Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

30added in the last 30 days

304new WordPress flaws this week

14,066entries in the database

11,556 results · page 101 of 232

Jul 21, 2026Academy LMS: Does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlersCVE-2026-14184 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.
Product
Academy LMS
Fixed in
3.8.1
What to do
Update Academy LMS to 3.8.1 or newer.
NVD record wpscan.com
Jul 21, 2026Classified Listing: Does not verify that the order targeted by its payment-receipt handler belongs to the requesting userCVE-2026-14183 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.
Product
Classified Listing
Fixed in
5.3.9
What to do
Update Classified Listing to 5.3.9 or newer.
NVD record wpscan.com
Jul 21, 2026Bit Form: Does not properly validate its workflow-trigger token once the associated transient has expiredCVE-2026-13694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.
Product
Bit Form
Fixed in
3.1.0
What to do
Update Bit Form to 3.1.0 or newer.
NVD record wpscan.com
Jul 21, 2026Bit Form: Does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification emailCVE-2026-13693 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
Product
Bit Form
Fixed in
3.1.0
What to do
Update Bit Form to 3.1.0 or newer.
NVD record wpscan.com
Jul 21, 2026Free Builder for Elementor: Does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboardCVE-2026-11767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in administrator views the form submissions.
Product
Free Builder for Elementor
Fixed in
1.6.7
What to do
Update Free Builder for Elementor to 1.6.7 or newer.
NVD record wpscan.com
Jul 21, 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Stored Cross-Site ScriptingCVE-2026-15782 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the OptinMonster plugin to be installed and configured with an active inline campaign that outputs matching #om-{id} markup on the target page, as the WPForms handler only fires when OptinMonster emits its 'om.Campaign.load' event.
Product
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
Affected
up to 2.0.0.1
What to do
Affects up to 2.0.0.1. Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2026Easy Form Builder by WhiteStudio: Unauthenticated Privilege Escalation to AdministratorCVE-2026-13439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.
Product
Easy Form Builder by WhiteStudio
Affected
up to 4.0.11
What to do
Affects up to 4.0.11. Update Easy Form Builder by WhiteStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 21, 2026Essential Addons for Elementor – Popular Elementor Templates & Widgets: Stored Cross-Site ScriptingCVE-2026-15156 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Popular Elementor Templates & Widgets
Affected
up to 6.6.11
What to do
Affects up to 6.6.11. Update Essential Addons for Elementor – Popular Elementor Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 20, 2026Spectra Gutenberg Blocks – Website Builder for the Block Editor: Stored Cross-Site ScriptingCVE-2026-12900 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `uagb/image` block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Spectra Gutenberg Blocks – Website Builder for the Block Editor
Affected
up to 2.19.28
What to do
Affects up to 2.19.28. Update Spectra Gutenberg Blocks – Website Builder for the Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 20, 2026Tag Groups is the Advanced Way to Display Your Taxonomy Terms: Does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content typeCVE-2026-9833 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
Product
Tag Groups is the Advanced Way to Display Your Taxonomy Terms
Fixed in
2.2.0
What to do
Update Tag Groups is the Advanced Way to Display Your Taxonomy Terms to 2.2.0 or newer.
NVD record wpscan.com
Jul 20, 2026Elementor Website Builder: Does not properly check user permissions before returning post data through one of its REST endpointsCVE-2026-8825 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
Product
Elementor Website Builder
Fixed in
4.1.4
What to do
Update Elementor Website Builder to 4.1.4 or newer.
NVD record wpscan.com
Jul 20, 2026ThumbPress: Does not perform a capability check on one of its AJAX actionsCVE-2026-13432 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site's image-handling functionality.
Product
ThumbPress
Fixed in
6.2.2
What to do
Update ThumbPress to 6.2.2 or newer.
NVD record wpscan.com
Jul 20, 2026MailerSend: Does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce)CVE-2026-13156 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8's SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site's email delivery.
Product
MailerSend
Fixed in
1.0.8
What to do
Update MailerSend to 1.0.8 or newer.
