Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

95 results · page 1 of 2

Oct 28, 2026Product Designer for WooCommerce WordPress | Lumise: Directory TraversalCVE-2026-15323 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The lumise_security nonce required to reach the vulnerable /?lumise=cart endpoint is freely obtainable by any unauthenticated visitor via the /?lumise=ajax action=init handler, making this exploitable with no prior access or credentials.
Product
Product Designer for WooCommerce WordPress | Lumise
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Product Designer for WooCommerce WordPress | Lumise to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2026PickPlugins Product Designer for WooCommerce: Does not perform any capability check and its nonce verification is invertedCVE-2026-87844 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.
Product
PickPlugins Product Designer for WooCommerce
Affected
up to 1.0.40
What to do
Affects up to 1.0.40. Update PickPlugins Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 13, 2026The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution inCVE-2026-93388 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopriv_), and its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter — bypassing the jpg/jpeg/png/gif allow-list applied on the other branch — and writes the fetched bytes to a web-accessible directory (wp-content/uploads/nbdesigner/temp/). This makes it possible for unauthenticated attackers to write a .php file to a web-served, PHP-executing location and, by supplying their own Google Drive file and OAuth token as the content source, execute arbitrary code on the server. The required save-design nonce is handed to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier.
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.CVE-2026-39726 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2026Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.CVE-2026-32568 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
Affected
up to 1.9.33
What to do
Affects up to 1.9.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.CVE-2026-94677 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Affected
up to 1.5.19.1
What to do
Affects up to 1.5.19.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 30, 2026Product Designer App: Directory TraversalCVE-2026-75098 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.
Product
Product Designer App
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Product Designer App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 25, 2026Fancy Product Designer: Stored Cross-Site ScriptingCVE-2026-84280 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an administrator reviews shortcode orders in the WordPress admin panel.
Product
Fancy Product Designer
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fancyproductdesigner.com wordfence.com
Sep 25, 2026Fancy Product Designer: Stored Cross-Site ScriptingCVE-2026-84281 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences (e.g. \u003c, \u003e), which json_decode() silently converts back to literal angle brackets when the order is rendered in the admin view.
Product
Fancy Product Designer
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fancyproductdesigner.com wordfence.com
Sep 25, 2026Fancy Product Designer: Stored Cross-Site ScriptingCVE-2026-84279 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Pro Export/Genius feature to be enabled on the site, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.
Product
Fancy Product Designer
Affected
up to 6.5.2
What to do
Affects up to 6.5.2. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fancyproductdesigner.com wordfence.com
Sep 21, 2026Web to Print Online Designer: Does not validate the type or extension of uploaded filesCVE-2026-82187 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.
Product
Web to Print Online Designer
Fixed in
2.15.0
What to do
Update Web to Print Online Designer to 2.15.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Printcart Web to Print Product Designer for WooCommerce: Directory TraversalCVE-2026-14323 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. A valid nonce is obtainable by unauthenticated users via the companion nbd_check_use_logged_in nopriv AJAX endpoint, which freely mints and returns a nbdesigner-get-data nonce to any visitor; additionally, if the NBDESIGNER_ENABLE_NONCE constant is disabled, even this nonce gate is bypassed entirely.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid: Authorization bypassCVE-2026-75017 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.
Product
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
Affected
up to 1.8.6
What to do
Affects up to 1.8.6. Update Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.CVE-2026-81794 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.CVE-2026-28005 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
Affected
up to 1.5.19
What to do
Affects up to 1.5.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 28, 2026PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer: Unauthorized access of dataCVE-2026-12124 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
Product
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2026Printcart Web to Print Product Designer for WooCommerce: Does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization checkCVE-2025-15662 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.
