Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,756exploited flaws on CISA’s list

30added in the last 30 days

304new WordPress flaws this week

14,066entries in the database

14,066 results · page 104 of 282

Jul 27, 2026Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerabiCVE-2026-65764 · Websites & servers · reported by security@joomla.orgMedium 5.1
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
NVD record phoca.cz
Jul 27, 2026bookingpress-appointment-booking-pro: Does not correctly invoke its REST permission callbackCVE-2026-9830 · WordPress plugins & themes · reported by WPScanHigh 8.2
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.
Product
bookingpress-appointment-booking-pro
Fixed in
5.7.3
What to do
Update bookingpress-appointment-booking-pro to 5.7.3 or newer.
NVD record wpscan.com
Jul 27, 2026Calendar: Does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing pageCVE-2026-14827 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar.
Product
Calendar
Fixed in
1.3.18
What to do
Update Calendar to 1.3.18 or newer.
NVD record wpscan.com
Jul 27, 2026Quiz and Survey Master (QSM): Does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accountsCVE-2026-14820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.
Product
Quiz and Survey Master (QSM)
Fixed in
11.1.3
What to do
Update Quiz and Survey Master (QSM) to 11.1.3 or newer.
NVD record wpscan.com
Jul 27, 2026User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration: Does not correctly verify ownership before deleting an attachmentCVE-2026-14568 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.
Product
User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration
Fixed in
4.3.8
What to do
Update User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration to 4.3.8 or newer.
NVD record wpscan.com
Jul 27, 2026FacturaONE para WooCommerce con VeriFactu: Does not authenticate one of its request handlersCVE-2026-14289 · WordPress plugins & themes · reported by WPScanCritical 9
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.
Product
FacturaONE para WooCommerce con VeriFactu
Fixed in
5.37
What to do
Update FacturaONE para WooCommerce con VeriFactu to 5.37 or newer.
NVD record wpscan.com
Jul 27, 2026Contact Form 7: Does not validate the host of a user-supplied return URL before using itCVE-2026-14236 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.
Product
Contact Form 7
Fixed in
2.5
What to do
Update Contact Form 7 to 2.5 or newer.
NVD record wpscan.com
Jul 27, 2026Download Manager: Does not bind its temporary download token to the requesting session nor expire it promptlyCVE-2026-14235 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
Product
Download Manager
Fixed in
3.3.62
What to do
Update Download Manager to 3.3.62 or newer.
NVD record wpscan.com
Jul 27, 2026Smart Manager: Does not properly encode a post field before rendering it into an HTML attribute in its management gridCVE-2026-14203 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.
Product
Smart Manager
Fixed in
8.92.0
What to do
Update Smart Manager to 8.92.0 or newer.
NVD record wpscan.com
Jul 27, 2026Sina Extension for Elementor: Does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML responseCVE-2026-14190 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.
Product
Sina Extension for Elementor
Fixed in
3.10.2
What to do
Update Sina Extension for Elementor to 3.10.2 or newer.
NVD record wpscan.com
Jul 27, 2026WPBot: Does not validate administrator-configured field identifiers before using them in a SQL queryCVE-2026-14189 · WordPress plugins & themes · reported by WPScanLow 3.8
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
Product
WPBot
Fixed in
8.5.2
What to do
Update WPBot to 8.5.2 or newer.
NVD record wpscan.com
Jul 27, 2026MPG: Does not sanitise and escape a parameter before reflecting it back in the responseCVE-2026-13726 · WordPress plugins & themes · reported by WPScanHigh 7.1
The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
Product
MPG
Fixed in
4.1.8
What to do
Update MPG to 4.1.8 or newer.
NVD record wpscan.com
Jul 27, 2026Realtyna Organic IDX plugin + WPL Real Estate: Does not validate the type of uploaded filesCVE-2026-13714 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
Product
Realtyna Organic IDX plugin + WPL Real Estate
Fixed in
5.3.0
What to do
Update Realtyna Organic IDX plugin + WPL Real Estate to 5.3.0 or newer.
NVD record wpscan.com
Jul 27, 2026微信二维码登陆: Does not properly validate WeChat webhook requestsCVE-2026-13597 · WordPress plugins & themes · reported by WPScanCritical 9.1
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
Product
微信二维码登陆
Affected
up to 1.3
What to do
Affects up to 1.3. Update 微信二维码登陆 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Jul 27, 2026Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2.CVE-2026-13400 · WordPress plugins & themes · reported by WPScanMedium 6.1
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.
Affected
up to 1.6.12.2
Fixed in
1.6.12.4
What to do
Update the plugin to 1.6.12.4 or newer.
NVD record wpscan.com
Jul 27, 2026Events Calendar: Does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status valueCVE-2026-13390 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
Product
Events Calendar
Fixed in
6.16.5.1
What to do
Update Events Calendar to 6.16.5.1 or newer.
NVD record wpscan.com
Jul 27, 2026Masteriyo LMS: Does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessionsCVE-2026-13332 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
Product
Masteriyo LMS
Fixed in
2.3.1
What to do
Update Masteriyo LMS to 2.3.1 or newer.
NVD record wpscan.com
Jul 27, 2026Custom Fields Account Registration For Woocommerce: Does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefixCVE-2026-13152 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.
