Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

1,230 results · page 11 of 25

May 10, 2026AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering CVE-2021-47910 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering JavaScript payloads into the 'icon title' field. Attackers can store XSS payloads like image tags with onerror event handlers that execute when the plugin page is viewed, affecting all users who access the plugin interface.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record accesspressthemes.com wordpress.org
May 6, 2026Mercado Pago payments for WooCommerce: Unauthorized access of dataCVE-2026-3208 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' WooCommerce API endpoint in all versions up to, and including, 8.7.11. This makes it possible for unauthenticated attackers to retrieve PIX payment QR code images for arbitrary orders. PIX QR codes contain sensitive merchant information including PIX keys (which may be CPF/CNPJ personal identifiers), transaction amounts, merchant name and city, and MercadoPago transaction references.
Product
Mercado Pago payments for WooCommerce
Affected
up to 8.7.11
What to do
Affects up to 8.7.11. Update Mercado Pago payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 4, 2026Magic Export & Import: Stores exported CSV files at a publicly accessible locationCVE-2026-5335 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.
Product
Magic Export & Import
Fixed in
1.2.0
What to do
Update Magic Export & Import to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com
May 3, 2026During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object ReferenCVE-2026-5337 · WordPress plugins & themes · reported by WPScanMedium 6.5
During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference (IDOR) attack. This vulnerability exists because the Frontend File Manager Plugin WordPress plugin through 23.6 does not properly validate user authorization for the requested uploaded file when processing download requests. By modifying the value of the 'file_id' parameter in the download endpoint (e.g., http://localhost/?do=wpfm_download&file_id=40&nm_file_nonce=a36fb893f1), an attacker can access files belonging to other users, including privileged users such as administrators. This allows unauthorized access/read to sensitive data stored within the application.
Affected
up to 23.6
What to do
Affects up to 23.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
May 2, 2026WP Mail Gateway: Unauthorized accessCVE-2026-6963 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wmg_save_provider_config AJAX action in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update SMTP settings and redirect mail which can be used for privilege escalation by triggering a password reset email and using that to access and administrator's account.
Product
WP Mail Gateway
Affected
up to 1.8
What to do
Affects up to 1.8. Update WP Mail Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2026Widgets for Social Photo Feed: Unauthorized access of data and modification of dataCVE-2025-14726 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.
Product
Widgets for Social Photo Feed
Affected
up to 1.8
What to do
Affects up to 1.8. Update Widgets for Social Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 29, 2026Complianz – GDPR/CCPA Cookie Consent: Unauthorized data accessCVE-2026-4019 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/{post_id}/{block_id} using __return_true as the permission_callback, allowing any unauthenticated user to access it. The cmplz_rest_consented_content() function retrieves a post by ID via get_post() and returns the consentedContent attribute of any complianz/consent-area block found in it, without checking if the post is published or if the user has permission to read it. This makes it possible for unauthenticated attackers to read the consent area block content from private, draft, or unpublished posts.
Product
Complianz – GDPR/CCPA Cookie Consent
Affected
up to 7.4.5
What to do
Affects up to 7.4.5. Update Complianz – GDPR/CCPA Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Apr 21, 2026Responsive Blocks – Page Builder for Blocks & Patterns: Unauthorized accessCVE-2026-6703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global site-wide plugin configuration options, including toggling custom CSS, disabling blocks, changing layout defaults such as content width, container padding, and container gap, and altering auto-block-recovery behavior.
Product
Responsive Blocks – Page Builder for Blocks & Patterns
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update Responsive Blocks – Page Builder for Blocks & Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2026Accessibility Suite by Ability, Inc: SQL InjectionCVE-2026-3773 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Accessibility Suite by Ability, Inc plugin for WordPress is vulnerable to SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Accessibility Suite by Ability, Inc
Affected
up to 4.20
What to do
Affects up to 4.20. Update Accessibility Suite by Ability, Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2026Accessibly: Stored Cross-Site ScriptingCVE-2026-3643 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Accessibly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in all versions up to, and including, 3.0.3. The plugin registers REST API endpoints at `/otm-ac/v1/update-widget-options` and `/otm-ac/v1/update-app-config` with the `permission_callback` set to `__return_true`, which means no authentication or authorization check is performed. The `updateWidgetOptions()` function in `AdminApi.php` accepts user-supplied JSON data and passes it directly to `AccessiblyOptions::updateAppConfig()`, which saves it to the WordPress options table via `update_option()` without any sanitization or validation. The stored `widgetSrc` value is later retrieved by `AssetsManager::enqueueFrontendScripts()` and passed directly to `wp_enqueue_script()` as the script URL, causing it to be rendered as a `<script>` tag on every front-end page. This makes it possible for unauthenticated attackers to inject arbitrary JavaScript that executes for all site visitors by changing the `widgetSrc` option to point to a malicious external script.
