including administrators, which can be leveraged to gain access to those accounts.
Product
TrueBooker – Appointment Booking and Scheduler System
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update TrueBooker – Appointment Booking and Scheduler System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 7, 2026TrueBooker – Appointment Booking and Scheduler System: Account takeoverCVE-2026-14364 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.
Product
TrueBooker – Appointment Booking and Scheduler System
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update TrueBooker – Appointment Booking and Scheduler System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 7, 2026Ultra Addons for Contact Form 7: Stored Cross-Site ScriptingCVE-2026-12801 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultra Addons for Contact Form 7
Affected
up to 3.5.43
What to do
Affects up to 3.5.43. Update Ultra Addons for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.