Product
Custom Fields Account Registration For Woocommerce
Fixed in
1.4
What to do
Update Custom Fields Account Registration For Woocommerce to 1.4 or newer.
NVD record wpscan.com
Jul 27, 2026Document Gallery: Does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX actionCVE-2026-12982 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
Product
Document Gallery
Fixed in
5.1.1
What to do
Update Document Gallery to 5.1.1 or newer.
NVD record wpscan.com
Jul 27, 2026Clover Payment Gateway by Zaytech for WooCommerce: Does not verify that an approved external payment record actually belongs to the WooCommerce order being completedCVE-2026-12493 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).
Product
Clover Payment Gateway by Zaytech for WooCommerce
Fixed in
1.3.6
What to do
Update Clover Payment Gateway by Zaytech for WooCommerce to 1.3.6 or newer.
NVD record wpscan.com
Jul 27, 2026MemberGlut: Does not validate the role chosen during front-end registrationCVE-2026-12394 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
Product
MemberGlut
Fixed in
1.1.5
What to do
Update MemberGlut to 1.1.5 or newer.
NVD record wpscan.com
Jul 27, 2026MainWP Child: Does not verify the requester's identity in its site-registration request handlerCVE-2026-12255 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Product
MainWP Child
Fixed in
6.1.2
What to do
Update MainWP Child to 6.1.2 or newer.
NVD record wpscan.com
Jul 27, 2026Advanced Ads: Does not sanitize and escape a shortcode parameter before outputting it in the pageCVE-2026-10082 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.
Product
Advanced Ads
Fixed in
2.0.23
What to do
Update Advanced Ads to 2.0.23 or newer.
NVD record wpscan.com
Jul 27, 2026Printcart Web to Print Product Designer for WooCommerce: Does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization checkCVE-2025-15662 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.
Product
Printcart Web to Print Product Designer for WooCommerce
Fixed in
2.5.3
What to do
Update Printcart Web to Print Product Designer for WooCommerce to 2.5.3 or newer.
NVD record wpscan.com
Jul 25, 2026Fluent Forms Pro Add On Pack: PHP Object InjectionCVE-2026-15962 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if user update integration is enabled and a user meta field is mapped.
Product
Fluent Forms Pro Add On Pack
Affected
up to 6.2.6
What to do
Affects up to 6.2.6. Update Fluent Forms Pro Add On Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record fluentforms.com wordfence.com
Jul 25, 2026Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Stored Cross-Site ScriptingCVE-2026-15425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
Product
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Affected
up to 28.0
What to do
Affects up to 28.0. Update Yoast SEO – Advanced SEO with real-time guidance and built-in AI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 25, 2026Checkout Field Editor for WooCommerce (Pro): Directory TraversalCVE-2026-14955 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
Checkout Field Editor for WooCommerce (Pro)
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update Checkout Field Editor for WooCommerce (Pro) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record themehigh.com wordfence.com
Jul 25, 2026WPForms Pro: Arbitrary File UploadCVE-2026-10818 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Product
WPForms Pro
Affected
up to 1.10.1.1
What to do
Affects up to 1.10.1.1. Update WPForms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpforms.com wordfence.com
Jul 24, 2026Easy Appointments: Unauthorized modification of dataCVE-2026-8789 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.
Product
Easy Appointments
Affected
up to 3.12.27
What to do
Affects up to 3.12.27. Update Easy Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2026Ninja Forms – The Contact Form Builder That Grows With You: Generic SQL InjectionCVE-2026-15663 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the 'settings' object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.
Product
Ninja Forms – The Contact Form Builder That Grows With You
Affected
up to 3.14.9
What to do
Affects up to 3.14.9. Update Ninja Forms – The Contact Form Builder That Grows With You to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026VikBooking Hotel Booking Engine & PMS: Stored Cross-Site ScriptingCVE-2026-15401 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vbfX custom-field value is stored via the public-facing saveorder task, which has no capability or authentication check enforced by default, enabling fully unauthenticated submission of malicious payloads.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026EventON Action User: Authorization bypassCVE-2026-10033 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON management capabilities and the upload_files capability to any non-administrator WordPress role or user, escalating their privileges within the site. The administrator role is protected by an early-return guard in update_role_caps(), so only non-administrator roles and individual users can be targeted; however, the same unauthenticated exposure also allows attackers to enumerate all WordPress users with their IDs and display names, disclose role and user capability state along with nonce values, and tamper with event-to-user term assignments.
Product
EventON Action User
Affected
up to 2.5.14
What to do
Affects up to 2.5.14. Update EventON Action User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org wordfence.com
Jul 24, 2026SureDash – Community, Courses & Member Dashboard: Stored Cross-Site ScriptingCVE-2026-15821 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SureDash – Community, Courses & Member Dashboard