Product
Printcart Web to Print Product Designer for WooCommerce
Fixed in
2.5.3
What to do
Update Printcart Web to Print Product Designer for WooCommerce to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Lumise Product Designer for WooCommerce: SQL InjectionCVE-2026-9713 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — the 'id' field is interpolated without quotes into a WHERE clause (numeric context) and 'table' is interpolated into the FROM clause, neither of which is protected by wp_magic_quotes or passed through $wpdb->prepare(). This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Lumise Product Designer for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Lumise Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 3, 2026Printcart Web to Print Product Designer for WooCommerce: Arbitrary File DeletionCVE-2026-9725 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 29, 2026Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions.CVE-2026-57329 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions.
Affected
up to 1.9.34
What to do
Affects up to 1.9.34. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Printcart Web to Print Product Designer for WooCommerce: Is vulnerable to path traversalCVE-2025-10268 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it possible for the attacker to retrieve the directory listing for arbitrary directories on the server.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 12, 2026SP Blog Designer: Stored Cross-Site ScriptingCVE-2026-4859 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the `wpsbd_post_carousel` shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SP Blog Designer
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update SP Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2026Lumise Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25371 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.
Product
Lumise Product Designer
What to do
Update Lumise Product Designer to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 19, 2026ColorFolio - Freelance Designer: Deserialization of Untrusted DataCVE-2026-27096 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.
Product
ColorFolio - Freelance Designer
Affected
up to 1.3
What to do
Affects up to 1.3. Update ColorFolio - Freelance Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2026Fancy Product Designer: Full Path DisclosureCVE-2025-15526 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling in the PDF upload functionality that exposes server filesystem paths and stack traces in error messages. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.fancyproductdesigner.com wordfence.com
Jan 14, 2026News and Blog Designer Bundle: Local File InclusionCVE-2025-14502 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
News and Blog Designer Bundle
Affected
up to 1.1
What to do
Affects up to 1.1. Update News and Blog Designer Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 16, 2025Fancy Product Designer: Server-Side Request ForgeryCVE-2025-13231 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time-of-check/time-of-use (TOCTOU) race condition in the 'url' parameter of the fpd_custom_uplod_file AJAX action. The plugin validates the URL by calling getimagesize() first, then later retrieves the same URL using file_get_contents(). This makes it possible for unauthenticated attackers to exploit the timing gap to perform SSRF attacks by serving a valid image during validation, then changing the response to redirect to arbitrary internal or external URLs during the actual fetch.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.fancyproductdesigner.com wordfence.com
Dec 16, 2025Fancy Product Designer: Information Disclosure and PHAR DeserializationCVE-2025-13439 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. This is due to insufficient validation of user-supplied input in the 'url' parameter of the 'fpd_custom_uplod_file' AJAX action, which flows directly into the 'getimagesize' function without sanitization. This makes it possible for unauthenticated attackers to read arbitrary sensitive files from the server, including wp-config.php.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record support.fancyproductdesigner.com wordfence.com
Dec 12, 2025Fancy Product Designer: Stored Cross-Site ScriptingCVE-2025-12570 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping in the data-to-image.php and pdf-to-image.php files. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
Fancy Product Designer
Affected
up to 6.4.8
What to do
Affects up to 6.4.8. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Dec 2, 2025Kadence WooCommerce Email Designer: Stored Cross-Site ScriptingCVE-2025-13387 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Kadence WooCommerce Email Designer
Affected
up to 1.5.17
What to do
Affects up to 1.5.17. Update Kadence WooCommerce Email Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 31, 2025WooCommerce Designer Pro: Arbitrary file readCVE-2025-10897 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials when the wp-config.php file is read.
Product
WooCommerce Designer Pro
Affected
up to 1.9.28
What to do
Affects up to 1.9.28. Update WooCommerce Designer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 29, 2025Blog Designer PRO: Missing AuthorizationCVE-2025-58711 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blog Designer PRO: from n/a through <= 3.4.8.
Product
Blog Designer PRO
Affected
up to 3.4.8
What to do
Affects up to 3.4.8. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 24, 2025The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploCVE-2025-6440 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected
up to 1.9.26
What to do
Affects up to 1.9.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Oct 11, 2025The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deleCVE-2025-6439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wcdp_save_canvas_design_ajax' function in all versions up to, and including, 1.9.26. This makes it possible for unauthenticated attackers to delete all files in an arbitrary directory on the server, which can lead to remote code execution, data loss, or site unavailability.
