Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Oct 14, 2026Asaas Gateway for WooCommerce: Does not properly authenticate its payment webhookCVE-2026-87974 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.
- Product
- Asaas Gateway for WooCommerce
- Fixed in
- 2.7.8
- What to do
- Update Asaas Gateway for WooCommerce to 2.7.8 or newer.
Oct 10, 2026CV Builder – Professional Resume Builder SaaS: Unauthorized arbitrary file uploadCVE-2026-3717 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.
- Product
- CV Builder – Professional Resume Builder SaaS
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update CV Builder – Professional Resume Builder SaaS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 1, 2026Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform: Authentication BypassCVE-2026-75957 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_customer_after_checkout` function. This is due to the publicly accessible `wu_ajax_nopriv_wu_validate_form` AJAX handler accepting a freely obtainable checkout nonce, and the `checkout_form=wu-finish-checkout` parameter causing `get_validation_rules()` to discard all validation rules while `finish_checkout_form_fields()` returns an empty step list — forcing `is_last_step()` to return true and routing the request directly into full order processing — after which `maybe_create_customer()` resolves the attacker-supplied `email_address` to an existing WordPress user ID without any authentication or ownership verification, and `login_customer_after_checkout()` calls `wp_set_auth_cookie()` for that user ID via a passwordless code path. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including a Network Super Admin — simply by knowing their email address. Exploitation requires that the targeted user account has no pre-existing
- Product
- Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform
- Affected
- up to 2.15.0
- What to do
- Affects up to 2.15.0. Update Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 20, 2026Saasplate Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69309 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through <= 1.2.8.
- Product
- Saasplate Core
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Saasplate Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2025SaasLauncher: Missing AuthorizationCVE-2025-58606 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.
- Product
- SaasLauncher
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update SaasLauncher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2025App, SaaS & Software Startup Tech Theme - Stratus: Missing AuthorizationCVE-2025-53341 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Pixel Makers Creative INC. App, SaaS & Software Startup Tech Theme - Stratus allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects App, SaaS & Software Startup Tech Theme - Stratus: from n/a before 4.2.11.
- Product
- App, SaaS & Software Startup Tech Theme - Stratus
- Fixed in
- 4.2.11
- What to do
- Update App, SaaS & Software Startup Tech Theme - Stratus to 4.2.11 or newer.
Jul 9, 2025Sala - Startup & SaaS: Privilege escalationCVE-2025-4606 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- Product
- Sala - Startup & SaaS
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Sala - Startup & SaaS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 11, 2025SuperSaaS – online appointment scheduling: Stored Cross-Site ScriptingCVE-2025-0862 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is limited to Chromium-based browsers (e.g. Chrome, Edge, Brave).
- Product
- SuperSaaS – online appointment scheduling
- Affected
- up to 2.1.12
- What to do
- Affects up to 2.1.12. Update SuperSaaS – online appointment scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 31, 2024SaasPricing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56231 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio SaasPricing saaspricing allows DOM-Based XSS.This issue affects SaasPricing: from n/a through <= 1.2.4.
- Product
- SaasPricing
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update SaasPricing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 21, 2024SuperSaaS – online appointment scheduling: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37460 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SuperSaaS SuperSaaS – online appointment scheduling allows Stored XSS.This issue affects SuperSaaS – online appointment scheduling: from n/a through 2.1.9.
- Product
- SuperSaaS – online appointment scheduling
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update SuperSaaS – online appointment scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023Saan World Clock: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0145 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Saan World Clock
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Saan World Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.