Product
Accessibly
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update Accessibly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 20263D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery: Unauthorized access of dataCVE-2026-1314 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the send_post_pages_json() function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticated attackers to retrieve flipbook page metadata for draft, private and password-protected flipbooks.
Product
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
Affected
up to 1.16.17
What to do
Affects up to 1.16.17. Update 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 14, 2026Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered): Unauthorized access of dataCVE-2026-4109 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the get_item_permissions_check() function in all versions up to, and including, 4.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order data including customer PII (name, email, phone) by iterating order IDs.
Product
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered)
Affected
up to 4.1.8
What to do
Affects up to 4.1.8. Update Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 9, 2026UsersWP – Front-end login form, User Registration, User Profile & Members Directory: Improper Access ControlCVE-2026-4977 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions up to, and including, 1.2.58 This is due to insufficient field-level permission validation in the upload_file_remove() AJAX handler where the $htmlvar parameter is not validated against a whitelist of allowed fields or checked against the field's for_admin_use property. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear or reset any restricted usermeta column for their own user record, including fields marked as "For admin use only", bypassing intended field-level access restrictions.
Product
UsersWP – Front-end login form, User Registration, User Profile & Members Directory
Affected
up to 1.2.58
What to do
Affects up to 1.2.58. Update UsersWP – Front-end login form, User Registration, User Profile & Members Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2026WP-Optimize: Unauthorized access of functionalityCVE-2026-2712 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the `receive_heartbeat()` function in `includes/class-wp-optimize-heartbeat.php` in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly invoking `Updraft_Smush_Manager_Commands` methods without verifying user capabilities, nonce tokens, or the allowed commands whitelist that the normal AJAX handler (`updraft_smush_ajax`) enforces. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke admin-only Smush operations including reading log files (`get_smush_logs`), deleting all backup images (`clean_all_backup_images`), triggering bulk image processing (`process_bulk_smush`), and modifying Smush options (`update_smush_options`).
Product
WP-Optimize
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update WP-Optimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 9, 2026Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that alloCVE-2026-34424 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trigger pre-authentication remote shell execution via HTTP headers, establish authenticated backdoors accepting arbitrary PHP code or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must-use plugins and core file modifications.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record mysites.guru patchstack.com
Apr 8, 2026Advanced Contact form 7 DB: Unauthorized access of dataCVE-2026-0814 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in all versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export form submissions to excel file.
Product
Advanced Contact form 7 DB
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Advanced Contact form 7 DB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Smart Slider 3: Unauthorized access and modification of dataCVE-2026-4065 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The display_admin_ajax() method does not call checkForCap() (which requires unfiltered_html capability), and several controller actions only validate the nonce (validateToken()) without calling validatePermission(). This makes it possible for authenticated attackers, with Contributor-level access and above, to enumerate slider metadata and create, modify, and delete image storage records by obtaining the nextend_nonce exposed on post editor pages.
Product
Smart Slider 3
Affected
up to 3.5.1.33
What to do
Affects up to 3.5.1.33. Update Smart Slider 3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Link Whisper Free: Has a publicly accessible REST endpoint that allows unauthenticated settings updatesCVE-2026-1900 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.
Product
Link Whisper Free
Fixed in
0.9.1
What to do
Update Link Whisper Free to 0.9.1 or newer.
Full record and what to do →NVD record wpscan.com
Apr 1, 2026Order Notification for WooCommerce: Overrides WooCommerce's permission checks to grant full access to all unauthenticated requestsCVE-2025-15484 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
Product
Order Notification for WooCommerce
Fixed in
3.6.3
What to do
Update Order Notification for WooCommerce to 3.6.3 or newer.
