Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

85 results · page 1 of 2

Oct 28, 2026Customer Engagement System: Does not safely build the SQL statements that store a popup's page and category visibility rulesCVE-2026-115224 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
Product
Customer Engagement System
Fixed in
2.0.2
What to do
Update Customer Engagement System to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Oct 23, 2026Otter Blocks: Does not enforce its block visibility conditionsCVE-2026-109935 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
Product
Otter Blocks
Fixed in
3.2.8
What to do
Update Otter Blocks to 3.2.8 or newer.
Full record and what to do →NVD record wpscan.com
Oct 16, 2026Dark Mode – Improve Accessibility with AI Powered Dark: Stored Cross-Site ScriptingCVE-2026-93535 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dark Mode – Improve Accessibility with AI Powered Dark
Affected
up to 5.3.17
What to do
Affects up to 5.3.17. Update Dark Mode – Improve Accessibility with AI Powered Dark to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 3, 2026Alt Text AI – Automatically generate image alt text for SEO and accessibility: Authorization bypassCVE-2026-91108 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site — including content they do not own — with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits. The nonce required to invoke the action is emitted on every admin page including /wp-admin/profile.php, which is accessible to Subscribers, making the nonce trivially obtainable by any authenticated user.
Product
Alt Text AI – Automatically generate image alt text for SEO and accessibility
Affected
up to 1.10.41
What to do
Affects up to 1.10.41. Update Alt Text AI – Automatically generate image alt text for SEO and accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Connections Business Directory: Does not apply its visibility and moderation-status restrictions on certain REST API read endpointsCVE-2026-86789 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.
Product
Connections Business Directory
Affected
up to 10.4.67
What to do
Affects up to 10.4.67. Update Connections Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 26, 2026Team Members: Does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by IDCVE-2026-11871 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Product
Team Members
Fixed in
9.3
What to do
Update Team Members to 9.3 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Post Grid Gutenberg Blocks: Does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given postCVE-2026-86783 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.
Product
Post Grid Gutenberg Blocks
Fixed in
5.0.41
What to do
Update Post Grid Gutenberg Blocks to 5.0.41 or newer.
Full record and what to do →NVD record wpscan.com
Sep 15, 2026WP Directory Kit: Does not check authorization or listing visibility in one of its shortcodesCVE-2026-16592 · WordPress plugins & themes · reported by WPScanLow 2.7
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
Product
WP Directory Kit
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.CVE-2026-24537 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.
Affected
up to 0.6.6
What to do
Affects up to 0.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance: Stored Cross-Site ScriptingCVE-2026-14481 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to have the ability to edit a post, as the REST endpoint /accessibility-checker/v1/post-scan-results/{id} is guarded only by the edit_post capability on the target post.
Product
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
Affected
up to 1.46.0
What to do
Affects up to 1.46.0. Update Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2026Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance: Authorization bypassCVE-2026-9199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.42.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to dismiss, ignore, or restore accessibility audit issue records belonging to posts they are not permitted to edit by supplying an issue from their own post as an authorization token to affect matching issues across the entire site. An Author-level user can exploit this by passing largeBatch=true on a dismiss-issue request referencing one of their own post's issues, causing the handler to bulk-modify all site-wide accessibility issues sharing the same 'object' value — including those belonging to administrator-owned posts.
Product
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
Affected
up to 1.42.1
What to do
Affects up to 1.42.1. Update Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2026the activity mention resolver that, when username compatibility mode is enabled,: BuddyPress 14.4.0 contains a regular expression injectionCVE-2026-53674 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP query against the users table, enabling boolean-based inference of usernames and denial of service through catastrophic backtracking.
Product
the activity mention resolver that, when username compatibility mode is enabled,
What to do
Update the activity mention resolver that, when username compatibility mode is enabled, to the newest version.
Full record and what to do →NVD record buddypress.org wordpress.org
Jun 2, 2026Content Visibility for Divi Builder: Remote Code ExecutionCVE-2026-1829 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_check' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Product
Content Visibility for Divi Builder
Affected
up to 4.02
What to do
Affects up to 4.02. Update Content Visibility for Divi Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2026Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance: Authorization bypassCVE-2026-9015 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.42.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the ignore state, ignore reason, and ignore comment of arbitrary accessibility issues across the entire site — including mass modification of all rows sharing an 'object' identifier when largeBatch=true is supplied — corrupting accessibility audit integrity by hiding or dismissing findings outside their authorization scope.
Product
Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
Affected
up to 1.42.0
What to do
Affects up to 1.42.0. Update Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2026Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets: Remote Code ExecutionCVE-2026-2052 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.
Product
Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2026Accessibility Suite by Ability, Inc: SQL InjectionCVE-2026-3773 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Accessibility Suite by Ability, Inc plugin for WordPress is vulnerable to SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Accessibility Suite by Ability, Inc
Affected
up to 4.20
What to do
Affects up to 4.20. Update Accessibility Suite by Ability, Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026Ally – Web Accessibility & Usability: SQL InjectionCVE-2026-2413 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.