NVD record wpscan.com
Jul 20, 2026Kirki: Does not validate a user-supplied URL before requesting it server-sideCVE-2026-13147 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Product
Kirki
Fixed in
6.0.12
What to do
Update Kirki to 6.0.12 or newer.
NVD record wpscan.com
Jul 20, 2026Social Login, Passkeys, Magic Link & Email OTP: Does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verificationCVE-2026-13142 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Product
Social Login, Passkeys, Magic Link & Email OTP
Fixed in
1.4.1
What to do
Update Social Login, Passkeys, Magic Link & Email OTP to 1.4.1 or newer.
NVD record wpscan.com
Jul 20, 2026PayPlus Payment Gateway: Does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated usersCVE-2026-12973 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.
Product
PayPlus Payment Gateway
Fixed in
8.2.2
What to do
Update PayPlus Payment Gateway to 8.2.2 or newer.
NVD record wpscan.com
Jul 20, 2026PayPlus Payment Gateway: Does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated usersCVE-2026-12972 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.
Product
PayPlus Payment Gateway
Fixed in
8.2.2
What to do
Update PayPlus Payment Gateway to 8.2.2 or newer.
NVD record wpscan.com
Jul 20, 2026LearnPress: Does not escape a search parameter before reflecting it into an HTML attributeCVE-2026-12970 · WordPress plugins & themes · reported by WPScanHigh 7.1
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
Product
LearnPress
Fixed in
4.4.1
What to do
Update LearnPress to 4.4.1 or newer.
NVD record wpscan.com
Jul 20, 2026All-in-One WP Migration and Backup: Does not properly sanitise a user-supplied value before using it to build a file pathCVE-2026-12898 · WordPress plugins & themes · reported by WPScanMedium 6.5
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Product
All-in-One WP Migration and Backup
Fixed in
7.106
What to do
Update All-in-One WP Migration and Backup to 7.106 or newer.
NVD record wpscan.com
Jul 20, 2026Kirki: Does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sendsCVE-2026-12724 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a request before including them in the password-reset email it sends as HTML, allowing unauthenticated users to inject arbitrary HTML into the message delivered to a registered user, which can be used for phishing.
Product
Kirki
Fixed in
6.0.12
What to do
Update Kirki to 6.0.12 or newer.
NVD record wpscan.com
Jul 20, 2026Kirki: Does not perform any authorisation check on one of its REST routesCVE-2026-12723 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.
Product
Kirki
Fixed in
6.0.12
What to do
Update Kirki to 6.0.12 or newer.
NVD record wpscan.com
Jul 20, 2026SlimStat Analytics: Does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reportsCVE-2026-12592 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the reports. Exploitation requires the SlimStat Analytics WordPress plugin before 5.5.0 to be configured to use the Cloudflare geolocation provider.
Product
SlimStat Analytics
Fixed in
5.5.0
What to do
Update SlimStat Analytics to 5.5.0 or newer.
NVD record wpscan.com
Jul 20, 2026WP Travel: Does not perform capability or ownership checks on its booking cancellation actionCVE-2026-11868 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Product
WP Travel
Fixed in
11.7.1
What to do
Update WP Travel to 11.7.1 or newer.
NVD record wpscan.com
Jul 20, 2026Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite: Do not sanitise and escape a request parameter before using it in a SQL statementCVE-2026-11349 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Product
Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite
Fixed in
7.34.0
What to do
Update Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite to 7.34.0 or newer.
NVD record wpscan.com
Jul 20, 2026All in One SEO: Does not correctly restrict access to some of its AI integration REST API endpointsCVE-2026-10755 · WordPress plugins & themes · reported by WPScanLow 2.7
The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state.
Product
All in One SEO
Fixed in
4.9.9
What to do
Update All in One SEO to 4.9.9 or newer.
NVD record wpscan.com
Jul 20, 2026Reviews Feed: Does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic blockCVE-2026-10724 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode in a review on the connected source.
Product
Reviews Feed
Fixed in
2.6.5
What to do
Update Reviews Feed to 2.6.5 or newer.
