Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,066 results · page 103 of 282
Jul 27, 2026Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.CVE-2026-66442 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.CVE-2026-66438 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.CVE-2026-66437 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.CVE-2026-66434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.CVE-2026-66433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.CVE-2026-66428 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.CVE-2026-66427 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.CVE-2026-65568 · WordPress plugins & themes · reported by PatchstackMedium 5
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.CVE-2026-65567 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.CVE-2026-65564 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.CVE-2026-65563 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.CVE-2026-65562 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.CVE-2026-65561 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.CVE-2026-65558 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.CVE-2026-65557 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.CVE-2026-65436 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.CVE-2026-65435 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.CVE-2026-65434 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.CVE-2026-65433 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.CVE-2026-59560 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.CVE-2026-59559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.CVE-2026-59558 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.CVE-2026-59557 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.CVE-2026-59556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.CVE-2026-59553 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.CVE-2026-59552 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.CVE-2026-59551 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.CVE-2026-59550 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.CVE-2026-59549 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions.CVE-2026-59548 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.CVE-2026-59546 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.CVE-2026-59539 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.CVE-2026-59538 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.CVE-2026-59537 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.CVE-2026-59536 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.CVE-2026-59535 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.CVE-2026-59534 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.CVE-2026-59533 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.CVE-2026-59532 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.CVE-2026-59531 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.CVE-2026-59530 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.CVE-2026-59529 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.CVE-2026-59528 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-59527 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attaCVE-2026-65879 · Websites & servers · reported by security@joomla.orgCritical 9.8
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletCVE-2026-65878 · Websites & servers · reported by security@joomla.orgHigh 8.3
Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager seaCVE-2026-65877 · Websites & servers · reported by security@joomla.orgHigh 8.2
Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles CVE-2026-65876 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content eCVE-2026-65766 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to pCVE-2026-65765 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.