Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,246 results · page 95 of 485
Jun 17, 2026Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.CVE-2026-42380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.CVE-2026-41557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.CVE-2026-40783 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.
- Affected
- up to 2.1.37
- What to do
- Affects up to 2.1.37. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.CVE-2026-40768 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.
- Affected
- up to 10.30.24
- What to do
- Affects up to 10.30.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.CVE-2026-40765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.CVE-2026-40761 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Behold <= 1.5 versions.CVE-2026-40760 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Behold <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.CVE-2026-40759 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.CVE-2026-40758 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.CVE-2026-40755 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.CVE-2026-40754 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.CVE-2026-40753 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.CVE-2026-40751 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.CVE-2026-40749 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.CVE-2026-40748 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.
- Affected
- up to 0.5.4
- What to do
- Affects up to 0.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.CVE-2026-40747 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.
- Affected
- up to 0.9.7
- What to do
- Affects up to 0.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.CVE-2026-40746 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.
- Affected
- up to 0.7.8
- What to do
- Affects up to 0.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.CVE-2026-40739 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.CVE-2026-40736 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Reina <= 2.1 versions.CVE-2026-40735 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Reina <= 2.1 versions.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.CVE-2026-40731 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.CVE-2026-40726 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.
- Affected
- up to 1.3.14
- What to do
- Affects up to 1.3.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.CVE-2026-40725 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.CVE-2026-40724 · WordPress plugins & themes · reported by PatchstackMedium 6.5
CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions.
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.CVE-2026-40723 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Yoast SEO Premium: Missing AuthorizationCVE-2026-40722 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6.
- Product
- Yoast SEO Premium
- Affected
- up to 26.6
- What to do
- Affects up to 26.6. Update Yoast SEO Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.CVE-2026-40721 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.
- Affected
- up to 9.0.6
- What to do
- Affects up to 9.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.CVE-2026-39597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.CVE-2026-39596 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.CVE-2026-39595 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.CVE-2026-39589 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.
- Affected
- up to 0.0.6
- What to do
- Affects up to 0.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.CVE-2026-39582 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.CVE-2026-39580 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.CVE-2026-39578 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.CVE-2026-39577 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.CVE-2026-39573 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Mr.CVE-2026-39568 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.CVE-2026-39567 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.CVE-2026-39558 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.CVE-2026-39557 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.CVE-2026-39554 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.CVE-2026-39549 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.CVE-2026-39548 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MagOne <= 9.0 versions.
- Affected
- up to 9.0
- What to do
- Affects up to 9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Getaway < 1.8 versions.CVE-2026-39547 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Getaway < 1.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.CVE-2026-39546 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.
- Affected
- up to 4.2.15
- What to do
- Affects up to 4.2.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.CVE-2026-39545 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.CVE-2026-39539 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.CVE-2026-39537 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.CVE-2026-39529 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Solene <= 3.4 versions.CVE-2026-39522 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Solene <= 3.4 versions.
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.