Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Oct 25, 2026GiveWP: Does not correctly determineCVE-2026-111980 · WordPress plugins & themes · reported by WPScanMedium 5.5
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
- Product
- GiveWP
- Fixed in
- 4.19.0.1
- What to do
- Update GiveWP to 4.19.0.1 or newer.
Oct 23, 2026Otter Blocks: Does not correctly determine whether a post is publicly readable before returning its data through a REST API endpointCVE-2026-109934 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 21, 2026LatePoint: Does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allowCVE-2026-105256 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.
- Product
- LatePoint
- Fixed in
- 5.7.5
- What to do
- Update LatePoint to 5.7.5 or newer.
Oct 21, 2026Advanced File Manager: Does not correctly determine whether a stored file is an SVG before sanitising itCVE-2026-79627 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
- Product
- Advanced File Manager
- Fixed in
- 6.0.0
- What to do
- Update Advanced File Manager to 6.0.0 or newer.
Oct 2, 2026All in One SEO: Does not correctly determineCVE-2026-19856 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older versions the protection is disabled outright, making the issue reachable without any crafted input.
- Product
- All in One SEO
- Fixed in
- 5.0.2.1
- What to do
- Update All in One SEO to 5.0.2.1 or newer.
Sep 16, 2026Tutor LMS: Does not correctly determine whether an incoming request is addressed to its own REST APICVE-2026-85569 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.
- Product
- Tutor LMS
- Fixed in
- 4.0.8
- What to do
- Update Tutor LMS to 4.0.8 or newer.
Mar 27, 2023Formidable Forms: Uses several potentially untrusted headers to determine the IP address of the clientCVE-2023-0816 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
- Product
- Formidable Forms
- Fixed in
- 6.1
- What to do
- Update Formidable Forms to 6.1 or newer.
Nov 2, 2020is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is CVE-2020-28039 · WordPress plugins & themes · reported by MITRECritical 9.1
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 2, 2020is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attaCVE-2020-28037 · WordPress plugins & themes · reported by MITRECritical 9.8
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 19, 2017WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging accessCVE-2012-6707 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org
Aug 7, 2016WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass anCVE-2016-4029 · WordPress plugins & themes · reported by MITREHigh 8.6
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
- Fixed in
- 4.5
- What to do
- Update the plugin to 4.5 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgdebian.org
Apr 9, 2014The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of aCVE-2014-0166 · WordPress plugins & themes · reported by Red HatMedium 6.4
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.
- Fixed in
- 3.7.2
- What to do
- Update the plugin to 3.7.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcodex.wordpress.org
Sep 12, 2013wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitCVE-2013-4338 · WordPress plugins & themes · reported by Red HatHigh 7.5
wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.
- Fixed in
- 3.6.1
- What to do
- Update the plugin to 3.6.1 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Aug 10, 2011WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.CVE-2011-3126 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.
- Fixed in
- 3.1.3
- What to do
- Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Jan 29, 2007WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a CVE-2007-0541 · WordPress plugins & themes · reported by MITREMedium 5
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain configurations causes a brief file excerpt to be published as a blog comment.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.