Full record and what to do →NVD record wpscan.com
Mar 31, 2026Database for Contact Form 7, WPforms, Elementor forms: Unauthorized access of dataCVE-2026-3831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entries_shortcode() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract all form submissions - including names, emails, phone numbers.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 23, 2026Smart Custom Fields: Unauthorized access of dataCVE-2026-4066 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 5.0.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to read private and draft post content from other authors via the smart-cf-relational-posts-search AJAX action. The function queries posts with post_status=any and returns full WP_Post objects including post_content, but only checks the generic edit_posts capability instead of verifying whether the requesting user has permission to read each individual post.
Product
Smart Custom Fields
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Smart Custom Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 23, 2026ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More: Unauthorized access of dataCVE-2025-10736 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to unauthorized access of data due to improper authorization checks on the userAccessibility() function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers to access protected REST API endpoints, extract and modify information related to users and plugin's configuration
Product
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More
Affected
up to 2.2.10
What to do
Affects up to 2.2.10. Update ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2026Build App Online: Unauthorized accessCVE-2026-3651 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin registering the 'build-app-online-update-vendor-product' AJAX action via wp_ajax_nopriv_ without proper authentication checks, capability verification, or nonce validation in the update_vendor_product() function. The function accepts a user-supplied post ID from the request and calls wp_update_post() to modify the post_author field without validating whether the user has permission to modify the specified post. This makes it possible for unauthenticated attackers to modify the post_author of arbitrary posts to 0 (orphaning posts from their legitimate authors), or for authenticated attackers to claim ownership of any post by setting themselves as the author.
Product
Build App Online
Affected
up to 1.0.23
What to do
Affects up to 1.0.23. Update Build App Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Smarter Analytics: Unauthorized accessCVE-2026-3570 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authentication and capability checks on the configuration reset functionality in the global scope of smarter-analytics.php. This makes it possible for unauthenticated attackers to reset all plugin configuration and delete all per-page/per-post analytics settings via the 'reset' parameter.
Product
Smarter Analytics
Affected
up to 2.0
What to do
Affects up to 2.0. Update Smarter Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Hr Press Lite: Unauthorized access of sensitive employee dataCVE-2026-2720 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the `hrp-fetch-employees` AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive employee information including names, email addresses, phone numbers, salary/pay rates, employment dates, and employment status.
Product
Hr Press Lite
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Hr Press Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026RepairBuddy – Repair Shop CRM & Booking: Unauthorized accessCVE-2026-3567 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132. The plugin exposes two AJAX handlers that, when combined, allow any authenticated user to modify admin-level plugin settings. First, the wc_rb_get_fresh_nonce() function (registered via wp_ajax and wp_ajax_nopriv hooks) allows any user to generate a valid WordPress nonce for any arbitrary action name by simply providing the nonce_name parameter, with no capability checks. Second, the wc_rep_shop_settings_submission() function only verifies the nonce (wcrb_main_setting_nonce) but performs no current_user_can() capability check before updating 15+ plugin options via update_option(). This makes it possible for authenticated attackers, with subscriber-level access and above, to modify all plugin configuration settings including business name, email, logo, menu label, GDPR settings, and more by first minting a valid nonce via the wc_rb_get_fresh_nonce endpoint and then calling the settings submission handler.
Product
RepairBuddy – Repair Shop CRM & Booking
Affected
up to 4.1132
What to do
Affects up to 4.1132. Update RepairBuddy – Repair Shop CRM & Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 19, 2026Download Manager: Unauthorized access of dataCVE-2026-2571 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all versions up to, and including, 3.3.49. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information for any user on the site including email addresses, display names, and registration dates.
Product
Download Manager
Affected
up to 3.3.49
What to do
Affects up to 3.3.49. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 16, 2026Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor: Unauthorized access of dataCVE-2026-1870 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft LearnPress course content by supplying post_status in the params_url payload.
Product
Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2026Appointment Booking Calendar — Simply Schedule Appointments: Unauthorized access of sensitive dataCVE-2026-3045 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method in `SSA_Settings_Api` relies on `nonce_permissions_check()` for authorization (which accepts the public nonce) but does not call `remove_unauthorized_settings_for_current_user()` to filter restricted fields. This makes it possible for unauthenticated attackers to access admin-only plugin settings including the administrator email, phone number, internal access tokens, notification configurations, and developer settings via the `/wp-json/ssa/v1/settings/{section}` endpoint. The exposure of appointment tokens also allows an attacker to modify or cancel appointments.
