Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

546new WordPress flaws this week

391,964entries in the database

24,230 results · page 104 of 485

Jun 6, 2026SEO Plugin by Squirrly SEO: Authorization bypassCVE-2026-7624 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to invoke privileged state-changing Squirrly cloud API operations, such as revoking the site's Google Search Console and Google Analytics integrations via `api/gsc/revoke` and `api/ga/revoke`, that are otherwise restricted to administrator-level users holding the `sq_manage_settings` capability.
Product
SEO Plugin by Squirrly SEO
Affected
up to 12.4.16
What to do
Affects up to 12.4.16. Update SEO Plugin by Squirrly SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026OptinCraft – Drag & Drop Optins & Popup Builder for: Generic SQL InjectionCVE-2026-8978 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The OptinCraft – Drag & Drop Optins & Popup Builder for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
OptinCraft – Drag & Drop Optins & Popup Builder for
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update OptinCraft – Drag & Drop Optins & Popup Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-8502 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'return_type' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the plaintext post_password of password-protected courses and the full post_content, post_author, and post_name of unpublished draft, private, and pending courses via the unrestricted SELECT * fallback query. Exploitation requires supplying both c_status=all (to bypass the publish-only post_status WHERE clause) and return_type=json (to prevent the safe DISTINCT(ID) AS ID field override) in a single unauthenticated request to the /wp-json/lp/v1/courses/archive-course endpoint.
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More: Insufficient Verification of Data AuthenticityCVE-2026-7792 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to and including 1.10.0.1. This is due to the PayPal Commerce webhook endpoint processing unauthenticated JSON webhook payloads without verifying that the request originated from PayPal using the required HMAC-SHA256 webhook signature, and only checking whether the supplied event_type is whitelisted before dispatching the attacker-controlled resource data to handlers that update payment records. This makes it possible for unauthenticated attackers who know a valid PayPal subscription_id to forge PayPal webhook events and modify subscription payment records, such as reactivating a cancelled or suspended subscription by setting its subscription_status to active.
Product
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Affected
up to 1.10.0.1
What to do
Affects up to 1.10.0.1. Update WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026Essential Addons for Elementor – Popular Elementor Templates & Widgets: Information ExposureCVE-2026-7665 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
Product
Essential Addons for Elementor – Popular Elementor Templates & Widgets
Affected
up to 6.6.4
What to do
Affects up to 6.6.4. Update Essential Addons for Elementor – Popular Elementor Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026LearnPress – Backup & Migration Tool: PHP Object InjectionCVE-2026-7566 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
LearnPress – Backup & Migration Tool
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update LearnPress – Backup & Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026LearnPress – Backup & Migration Tool: Arbitrary File ReadCVE-2026-7565 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including, 4.1.4 via the 'import-user-file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
LearnPress – Backup & Migration Tool
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update LearnPress – Backup & Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits: Stored Cross-Site ScriptingCVE-2026-9281 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.
Product
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Page-list: Missing AuthorizationCVE-2026-9008 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist_unqprfx_ext_shortcode() function (the [pagelist_ext] / [pagelistext] shortcode) accepting attacker-controlled post_status, post_type, and show_meta_key attributes and passing them directly into get_pages() and get_post_meta() with no capability check verifying that the rendering user is permitted to read the matched objects. When the current post has no child pages, the shortcode re-issues the query with child_of => 0, broadening it to every page on the site matching the supplied status/type. This makes it possible for authenticated attackers, with contributor-level access and above, to disclose the titles, body content/excerpts, and arbitrary post meta of unrelated private and draft pages by inserting the shortcode into a contributor-authored draft and previewing it.
Product
Page-list
Affected
up to 6.2
What to do
Affects up to 6.2. Update Page-list to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More: Stored Cross-Site ScriptingCVE-2026-8901 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Submission Data in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes when a CRM API call fails for the submitted form and an administrator subsequently views the error log details modal in the WordPress admin panel.
Product
Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026WP User Manager – User Profile Builder & Membership: Local File InclusionCVE-2026-9290 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WP User Manager – User Profile Builder & Membership
Affected
up to 2.9.17
What to do
Affects up to 2.9.17. Update WP User Manager – User Profile Builder & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 5, 2026RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Authorization bypassCVE-2026-8976 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create and execute RSS import jobs, purge (force-delete) all posts associated with any import job, clear import error logs, and enumerate taxonomy terms and post meta_key names. The nonce required to reach these sub-handlers is leaked to any user with the edit_posts capability via the feedzyjs localized script injected into the block editor, meaning no privileged nonce theft or separate exploit step is required for Contributor-level users.