NVD record wpscan.com
Jul 20, 2026Unlimited Elements For Elementor: Does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget outputCVE-2026-10081 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews.
Product
Unlimited Elements For Elementor
Fixed in
2.0.11
What to do
Update Unlimited Elements For Elementor to 2.0.11 or newer.
NVD record wpscan.com
Jul 18, 2026The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page.CVE-2026-57857 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the error_message GET parameter is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57-58) without input sanitization (for example sanitize_text_field()) or output escaping (for example esc_html()) before being rendered in the checkout notice HTML. An unauthenticated attacker can craft a URL containing a JavaScript payload in the error_message parameter (for example /checkout/?add-to-cart={product-id}&cancel_order=true&error_message={payload}); when a victim with an active WooCommerce checkout session follows the link, the payload executes in the victim's browser in the origin of the WordPress site.
What to do
Update the plugin to the newest version.
NVD record flow.cl vulncheck.com
Jul 18, 2026W3SC Elementor to Zoho CRM: Cross-Site Request ForgeryCVE-2026-9734 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's Zoho CRM integration settings, replacing the configured data center, client ID, client secret, and user email credentials with attacker-controlled values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
W3SC Elementor to Zoho CRM
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update W3SC Elementor to Zoho CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026WordPress Core Interpretation Conflict VulnerabilityCVE-2026-63030 · WordPress plugins & themes · reported by WPScanExploitedCritical 9.8
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
Product
Core
Fixed in
6.9.5
On CISA’s list since
Jul 21, 2026 (federal fix deadline Jul 24, 2026)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog github.com wordpress.org
Jul 17, 2026WordPress Core SQL Injection VulnerabilityCVE-2026-60137 · WordPress plugins & themes · reported by WPScanExploitedMedium 5.9
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
Product
Core
Fixed in
6.8.6
On CISA’s list since
Jul 21, 2026 (federal fix deadline Aug 4, 2026)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
NVD record CISA catalog github.com wordpress.org
Jul 17, 2026HubSpot All-In-One Marketing – Forms, Popups, Live Chat: Sensitive Information ExposureCVE-2026-9656 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wp_localize_script() / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's plaintext HubSpot OAuth refresh token exposed via the window.leadinConfig JavaScript object, which can then be used to access or modify data in the connected HubSpot tenant. Although the refresh token is stored at rest with AES-256-CTR encryption, decryption occurs server-side before the plaintext value is passed to wp_localize_script(), rendering the at-rest encryption ineffective against this exposure path.
Product
HubSpot All-In-One Marketing – Forms, Popups, Live Chat
Affected
up to 11.3.62
What to do
Affects up to 11.3.62. Update HubSpot All-In-One Marketing – Forms, Popups, Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026AI Copilot: Does not bind OAuth access tokens to a WordPress userCVE-2026-9810 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.
Product
AI Copilot
Fixed in
1.5.4
What to do
Update AI Copilot to 1.5.4 or newer.
NVD record wpscan.com
Jul 17, 2026Royal Addons for Elementor: Does not check the post status of menu items or the templates they reference in one of its REST endpointsCVE-2026-13402 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from non-public navigation menu items.
Product
Royal Addons for Elementor
Fixed in
1.7.1063
What to do
Update Royal Addons for Elementor to 1.7.1063 or newer.
NVD record wpscan.com
Jul 17, 2026WPS Bookings for WooCommerce: Does not verify that a booking order belongs to the requesting user before cancelling itCVE-2026-12393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.
Product
WPS Bookings for WooCommerce
Fixed in
3.11.7
What to do
Update WPS Bookings for WooCommerce to 3.11.7 or newer.
NVD record wpscan.com
Jul 17, 2026User Registration & Membership: Does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifierCVE-2026-11966 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.
Product
User Registration & Membership
Fixed in
5.2.3
What to do
Update User Registration & Membership to 5.2.3 or newer.
NVD record wpscan.com
Jul 17, 2026User Registration & Membership: Does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user roleCVE-2026-11961 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.