Product
Ally – Web Accessibility & Usability
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Ally – Web Accessibility & Usability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2026WP Accessibility: Stored DOM-Based Cross-Site ScriptingCVE-2026-2362 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Description UI" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using getAttribute() and unsafely concatenating it into innerHTML and insertAdjacentHTML calls without proper sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the "Long Description UI" setting to be enabled and set to "Link to description."
Product
WP Accessibility
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WP Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Web Accessibility by accessiBe: Sensitive Information ExposureCVE-2025-13113 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Web Accessibility by accessiBe plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11. This is due to the `accessibe_render_js_in_footer()` function logging the complete plugin options array to the browser console on public pages, without restricting output to privileged users or checking for debug mode. This makes it possible for unauthenticated attackers to view sensitive configuration data, including email addresses, accessiBe user IDs, account IDs, and license information, via the browser console when the widget is disabled.
Product
Web Accessibility by accessiBe
Affected
up to 2.11
What to do
Affects up to 2.11. Update Web Accessibility by accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2026AMP Enhancer – Compatibility Layer for Official AMP: Stored Cross-Site ScriptingCVE-2026-2027 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AMP Custom CSS setting in all versions up to, and including, 1.0.49 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
AMP Enhancer – Compatibility Layer for Official AMP
Affected
up to 1.0.49
What to do
Affects up to 1.0.49. Update AMP Enhancer – Compatibility Layer for Official AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 6, 2026Orange Confort+ accessibility toolbar for: Stored Cross-Site ScriptingCVE-2026-1808 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Orange Confort+ accessibility toolbar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' parameter of the ocplus_button shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Orange Confort+ accessibility toolbar for
Affected
up to 0.7
What to do
Affects up to 0.7. Update Orange Confort+ accessibility toolbar for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026Web Accessibility with Max Access: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24629 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Stored XSS.This issue affects Web Accessibility with Max Access: from n/a through <= 2.1.0.
Product
Web Accessibility with Max Access
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Web Accessibility with Max Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2026NS IE Compatibility Fixer: Cross-Site Request Forgery (CSRF)CVE-2025-14845 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
NS IE Compatibility Fixer
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update NS IE Compatibility Fixer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record developer.wordpress.org developer.wordpress.org
Dec 31, 2025Accessibility Press: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49355 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ikaes Accessibility Press ilogic-accessibility allows Stored XSS.This issue affects Accessibility Press: from n/a through <= 1.0.2.
Product
Accessibility Press
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Accessibility Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025All in One Accessibility: Missing AuthorizationCVE-2025-63004 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Skynet Technologies USA LLC All in One Accessibility all-in-one-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All in One Accessibility: from n/a through <= 1.15.
Product
All in One Accessibility
Affected
up to 1.15
What to do
Affects up to 1.15. Update All in One Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Accessibility by AudioEye: Missing AuthorizationCVE-2025-64246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility by AudioEye: from n/a through <= 1.0.49.
Product
Accessibility by AudioEye
Affected
up to 1.0.49
What to do
Affects up to 1.0.49. Update Accessibility by AudioEye to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 6, 2025Accessiy By CodeConfig Accessibility: Unauthorized page creationCVE-2025-13358 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to, and including, 1.0.0. This is due to the plugin not performing capability checks in the `Settings::createPage()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published pages on the site via the `ccpcaCreatePage` AJAX action.
Product
Accessiy By CodeConfig Accessibility
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Accessiy By CodeConfig Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 6, 2025Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters: Authorization bypassCVE-2025-13309 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to modify the plugin’s global accessibility settings.
Product
Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 21, 2025Accessibility Toolkit by WebYes: Missing AuthorizationCVE-2025-66112 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Toolkit by WebYes: from n/a through <= 2.0.4.
Product
Accessibility Toolkit by WebYes
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Accessibility Toolkit by WebYes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 22, 2025Web Accessibility By accessiBe: Missing AuthorizationCVE-2025-49920 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10.
Product
Web Accessibility By accessiBe
Affected
up to 2.10
What to do
Affects up to 2.10. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 15, 2025Ally – Web Accessibility & Usability: Cross-Site Request ForgeryCVE-2025-10700 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function. This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ally – Web Accessibility & Usability
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Ally – Web Accessibility & Usability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 11, 2025Web Accessibility By accessiBe: Cross-Site Request ForgeryCVE-2025-10375 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to missing nonce validation on multiple AJAX actions including accessibe_signup, accessibe_login, accessibe_license_trial, accessibe_modify_config, and accessibe_add_verification_page. This makes it possible for unauthenticated attackers to modify plugin settings and create verification files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Web Accessibility By accessiBe
Affected
up to 2.10
What to do
Affects up to 2.10. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2025Text To Speech TTS Accessibility: Missing AuthorizationCVE-2025-58664 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Azizul Hasan Text To Speech TTS Accessibility text-to-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Text To Speech TTS Accessibility: from n/a through <= 1.9.30.
