Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,714entries in the database

121 results · page 1 of 3

Oct 11, 2026WP-Invoice: Does not perform capability checks in several of its AJAX handlersCVE-2026-97183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.
Product
WP-Invoice
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update WP-Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Oct 10, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Insecure Direct Object ReferenceCVE-2026-93746 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.
Product
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 1, 2026PDF Invoices & Packing Slips for WooCommerce: Stored Cross-Site ScriptingCVE-2026-92244 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 5.16.1
What to do
Affects up to 5.16.1. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.CVE-2026-97078 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
Affected
up to 20.8.17
What to do
Affects up to 20.8.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 19, 2026PDF Builder for WooCommerce. Create invoices,packing slips and more: Authorization bypassCVE-2026-11899 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.
Product
PDF Builder for WooCommerce. Create invoices,packing slips and more
Affected
up to 2.0.11
What to do
Affects up to 2.0.11. Update PDF Builder for WooCommerce. Create invoices,packing slips and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2026Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.CVE-2026-66676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
Affected
up to 2.3.8
What to do
Affects up to 2.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 12, 2026Sprout Invoices: Does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actionsCVE-2026-87797 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.
Product
Sprout Invoices
Fixed in
20.8.16
What to do
Update Sprout Invoices to 20.8.16 or newer.
Full record and what to do →NVD record wpscan.com
Sep 11, 2026Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce"): Insecure Direct Object ReferenceCVE-2026-11496 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.
Product
Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce")
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.CVE-2026-32560 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
Affected
up to 1.4
What to do
Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 22, 2026WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels: Directory TraversalCVE-2026-18027 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.
Product
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
Affected
up to 4.9.8
What to do
Affects up to 4.9.8. Update WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 14, 2026Propovoice: All-in-One Client Management System: Privilege EscalationCVE-2026-15312 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.
Product
Propovoice: All-in-One Client Management System
Affected
up to 1.7.8
What to do
Affects up to 1.7.8. Update Propovoice: All-in-One Client Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer: Unauthorized access of dataCVE-2026-12124 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
Product
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65516 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65499 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-27372 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2026Advance Product Search- Voice & Ajax Search for WooCommerce: Generic SQL InjectionCVE-2026-12753 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advance Product Search- Voice & Ajax Search for WooCommerce
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Advance Product Search- Voice & Ajax Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-57418 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.13.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.13
What to do
Affects up to 20.8.13. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026WooCommerce PDF Invoice Builder: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-57393 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 2.0.8.
Product
WooCommerce PDF Invoice Builder
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 11, 2026PDF Invoices & Packing Slips for WooCommerce: Insecure Direct Object ReferenceCVE-2026-13116 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.14.0 via the generate_document_shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to mint publicly accessible, session-free download links for arbitrary third-party orders, exposing customer names, billing and shipping addresses, email addresses, phone numbers, order and invoice numbers, line items, totals, payment details, and customer notes contained in those orders' invoices and packing slips. Exploitation requires the plugin's Document link access type setting to be configured to 'full'; with the default 'logged_in' value, generated URLs are signed with a per-session nonce rather than the order_key, making the shortcode path unexploitable for unauthorized access to third-party orders.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 5.14.0
What to do
Affects up to 5.14.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026Invoice123: Authorization bypassCVE-2026-9857 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the plugin's API key stored in wp_options, modify invoice plugin settings, and alter WooCommerce tax rate data in the wp_woocommerce_tax_rates table.
Product
Invoice123
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Invoice123 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Easy Invoice: Missing AuthorizationCVE-2026-9021 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes — and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) — by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.
Product
Easy Invoice
Affected
up to 2.1.19
What to do
Affects up to 2.1.19. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2026Invoice Generator: Privilege escalationCVE-2026-12415 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.
Product
Invoice Generator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Invoice Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.CVE-2026-56060 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 24, 2026Invoice Generator: Account TakeoverCVE-2026-12416 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parameter and the target user's stored `forgot_email` user meta — a check that trivially evaluates to true (`'' == ''`) for any user who has never initiated a forgot-password request, which applies to administrators under normal conditions. This makes it possible for unauthenticated attackers to supply an arbitrary user ID via the `reset_user_id` POST parameter, bypass the activation code check entirely by omitting `reset_activation_code`, and set the target account's password to an attacker-chosen value, enabling full takeover of any account on the site, including administrator accounts.
Product
Invoice Generator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Invoice Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.CVE-2026-49056 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.
Affected
up to 4.9.4
What to do
Affects up to 4.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.CVE-2026-48836 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.