Affected
up to 1.9.26
What to do
Affects up to 1.9.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 26, 2025WooCommerce Designer Pro: Unrestricted Upload of File with Dangerous TypeCVE-2025-60219 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme WooCommerce Designer Pro wc-designer-pro allows Upload a Web Shell to a Web Server.This issue affects WooCommerce Designer Pro: from n/a through <= 1.9.24.
Product
WooCommerce Designer Pro
Affected
up to 1.9.24
What to do
Affects up to 1.9.24. Update WooCommerce Designer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Blog Designer: Missing AuthorizationCVE-2025-57990 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in solwininfotech Blog Designer blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blog Designer: from n/a through <= 3.1.8.
Product
Blog Designer
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Blog Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025CoDesigner: Missing AuthorizationCVE-2025-57961 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Codexpert, Inc CoDesigner woolementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoDesigner: from n/a through <= 4.29.
Product
CoDesigner
Affected
up to 4.29
What to do
Affects up to 4.29. Update CoDesigner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2025Printcart Web to Print Product Designer for WooCommerce: Missing AuthorizationCVE-2025-57917 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.8.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 11, 2025Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid: Cross-Site Request Forgery in version 1CVE-2025-8481 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.1.7. This is due to missing or incorrect nonce validation on the bdfe_install_activate_rswpbs_only function. This makes it possible for unauthenticated attackers to install the 'rs-wp-books-showcase' plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid
What to do
Update Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2025Blog Designer PRO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47695 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.
Product
Blog Designer PRO
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Blog Designer PRO: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47694 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.
Product
Blog Designer PRO
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 31, 2025Blog Designer PRO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47696 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.
Product
Blog Designer PRO
Affected
up to 3.4.7
What to do
Affects up to 3.4.7. Update Blog Designer PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 14, 2025Kadence WooCommerce Email Designer: Incorrect Privilege AssignmentCVE-2025-54697 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Privilege Escalation.This issue affects Kadence WooCommerce Email Designer: from n/a through <= 1.5.16.
Product
Kadence WooCommerce Email Designer
Affected
up to 1.5.16
What to do
Affects up to 1.5.16. Update Kadence WooCommerce Email Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 4, 2025Printcart Web to Print Product Designer for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24780 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.0.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 9, 2025MyStyle Custom Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-48281 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer allows Blind SQL Injection.This issue affects MyStyle Custom Product Designer: from n/a through <= 3.21.1.
Product
MyStyle Custom Product Designer
Affected
up to 3.21.1
What to do
Affects up to 3.21.1. Update MyStyle Custom Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Printcart Web to Print Product Designer for WooCommerce: Unrestricted Upload of File with Dangerous TypeCVE-2025-47641 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows Upload a Web Shell to a Web Server.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.3.9.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2025Printcart Web to Print Product Designer for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-47640 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.0.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Print Science Designer: Cross-Site Request Forgery (CSRF)CVE-2025-46465 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in John Weissberg Print Science Designer print-science-designer allows Stored XSS.This issue affects Print Science Designer: from n/a through <= 1.3.155.
Product
Print Science Designer
Affected
up to 1.3.155
What to do
Affects up to 1.3.155. Update Print Science Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 16, 2025Kadence WooCommerce Email Designer: Unrestricted Upload of File with Dangerous TypeCVE-2025-39557 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Upload a Web Shell to a Web Server.This issue affects Kadence WooCommerce Email Designer: from n/a through <= 1.5.14.
Product
Kadence WooCommerce Email Designer
Affected
up to 1.5.14
What to do
Affects up to 1.5.14. Update Kadence WooCommerce Email Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Print Science Designer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32671 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John Weissberg Print Science Designer print-science-designer allows Path Traversal.This issue affects Print Science Designer: from n/a through <= 1.3.155.
Product
Print Science Designer
Affected
up to 1.3.155
What to do
Affects up to 1.3.155. Update Print Science Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.