Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,830 results · page 10 of 37
Mar 23, 2026Woocommerce Custom Product Addons Pro: Remote Code ExecutionCVE-2026-4001 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).
- Product
- Woocommerce Custom Product Addons Pro
- Affected
- up to 5.4.1
- What to do
- Affects up to 5.4.1. Update Woocommerce Custom Product Addons Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordacowebs.comwordfence.com
Mar 23, 2026Smart Custom Fields: Unauthorized access of dataCVE-2026-4066 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to read private and draft post content from other authors via the smart-cf-relational-posts-search AJAX action. The function queries posts with post_status=any and returns full WP_Post objects including post_content, but only checks the generic edit_posts capability instead of verifying whether the requesting user has permission to read each individual post.
- Product
- Smart Custom Fields
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Smart Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026Import and export users and customers: Privilege escalationCVE-2026-3629 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user meta keys can be updated via profile fields. The 'get_restricted_fields' method does not include sensitive meta keys such as 'wp_capabilities'. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator by submitting a crafted registration request that sets the 'wp_capabilities' meta key. The vulnerability can only be exploited if the "Show fields in profile" setting is enabled and a CSV with a wp_capabilities column header has been previously imported.
- Product
- Import and export users and customers
- Affected
- up to 1.29.7
- What to do
- Affects up to 1.29.7. Update Import and export users and customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026Sherk Custom Post Type Displays: Stored Cross-Site ScriptingCVE-2026-3554 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. Specifically, in the sherkcptdisplays_func() function in includes/SherkCPTDisplaysShortcode.php, the 'title' attribute value is extracted from shortcode_atts() on line 19 and directly concatenated into an HTML <h2> tag on line 31 without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Sherk Custom Post Type Displays
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Sherk Custom Post Type Displays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 21, 2026UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2026-2294 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_global_settings' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings.
- Product
- UiPress lite | Effortless custom dashboards, admin themes and pages
- Affected
- up to 3.5.09
- What to do
- Affects up to 3.5.09. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 21, 2026Fonts Manager | Custom Fonts: Time-based SQL InjectionCVE-2026-1800 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Fonts Manager | Custom Fonts
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Fonts Manager | Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2026EmailKit – Email Customizer for WooCommerce & WP: Arbitrary file readCVE-2026-3474 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 1.6.3. This is due to the action() function in the TemplateData class passing user-supplied input from the 'emailkit-editor-template' REST API parameter directly to file_get_contents() without any path validation, sanitization, or restriction to an allowed directory. This makes it possible for authenticated attackers, with Administrator-level access, to read arbitrary files on the server (such as /etc/passwd or wp-config.php) by supplying a traversal path. The file contents are stored as post meta and can subsequently be retrieved via the fetch-data REST API endpoint. Notably, the CheckForm class in the same plugin implements proper path validation using realpath() and directory restriction, demonstrating that the developer was aware of the risk but failed to apply the same protections to the TemplateData endpoint.
- Product
- EmailKit – Email Customizer for WooCommerce & WP
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update EmailKit – Email Customizer for WooCommerce & WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2026TotalContest Lite: Deserialization of Untrusted DataCVE-2026-0677 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Object Injection.This issue affects TotalContest Lite: from n/a through <= 2.9.1.
- Product
- TotalContest Lite
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update TotalContest Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2026CM Custom Reports – Flexible reporting to track what matters most: Stored Cross-Site ScriptingCVE-2026-2432 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- CM Custom Reports – Flexible reporting to track what matters most
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update CM Custom Reports – Flexible reporting to track what matters most to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 19, 2026WishList Member X: Deserialization of Untrusted DataCVE-2026-25445 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0.
- Product
- WishList Member X
- Affected
- up to 3.29.0
- What to do
- Affects up to 3.29.0. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Finag: Deserialization of Untrusted DataCVE-2025-60237 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.
- Product
- Finag
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Finag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Zuut: Deserialization of Untrusted DataCVE-2025-60233 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.
- Product
- Zuut
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Zuut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Add Custom Fields to Media: Cross-Site Request ForgeryCVE-2026-4068 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Add Custom Fields to Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.3. This is due to missing nonce validation on the field deletion functionality in the admin display template. The plugin properly validates a nonce for the 'add field' operation (line 24-36), but the 'delete field' operation (lines 38-49) processes the $_GET['delete'] parameter and calls update_option() without any nonce verification. This makes it possible for unauthenticated attackers to delete arbitrary custom media fields via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Add Custom Fields to Media
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Add Custom Fields to Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 19, 2026ColorFolio - Freelance Designer: Deserialization of Untrusted DataCVE-2026-27096 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.
- Product
- ColorFolio - Freelance Designer
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update ColorFolio - Freelance Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2026Traveler: Deserialization of Untrusted DataCVE-2026-25449 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Mar 16, 2026Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types: Insecure Direct Object ReferenceCVE-2026-1883 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the delete_folders() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders created by other users.
- Product
- Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 13, 2026JetEngine: Deserialization of Untrusted DataCVE-2026-32355 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
- Product
- JetEngine
- What to do
- Update JetEngine to the newest version.
Mar 13, 2026the customCss field that: WpDiscuz before 7.6.47 contains a cross-site scriptingCVE-2026-22209 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like </style><script>alert(1)</script> in the custom CSS setting to execute arbitrary JavaScript in user browsers.
- Product
- the customCss field that
- Fixed in
- 7.6.47
- What to do
- Update the customCss field that to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 6, 2026CM Custom Reports: Reflected Cross-Site ScriptingCVE-2026-2431 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date_from' and 'date_to' parameters in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- CM Custom Reports
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update CM Custom Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2026B2BKing Premium: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-28106 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugins B2BKing Premium allows Phishing.This issue affects B2BKing Premium: from n/a before 5.4.20.