Affected
up to 2.1.19
What to do
Affects up to 2.1.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.CVE-2026-39472 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WooCommerce PDF Invoice Builder: Improper Control of Generation of Code ('Code Injection')CVE-2026-52704 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
Product
WooCommerce PDF Invoice Builder
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injeCVE-2019-25746 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record slicedinvoices.com wordpress.org
Apr 8, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-39562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.10
What to do
Affects up to 20.8.10. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 4, 2026Text to Speech for WP (AI Voices by Mementor): Sensitive information exposureCVE-2026-1233 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the `Mementor_TTS_Remote_Telemetry` class. This makes it possible for unauthenticated attackers to extract and decode these credentials, gaining unauthorized write access to the vendor's telemetry database.
Product
Text to Speech for WP (AI Voices by Mementor)
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Text to Speech for WP (AI Voices by Mementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 25, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-25317 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.9.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026PeproDev Ultimate Invoice: Has a bulk download invoices action that generates ZIP archives containing exported invoice PDFsCVE-2026-2343 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.
Product
PeproDev Ultimate Invoice
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2026Client Invoicing by Sprout Invoices: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32401 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows PHP Local File Inclusion.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.9.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.9
What to do
Affects up to 20.8.9. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-24946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.8.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-25364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.8.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.8
What to do
Affects up to 20.8.8. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 18, 2026PDF Invoices & Packing Slips for WooCommerce: Insecure Direct Object ReferenceCVE-2026-1906 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the `wpo_ips_edi_save_order_customer_peppol_identifiers` AJAX action due to missing capability checks and order ownership validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify Peppol/EDI endpoint identifiers (`peppol_endpoint_id`, `peppol_endpoint_eas`) for any customer by specifying an arbitrary `order_id` parameter on systems using Peppol invoicing. This can affect order routing on the Peppol network and may result in payment disruptions and data leakage.
Product
PDF Invoices & Packing Slips for WooCommerce
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update PDF Invoices & Packing Slips for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026Easy Voice Mail: Stored Cross-Site ScriptingCVE-2026-1164 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Voice Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Voice Mail
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Easy Voice Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 11, 2026Invoct – PDF Invoices & Billing for WooCommerce: Unauthorized access of dataCVE-2026-1748 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve invoice clients, invoice items, and list of WordPress users along with their emails.
Product
Invoct – PDF Invoices & Billing for WooCommerce
Affected
up to 1.6
What to do
Affects up to 1.6. Update Invoct – PDF Invoices & Billing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2026Link Invoice Payment for WooCommerce: Unauthorized modification of dataCVE-2025-14971 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createPartialPayment and cancelPartialPayment functions in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create partial payments on any order or cancel any existing partial payment via ID enumeration.
Product
Link Invoice Payment for WooCommerce
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update Link Invoice Payment for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026QR Code for WooCommerce order emails, PDF invoices, packing slips: Stored Cross-Site ScriptingCVE-2025-14626 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.9.42 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
QR Code for WooCommerce order emails, PDF invoices, packing slips
Affected
up to 1.9.42
What to do
Affects up to 1.9.42. Update QR Code for WooCommerce order emails, PDF invoices, packing slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 30, 2025E-Invoice App Malaysia: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-68988 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.
Product
E-Invoice App Malaysia
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update E-Invoice App Malaysia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Print Invoice & Delivery Notes for WooCommerce: Remote Code ExecutionCVE-2025-13773 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.8.0 via the 'WooCommerce_Delivery_Notes::update' function. This is due to missing capability check in the 'WooCommerce_Delivery_Notes::update' function, PHP enabled in Dompdf, and missing escape in the 'template.php' file. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025Easy Invoice: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-6324 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based XSS.This issue affects Easy Invoice: from n/a through <= 2.0.9.
Product
Easy Invoice
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
Product
Client Invoicing by Sprout Invoices
Affected
up to 20.8.7
What to do
Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025PDF Invoice Builder for WooCommerce: Deserialization of Untrusted DataCVE-2025-60083 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.
Product
PDF Invoice Builder for WooCommerce
Affected
up to 6.5.0
What to do
Affects up to 6.5.0. Update PDF Invoice Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 9, 2025WooCommerce PDF Invoices & Packing Slips: Missing AuthorizationCVE-2025-67589 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.
Product
WooCommerce PDF Invoices & Packing Slips
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update WooCommerce PDF Invoices & Packing Slips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 21, 2025Easy Invoice: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-66115 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a through <= 2.1.4.
Product
Easy Invoice
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 13, 2025WooCommerce PDF Invoice Builder: Missing AuthorizationCVE-2025-64269 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.150.
Product
WooCommerce PDF Invoice Builder
Affected
up to 1.2.150
What to do
Affects up to 1.2.150. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.