Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

22 results

Oct 10, 2026Bayarcash WooCommerce: Missing AuthorizationCVE-2026-106609 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
Product
Bayarcash WooCommerce
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Bayarcash WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 25, 2026Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more: Privilege EscalationCVE-2026-89426 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.
Product
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
Affected
up to 9.6.1.0
What to do
Affects up to 9.6.1.0. Update Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Word 2 Cash: Cross-Site Request Forgery leading to Stored Cross-Site ScriptingCVE-2026-6395 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2. This is due to the complete absence of nonce verification on the settings save handler in the w2c_admin() function, combined with missing input sanitization before storage and missing output escaping when rendering the stored value. The w2c-definitions POST parameter is saved raw via update_option() and later echoed without escaping inside a <textarea> element. This makes it possible for unauthenticated attackers to forge a request on behalf of a logged-in administrator, storing arbitrary JavaScript payloads that execute in the WordPress admin panel whenever the settings page is visited.
Product
Word 2 Cash
Affected
up to 0.9.2
What to do
Affects up to 0.9.2. Update Word 2 Cash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026PopCash.Net Code Integration Tool: Missing AuthorizationCVE-2026-24619 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PopCash PopCash.Net Code Integration Tool popcashnet-code-integration-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PopCash.Net Code Integration Tool: from n/a through <= 1.8.
Product
PopCash.Net Code Integration Tool
Affected
up to 1.8
What to do
Affects up to 1.8. Update PopCash.Net Code Integration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2026Bayarcash WooCommerce: Missing AuthorizationCVE-2026-24606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.
Product
Bayarcash WooCommerce
Affected
up to 4.3.13
What to do
Affects up to 4.3.13. Update Bayarcash WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 14, 2026Netcash WooCommerce Payment Gateway: Unauthorized modification of dataCVE-2025-14880 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_return_url function in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to mark any WooCommerce order as processing/completed.
Product
Netcash WooCommerce Payment Gateway
Affected
up to 4.1.3
What to do
Affects up to 4.1.3. Update Netcash WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025Get Cash: Missing AuthorizationCVE-2025-49041 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in The African Boss Get Cash get-cash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Get Cash: from n/a through <= 3.2.3.
Product
Get Cash
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Get Cash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Goracash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53458 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davaxi Goracash goracash allows Stored XSS.This issue affects Goracash: from n/a through <= 1.1.
Product
Goracash
Affected
up to 1.1
What to do
Affects up to 1.1. Update Goracash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025CashBill.pl – Płatności WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53455 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CashBill CashBill.pl – Płatności WooCommerce cashbill-payment-method allows Stored XSS.This issue affects CashBill.pl – Płatności WooCommerce: from n/a through <= 3.2.1.
Product
CashBill.pl – Płatności WooCommerce
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update CashBill.pl – Płatności WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 5, 2025Get Cash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58823 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The African Boss Get Cash get-cash allows Stored XSS.This issue affects Get Cash: from n/a through <= 3.2.3.
Product
Get Cash
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Get Cash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 28, 2025Risk Free Cash On Delivery (COD) – WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48358 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommerce risk-free-cash-on-delivery-cod-woocommerce allows Stored XSS.This issue affects Risk Free Cash On Delivery (COD) – WooCommerce: from n/a through <= 1.0.4.
Product
Risk Free Cash On Delivery (COD) – WooCommerce
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Risk Free Cash On Delivery (COD) – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 4, 2025Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction: Unauthorized access to functionalityCVE-2024-13724 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their own wallet balance, transfer balances between arbitrary users and initiate transfer requests from other users' wallets.
Product
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 4, 2025Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction: Cross-Site Request ForgeryCVE-2024-13682 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in class-wallet-user-table.php. This makes it possible for unauthenticated attackers to modify wallet balances via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 6, 2024The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce creditCVE-2024-11201 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_send shortcode in all versions up to, and including, 2.7.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 2.7.5.2
What to do
Affects up to 2.7.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 23, 2024Checkout with Cash App on WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Checkout with Cash App on WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wp_http_referer' parameter in several files in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Checkout with Cash App on WooCommerce
Affected
up to 6.0.2
What to do
Affects up to 6.0.2. Update Checkout with Cash App on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 8, 2024The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce creditCVE-2024-10187 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_link shortcode in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected
up to 2.7.4
What to do
Affects up to 2.7.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 16, 2024Telecash Ricaricaweb: Deserialization of Untrusted DataCVE-2024-48030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Webextends Telecash Ricaricaweb telecash-ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through <= 2.2.
Product
Telecash Ricaricaweb
Affected
up to 2.2
What to do
Affects up to 2.2. Update Telecash Ricaricaweb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 25, 2024The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce creditCVE-2024-8658 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2024AA Cash Calculator: Reflected Cross-Site ScriptingCVE-2024-0848 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AA Cash Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘invoice’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AA Cash Calculator
Affected
up to 1.0
What to do
Affects up to 1.0. Update AA Cash Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2024TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds: Unauthorized access of dataCVE-2024-1690 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawallet_export_user_search() function in all versions up to, and including, 1.4.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to export a list of registered users and their emails.
Product
TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds
Affected
up to 1.4.10
What to do
Affects up to 1.4.10. Update TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2021An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leaCVE-2021-24391 · WordPress plugins & themes · reported by WPScanHigh 8.8
An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
Cashtomer
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Cashtomer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Oct 23, 2017The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.CVE-2017-15810 · WordPress plugins & themes · reported by MITREMedium 6.1
The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.
Product
PopCash.Net Code Integration Tool
Fixed in
1.1
What to do
Update PopCash.Net Code Integration Tool to 1.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.