Product
User Registration & Membership
Fixed in
5.2.3
What to do
Update User Registration & Membership to 5.2.3 or newer.
NVD record wpscan.com
Jul 17, 2026PhonePe Payment Solutions: Does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flowCVE-2026-11575 · WordPress plugins & themes · reported by WPScanHigh 7.5
The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-success notification and mark unpaid WooCommerce orders as paid without any payment being made.
Product
PhonePe Payment Solutions
Fixed in
3.1.0
What to do
Update PhonePe Payment Solutions to 3.1.0 or newer.
NVD record wpscan.com
Jul 17, 2026NEX-Forms: Does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboardCVE-2026-10525 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries.
Product
NEX-Forms
Fixed in
9.2.3
What to do
Update NEX-Forms to 9.2.3 or newer.
NVD record wpscan.com
Jul 17, 2026Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit: Privilege EscalationCVE-2026-15982 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.
Product
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record coderevolution.ro wordfence.com
Jul 17, 2026WP Hotel Booking: Reflected Cross-Site ScriptingCVE-2026-15094 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Hotel Booking
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form: Stored Cross-Site ScriptingCVE-2026-15759 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Directory TraversalCVE-2026-15457 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete arbitrary directories on the server, which can result in loss of data and availability.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.0.13
What to do
Affects up to 6.0.13. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce: Authorization bypassCVE-2026-15349 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.17.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary company locations in the ERP database.
Product
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
Affected
up to 1.17.6
What to do
Affects up to 1.17.6. Update ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Ninja Forms - Excel Export: Stored Cross-Site ScriptingCVE-2026-15161 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() AJAX handler storing the raw $_POST['filter'] array into a WordPress option via update_option() without any capability check, nonce verification, or input sanitization, combined with the get_filter_row() method on the admin Excel Export screen concatenating the stored filter values (field_key, condition, value) directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms - Excel Export
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Ninja Forms - Excel Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Jul 17, 2026pCloud WP Backup: Sensitive Information ExposureCVE-2026-14503 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_inner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a full-site backup archive written to a publicly accessible directory, exposing wp-config.php database credentials, WordPress secret salts, and the complete PHP source tree. The resulting archive is deposited in the plugin's unprotected tmp/ directory at a predictable URL, making the extracted data accessible to unauthenticated visitors once the backup is triggered.
Product
pCloud WP Backup
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update pCloud WP Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-13765 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including questions belonging to paid courses the attacker is not enrolled in.
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Arbitrary File UploadCVE-2026-13352 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the global WordPress MIME allowlist, without scoping the expansion to digital-product upload contexts. This makes it possible for authenticated attackers, with author-level access and above, to upload files that may be executable, which makes remote code execution possible. This filter is registered globally on every request regardless of whether the digital products feature is configured or in use, meaning the expanded MIME allowlist affects all WordPress upload contexts site-wide.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.16.18
What to do
Affects up to 4.16.18. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Fense Proxy & VPN Blocker: Unauthorized modification of dataCVE-2026-8616 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce validation on the fense_bpvt_save_settings() function in versions up to, and including, 3.0.1. The callback is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks and unconditionally calls delete_option() on four plugin options and delete_transient() on three transients tied to the plugin's API key cache and settings. This makes it possible for unauthenticated attackers to delete plugin options and transients, effectively resetting the plugin's API key/data cache and forcing the plugin to refetch state.
Product
Fense Proxy & VPN Blocker
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Fense Proxy & VPN Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2026Kali Forms — Contact Form & Drag-and-Drop Builder: Stored Cross-Site ScriptingCVE-2026-15395 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to, and including, 2.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form-submission nonce is publicly available on any page containing the form shortcode, making this exploitable by fully unauthenticated attackers without any precondition beyond the form being published.
Product
Kali Forms — Contact Form & Drag-and-Drop Builder
Affected
up to 2.4.18
What to do
Affects up to 2.4.18. Update Kali Forms — Contact Form & Drag-and-Drop Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.