Affected
up to 1.10.0
What to do
Affects up to 1.10.0. Update SureDash – Community, Courses & Member Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Rich Showcase for Google Reviews: Stored Cross-Site ScriptingCVE-2026-15739 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rich Showcase for Google Reviews
Affected
up to 6.9.9
What to do
Affects up to 6.9.9. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026VikBooking Hotel Booking Engine & PMS: Reflected Cross-Site ScriptingCVE-2026-15346 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Open User Map – Interactive Leaflet Maps: Stored Cross-Site ScriptingCVE-2026-15755 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack does not require post publication; a Contributor submitting a post for pending review is sufficient, as the payload executes when an Administrator opens the pending-review preview.
Product
Open User Map – Interactive Leaflet Maps
Affected
up to 1.4.45
What to do
Affects up to 1.4.45. Update Open User Map – Interactive Leaflet Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Fluent Support – Helpdesk & Customer Support Ticket System: Stored Cross-Site ScriptingCVE-2026-15665 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely.
Product
Fluent Support – Helpdesk & Customer Support Ticket System
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Fluent Support – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Visualizer – Tables & Charts Manager with Built-in AI Generator: Stored Cross-Site ScriptingCVE-2026-15653 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visualizer – Tables & Charts Manager with Built-in AI Generator
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Visualizer – Tables & Charts Manager with Built-in AI Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Brands for WooCommerce: Stored Cross-Site ScriptingCVE-2026-15648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Brands for WooCommerce
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026WP Hotel Booking: Stored Cross-Site ScriptingCVE-2026-15464 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on browsers where access keys can be used as the payload is stored in a hidden attribute.
Product
WP Hotel Booking
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates: Stored Cross-Site ScriptingCVE-2026-15334 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates: Stored Cross-Site ScriptingCVE-2026-15333 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Payment Plugins for Stripe WooCommerce: Authorization bypassCVE-2026-12654 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending asynchronous WooCommerce orders as paid by forging a charge.pending event with attacker-controlled metadata.order_id, metadata.gateway_id, and a charge object carrying status=succeeded and captured=true, triggering payment_complete() and downstream fulfillment flows with an attacker-supplied transaction ID. Exploitation requires the merchant to have left the webhook_secret_test or webhook_secret_live option blank, which is the plugin's default state until a Stripe-issued whsec_ value is manually configured; once a non-empty secret is set, the signature verification cannot be bypassed.
Product
Payment Plugins for Stripe WooCommerce
Affected
up to 4.0.7
What to do
Affects up to 4.0.7. Update Payment Plugins for Stripe WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026WowOptin: Next-Gen Popup Maker: Does not have proper authorization on a REST endpointCVE-2026-14603 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database.
Product
WowOptin: Next-Gen Popup Maker
Fixed in
1.4.38
What to do
Update WowOptin: Next-Gen Popup Maker to 1.4.38 or newer.
NVD record wpscan.com
Jul 24, 2026CAFEHAUS API: Does not have any authentication or authorisationCVE-2026-12981 · WordPress plugins & themes · reported by WPScanHigh 7.5
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
Product
CAFEHAUS API
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update CAFEHAUS API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Jul 24, 2026Project Management, Bug and Issue Tracking: Does not sanitise and escape user supplied input before using it in a SQL queryCVE-2026-12877 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.
Product
Project Management, Bug and Issue Tracking
Fixed in
5.1.0
What to do
Update Project Management, Bug and Issue Tracking to 5.1.0 or newer.
NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not perform a capability check on its license management actionsCVE-2026-12690 · WordPress plugins & themes · reported by WPScanLow 3.8
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not perform any authorization or ownership check on some of its private-message thread actionsCVE-2026-12689 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not verify PayPal IPN notifications before granting paid group membershipCVE-2026-12688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
NVD record wpscan.com
Jul 24, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not consistently enforce the role restriction configured on its front-end registration role-selection fieldCVE-2026-12497 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to accepting any non-administrator role. Combined with the absence of a nonce on the public registration handler, this allows an unauthenticated visitor to register an account with a higher role, such as Editor or Author, than the form was configured to offer.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.16.18
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.16.18 or newer.
NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.