Product
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
Affected
up to 5.1.7
What to do
Affects up to 5.1.7. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Event Monster – Event Management, Events Calendar, Tickets: Insufficient Verification of Data AuthenticityCVE-2026-8608 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capture_payment() AJAX handler (registered via wp_ajax_nopriv_em_capture_payment) trusting client-supplied payment data — including transaction ID, amount, and payment status — without performing any server-side verification against the PayPal API or any other payment gateway, and without nonce or capability checks. This makes it possible for unauthenticated attackers to forge payment records, mark bookings as Completed, and obtain confirmation emails containing valid QR code tickets without making any actual payment.
Product
Event Monster – Event Management, Events Calendar, Tickets
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Event Monster – Event Management, Events Calendar, Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Time-based blind SQL InjectionCVE-2026-6448 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. If the secret key is exposed, this can be exploited by lower-privileged users.
Product
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Affected
up to 11.1.2
What to do
Affects up to 11.1.2. Update Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment DeletionCVE-2026-10038 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user's 'avatar' meta without validating that the attachment is owned by the user, combined with Charitable_Data_Processor::process_picture() returning the raw posted value when no file is uploaded, allowing the 'avatar' user meta to be poisoned with any attacker-chosen attachment ID. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary attachments from the Media Library by performing a two-request chain (first poisoning the stored avatar meta value with a target attachment ID, then triggering deletion via a normal avatar upload).
Product
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Affected
up to 1.8.11.1
What to do
Affects up to 1.8.11.1. Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Migration, Backup, Staging – WPvivid Backup & Migration: Arbitrary directory deletionCVE-2025-12656 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
Product
Migration, Backup, Staging – WPvivid Backup & Migration
Affected
up to 0.9.128
What to do
Affects up to 0.9.128. Update Migration, Backup, Staging – WPvivid Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Admin Columns: PHP Object Injection leading to Remote Code ExecutionCVE-2026-7654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of `unserialize()` without an `allowed_classes` restriction in the `IdsToCollection::get_ids_from_string()` function, which processes attacker-controlled post meta values without proper validation. This makes it possible for authenticated attackers with Contributor-level access and above to inject a serialized PHP object into a post's custom meta field and trigger arbitrary code execution by exploiting a bundled POP gadget chain, resulting in remote code execution as the web server user.
Product
Admin Columns
Affected
up to 7.0.18
What to do
Affects up to 7.0.18. Update Admin Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Alba Board: Authorization bypassCVE-2026-7523 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Alba Board plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access arbitrary private alba_card post data, including title, description, assignee, due date, tags, and comments, that is intended to be restricted to Administrators and Editors. The handler is registered via the wp_ajax_nopriv_ hook and its nonce is exposed to all site visitors through wp_localize_script on pages containing the [alba_board] shortcode, making this exploitable by unauthenticated users who can access any such page.
Product
Alba Board
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Alba Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug): Authentication BypassCVE-2026-5415 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via wp_localize_script() on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.
Product
WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug)
Affected
up to 5.38
What to do
Affects up to 5.38. Update WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record getwpcaptcha.com wordfence.com
Jun 5, 2026WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug): Arbitrary file uploadCVE-2026-5411 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.
Product
WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug)
Affected
up to 5.38
What to do
Affects up to 5.38. Update WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record getwpcaptcha.com wordfence.com
Jun 5, 2026Hippoo Mobile App for WooCommerce: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-10580 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a {"password":"<new_password>"} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.
Product
Hippoo Mobile App for WooCommerce
Affected
up to 1.9.4
What to do
Affects up to 1.9.4. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Product Slider Pro for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-49777 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.
Product
Product Slider Pro for WooCommerce
Fixed in
3.5.4
What to do
Update Product Slider Pro for WooCommerce to 3.5.4 or newer.