Product
Text To Speech TTS Accessibility
Affected
up to 1.9.30
What to do
Affects up to 1.9.30. Update Text To Speech TTS Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
Product
Accessibility Checker by Equalize Digital
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 9, 2025Accessibility Checker by Equalize Digital: Missing AuthorizationCVE-2025-58976 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.31.0.
Product
Accessibility Checker by Equalize Digital
Affected
up to 1.31.0
What to do
Affects up to 1.31.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2025Accessibility Checker by Equalize Digital: Authorization Bypass Through User-Controlled KeyCVE-2025-57886 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from n/a through <= 1.30.0.
Product
Accessibility Checker by Equalize Digital
Affected
up to 1.30.0
What to do
Affects up to 1.30.0. Update Accessibility Checker by Equalize Digital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 22, 2025Birth Chart Compatibility: Full Path DisclosureCVE-2025-6082 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Birth Chart Compatibility
Affected
up to 2.0
What to do
Affects up to 2.0. Update Birth Chart Compatibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org wordpress.org
Jun 27, 2025FL3R Accessibility Suite: Stored Cross-Site ScriptingCVE-2025-6689 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FL3R Accessibility Suite
Affected
up to 1.4
What to do
Affects up to 1.4. Update FL3R Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 6, 2025Accessibility Suite: Missing AuthorizationCVE-2025-30636 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.19.
Product
Accessibility Suite
Affected
up to 4.19
What to do
Affects up to 4.19. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 7, 2025Web Accessibility with Max Access: Cross-Site Request Forgery (CSRF)CVE-2025-47681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Cross Site Request Forgery.This issue affects Web Accessibility with Max Access: from n/a through <= 2.0.9.
Product
Web Accessibility with Max Access
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Web Accessibility with Max Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 24, 2025Checkout Field Visibility for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39391 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for WooCommerce: from n/a through <= 1.3.0.
Product
Checkout Field Visibility for WooCommerce
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Checkout Field Visibility for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 11, 2025Accessibility Suite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32650 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ability, Inc Accessibility Suite online-accessibility allows SQL Injection.This issue affects Accessibility Suite: from n/a through <= 4.18.
Product
Accessibility Suite
Affected
up to 4.18
What to do
Affects up to 4.18. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 10, 2025Accessibility Suite: Unrestricted Upload of File with Dangerous TypeCVE-2025-32215 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unrestricted Upload of File with Dangerous Type vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Stored XSS.This issue affects Accessibility Suite: from n/a through <= 4.18.
Product
Accessibility Suite
Affected
up to 4.18
What to do
Affects up to 4.18. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 24, 2025wA11y – The Web Accessibility Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30623 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry wA11y – The Web Accessibility Toolbox wa11y allows Stored XSS.This issue affects wA11y – The Web Accessibility Toolbox: from n/a through <= 1.0.3.
Product
wA11y – The Web Accessibility Toolbox
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update wA11y – The Web Accessibility Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 25, 2025Web Accessibility By accessiBe: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26981 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Reflected XSS.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.5.
Product
Web Accessibility By accessiBe
Affected
up to 2.5
What to do
Affects up to 2.5. Update Web Accessibility By accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2025Accessibility Suite: Missing AuthorizationCVE-2025-22698 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.18.
Product
Accessibility Suite
Affected
up to 4.18
What to do
Affects up to 4.18. Update Accessibility Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 13, 2025Wibiya Toolbar: Cross-Site Request Forgery (CSRF)CVE-2025-26571 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in wibiya Wibiya Toolbar wibiya allows Cross Site Request Forgery.This issue affects Wibiya Toolbar: from n/a through <= 2.0.
Product
Wibiya Toolbar
Affected
up to 2.0
What to do
Affects up to 2.0. Update Wibiya Toolbar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025Accessibility Task Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23725 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pshikli Accessibility Task Manager accessibility-task-manager allows Reflected XSS.This issue affects Accessibility Task Manager: from n/a through <= 1.2.1.
Product
Accessibility Task Manager
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Accessibility Task Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 21, 2025Weaver Themes Shortcode Compatibility: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22267 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Themes Shortcode Compatibility weaver-themes-shortcode-compatibility allows Stored XSS.This issue affects Weaver Themes Shortcode Compatibility: from n/a through <= 1.0.4.
Product
Weaver Themes Shortcode Compatibility
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Weaver Themes Shortcode Compatibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025Accessibility by AllAccessible: Incorrect Privilege AssignmentCVE-2024-49644 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Accessibility by AllAccessible: from n/a through <= 1.3.4.
Product
Accessibility by AllAccessible
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update Accessibility by AllAccessible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.