Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Oct 16, 2026WSP MCP AI Agents Connector: Sensitive Information DisclosureCVE-2026-109382 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site.
- Product
- WSP MCP AI Agents Connector
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update WSP MCP AI Agents Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 23, 2026Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.CVE-2026-93529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.CVE-2026-84779 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.
- Affected
- up to 1.51.0
- What to do
- Affects up to 1.51.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2026WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts thCVE-2019-25742 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execute when administrators view the property for approval, enabling cookie theft and session hijacking.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordfruitfulcode.comthemeforest.net
Dec 5, 2025Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents: Cross-Site Request ForgeryCVE-2025-12189 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.11.1374. This is due to missing or incorrect nonce validation on the uploadImage() function. This makes it possible for unauthenticated attackers to upload arbitrary files that make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents
- Affected
- up to 7.11.1374
- What to do
- Affects up to 7.11.1374. Update Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 16, 2023User Activity Log Pro: Does not properly escape recorded User-Agents in the user activity logs dashboardCVE-2023-5167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.
- Product
- User Activity Log Pro
- Fixed in
- 2.3.4
- What to do
- Update User Activity Log Pro to 2.3.4 or newer.
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statementCVE-2023-2805 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- SupportCandy
- Fixed in
- 3.1.7
- What to do
- Update SupportCandy to 3.1.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.