Full record and what to do →NVD record patchstack.com
Jun 4, 2026WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database qCVE-2019-25745 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jun 4, 2026WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by eCVE-2019-25738 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.framework-y.com wordpress.framework-y.com
Jun 4, 2026Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to includCVE-2019-25734 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Contact Form by WD 1.13.1 contains a cross-site request forgery vulnerability combined with local file inclusion that allows unauthenticated attackers to include arbitrary files by exploiting unsanitized action parameters. Attackers can craft malicious forms targeting the admin-ajax.php endpoint with directory traversal sequences in the GET action parameter to load files via CSRF, bypassing authentication on vulnerable AJAX actions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record web-dorado.com wordpress.org
Jun 4, 2026WP eMember: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-49077 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data. This issue affects WP eMember: from n/a through v10.2.2.
Product
WP eMember
Affected
up to v10.2.2
What to do
Affects up to v10.2.2. Update WP eMember to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 4, 2026Photo Gallery by 10Web: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49771 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.
Product
Photo Gallery by 10Web
Affected
up to 1.8.41
What to do
Affects up to 1.8.41. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 3, 2026MasterStudy LMS Pro Plus: Generic SQL InjectionCVE-2026-8653 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MasterStudy LMS Pro Plus
Affected
up to 4.8.20
What to do
Affects up to 4.8.20. Update MasterStudy LMS Pro Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record stylemixthemes.com wordfence.com
Jun 3, 2026School Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-15655 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0.
Product
School Management
Affected
up to 93.2.0
What to do
Affects up to 93.2.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 3, 2026Prague: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-15654 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS. This issue affects Prague: from n/a through 2.2.8.
Product
Prague
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update Prague to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026ARMember Premium: SQL InjectionCVE-2026-5074 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_private_content_data` AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient sanitization of the user-supplied parameter which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if the "User Private Content" addon is enabled, which is disabled by default..
Product
ARMember Premium
Affected
up to 7.3.1
What to do
Affects up to 7.3.1. Update ARMember Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jun 2, 2026ARMember Premium: SQL InjectionCVE-2026-5073 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
ARMember Premium
Affected
up to 7.3.1
What to do
Affects up to 7.3.1. Update ARMember Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jun 2, 2026Content Visibility for Divi Builder: Remote Code ExecutionCVE-2026-1829 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_check' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Product
Content Visibility for Divi Builder
Affected
up to 4.02
What to do
Affects up to 4.02. Update Content Visibility for Divi Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2026Wallet System for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-42654 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation. This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.
Product
Wallet System for WooCommerce
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update Wallet System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026BookIt: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-40780 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.
Product
BookIt
Fixed in
2.5.4.1
What to do
Update BookIt to 2.5.4.1 or newer.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Elementor Website Builder: Missing AuthorizationCVE-2026-49782 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0.
Product
Elementor Website Builder
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Askka: Deserialization of Untrusted DataCVE-2026-39555 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.
Product
Askka
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Askka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026WaveRide: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39553 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.
Product
WaveRide
Affected
up to 1.4
What to do
Affects up to 1.4. Update WaveRide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Blueprint: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39552 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.
Product
Blueprint
Fixed in
1.1.5
What to do
Update Blueprint to 1.1.5 or newer.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Progress Planner: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28116 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emilia Projects Progress Planner allows Stored XSS. This issue affects Progress Planner: from n/a through 1.9.0.
Product
Progress Planner
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update Progress Planner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Crew HRM: Missing AuthorizationCVE-2026-27351 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM: from n/a through 1.2.2.
Product
Crew HRM
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Crew HRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Racquet: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69369 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.
Product
Racquet
Affected
up to 1.12.0
What to do
Affects up to 1.12.0. Update Racquet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Cookiteer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68886 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.
Product
Cookiteer
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Cookiteer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Fermentio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58897 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0.
Product
Fermentio
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Fermentio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Spin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58707 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.
Product
Spin
Affected
up to 1.8
What to do
Affects up to 1.8. Update Spin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026WP Job Portal: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42685 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.
Product
WP Job Portal
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026WP Job Portal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42684 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.
Product
WP Job Portal
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Five Star Restaurant Reservations: Missing AuthorizationCVE-2026-42670 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.
Product
Five Star Restaurant Reservations
Affected
up to 2.7.14
What to do
Affects up to 2.7.14. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026EventPrime: Missing AuthorizationCVE-2026-42669 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.
Product
EventPrime
Affected
up to 4.3.2.0
What to do
Affects up to 4.3.2.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Töbel: Deserialization of Untrusted DataCVE-2026-39551 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.
Product
Töbel
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Töbel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.