- Product
- B2BKing Premium
- Fixed in
- 5.4.20
- What to do
- Update B2BKing Premium to 5.4.20 or newer.
Mar 5, 2026Royal Elementor Addons: Inclusion of Functionality from Untrusted Control SphereCVE-2026-28135 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Inclusion of Functionality from Untrusted Control Sphere vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1052.
- Product
- Royal Elementor Addons
- Affected
- up to 1.7.1052
- What to do
- Affects up to 1.7.1052. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Good Energy: Deserialization of Untrusted DataCVE-2026-28105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.
- Product
- Good Energy
- Affected
- up to 1.7.7
- What to do
- Affects up to 1.7.7. Update Good Energy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Pizza House: Deserialization of Untrusted DataCVE-2026-28074 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.
- Product
- Pizza House
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Pizza House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Justitia: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27995 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Justitia justitia allows PHP Local File Inclusion.This issue affects Justitia: from n/a through <= 1.1.0.
- Product
- Justitia
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Justitia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Dentario: Deserialization of Untrusted DataCVE-2026-27439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.
- Product
- Dentario
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Dentario to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Kingler: Deserialization of Untrusted DataCVE-2026-27438 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.
- Product
- Kingler
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Kingler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Tennis Club: Deserialization of Untrusted DataCVE-2026-27437 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.
- Product
- Tennis Club
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Tennis Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Sweet Date: Deserialization of Untrusted DataCVE-2026-27417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.
- Product
- Sweet Date
- What to do
- Update Sweet Date to the newest version.
Mar 5, 2026NextScripts: Deserialization of Untrusted DataCVE-2026-27379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.
- Product
- NextScripts
- Affected
- up to 4.4.7
- What to do
- Affects up to 4.4.7. Update NextScripts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Celeste: Deserialization of Untrusted DataCVE-2026-27369 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.
- Product
- Celeste
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Celeste to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Car Zone: Deserialization of Untrusted DataCVE-2026-27338 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
- Product
- Car Zone
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Car Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Au Pair Agency - Babysitting & Nanny: Deserialization of Untrusted DataCVE-2026-27098 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.
- Product
- Au Pair Agency - Babysitting & Nanny
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Au Pair Agency - Babysitting & Nanny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Podlove Web Player: Deserialization of Untrusted DataCVE-2026-24385 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in gerritvanaaken Podlove Web Player podlove-web-player allows Object Injection.This issue affects Podlove Web Player: from n/a through <= 5.9.1.
- Product
- Podlove Web Player
- Affected
- up to 5.9.1
- What to do
- Affects up to 5.9.1. Update Podlove Web Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026PowerPress Podcasting: Deserialization of Untrusted DataCVE-2026-23798 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: from n/a through <= 11.15.10.
- Product
- PowerPress Podcasting
- Affected
- up to 11.15.10
- What to do
- Affects up to 11.15.10. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Mounthood: Deserialization of Untrusted DataCVE-2026-22501 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1.3.2.
- Product
- Mounthood
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Mounthood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Jardi: Deserialization of Untrusted DataCVE-2026-22497 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2.
- Product
- Jardi
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Jardi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Estate: Deserialization of Untrusted DataCVE-2026-22475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.
- Product
- Estate
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Equestrian Centre: Deserialization of Untrusted DataCVE-2026-22474 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.
- Product
- Equestrian Centre
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Equestrian Centre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Dental Clinic: Deserialization of Untrusted DataCVE-2026-22473 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.
- Product
- Dental Clinic
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Dental Clinic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Secudeal Payments for Ecommerce: Deserialization of Untrusted DataCVE-2026-22471 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This issue affects Secudeal Payments for Ecommerce: from n/a through <= 1.1.
- Product
- Secudeal Payments for Ecommerce
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Secudeal Payments for Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Solaris: Deserialization of Untrusted DataCVE-2026-22454 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
- Product
- Solaris
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Solaris to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Pets Club: Deserialization of Untrusted DataCVE-2026-22453 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
- Product
- Pets Club
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Pets Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Handyman: Deserialization of Untrusted DataCVE-2026-22451 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.
- Product
- Handyman
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Grand Wedding: Deserialization of Untrusted DataCVE-2026-22417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.
- Product
- Grand Wedding
- What to do
- Update Grand Wedding to the newest version.
Mar 5, 2026Justicia: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22408 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Justicia justicia allows PHP Local File Inclusion.This issue affects Justicia: from n/a through <= 1.2.
- Product
- Justicia
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Justicia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Classter: Deserialization of Untrusted DataCVE-2025-54001 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.
- Product
- Classter
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Classter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 4, 2026Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder: Unauthorized modification of dataCVE-2026-1674 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the save_gutena_forms_schema() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to update option values to a structured array value on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values, that would, for example enable site user registration when it is explicitly disabled.
- Product
- Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 3, 2026The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPCVE-2026-1492 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including, 5.1.2. This is due to the plugin accepting a user-supplied role during membership registration without properly enforcing a server-side allowlist. This makes it possible for unauthenticated attackers to create administrator accounts by supplying a role value during membership registration.
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 26, 2026uListing: Deserialization of Untrusted DataCVE-2026-28138 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0.
- Product
- uListing
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2026User Registration & Membership – Custom Registration Form, Login Form, and User Profile: Insecure Direct Object ReferenceCVE-2026-2356 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'register_member' function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that newly registered on the site who has the 'urm_user_just_created' user meta set.
- Product
- User Registration & Membership – Custom Registration Form, Login Form, and User Profile
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update User Registration & Membership – Custom Registration Form, Login Form, and User Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.