Product
Appointment Booking Calendar — Simply Schedule Appointments
Affected
up to 1.6.9.29
What to do
Affects up to 1.6.9.29. Update Appointment Booking Calendar — Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1.CVE-2026-3906 · WordPress plugins & themes · reported by WordfenceMedium 4.3
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.
Affected
up to 6.9.1
What to do
Affects up to 6.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Mar 11, 2026Ally – Web Accessibility & Usability: SQL InjectionCVE-2026-2413 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques. The Remediation module must be active, which requires the plugin to be connected to an Elementor account.
Product
Ally – Web Accessibility & Usability
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update Ally – Web Accessibility & Usability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 10, 2026Booking Calendar for Appointments and Service Businesses – Booktics: Unauthorized access of dataCVE-2026-1919 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.
Product
Booking Calendar for Appointments and Service Businesses – Booktics
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update Booking Calendar for Appointments and Service Businesses – Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 4, 2026My Calendar – Accessible Event Manager: Stored Cross-Site ScriptingCVE-2026-2355 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template` attribute of the `[my_calendar_upcoming]` shortcode in all versions up to, and including, 3.7.3. This is due to the use of `stripcslashes()` on user-supplied shortcode attribute values in the `mc_draw_template()` function, which decodes C-style hex escape sequences (e.g., `\x3c` to `<`) at render time, bypassing WordPress's `wp_kses_post()` content sanitization that runs at save time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My Calendar – Accessible Event Manager
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 2, 2026AI ChatBot with ChatGPT and Content Generator by AYS: Unauthorized access and modification of dataCVE-2026-1336 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the store_data() and get_chatgpt_api_key() functions in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to view, modify or delete the plugin's ChatGPT API key. The vulnerability was partially fixed in version 2.7.5 and fully fixed in version 2.7.6
Product
AI ChatBot with ChatGPT and Content Generator by AYS
Affected
up to 2.7.5
Fixed in
2.7.5
What to do
Update AI ChatBot with ChatGPT and Content Generator by AYS to 2.7.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2026The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0.CVE-2024-10938 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2026WP Accessibility: Stored DOM-Based Cross-Site ScriptingCVE-2026-2362 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Description UI" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using getAttribute() and unsafely concatenating it into innerHTML and insertAdjacentHTML calls without proper sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the "Long Description UI" setting to be enabled and set to "Link to description."
Product
WP Accessibility
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WP Accessibility to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 25, 2026WP Recipe Maker: Unauthorized access of dataCVE-2025-14742 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_search_recipes' and 'ajax_get_recipe' functions in all versions up to, and including, 10.2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive recipe information including draft, pending, and private recipes that they shouldn't be able to access.
Product
WP Recipe Maker
Affected
up to 10.2.3
What to do
Affects up to 10.2.3. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions: Stored Cross-Site ScriptingCVE-2025-13732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 's2Eot' shortcode in all versions up to, and including, 251005 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Affected
up to 251005
What to do
Affects up to 251005. Update s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Web Accessibility by accessiBe: Sensitive Information ExposureCVE-2025-13113 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Web Accessibility by accessiBe plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11. This is due to the `accessibe_render_js_in_footer()` function logging the complete plugin options array to the browser console on public pages, without restricting output to privileged users or checking for debug mode. This makes it possible for unauthenticated attackers to view sensitive configuration data, including email addresses, accessiBe user IDs, account IDs, and license information, via the browser console when the widget is disabled.
Product
Web Accessibility by accessiBe
Affected
up to 2.11
What to do
Affects up to 2.11. Update Web Accessibility by accessiBe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2026Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: Unauthorized access of data that leads to privilege escalationCVE-2025-12845 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() function in versions 0.5.4 to 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve plugin table data that can expose email log information. Attackers can leverage this on sites where the table log is enabled in order to trigger a password reset and obtain the reset key.
Product
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
Affected
0.5.4 to 1.2.1
What to do
Affects 0.5.4 to 1.2.1. Update Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 19, 2026Mesmerize Companion: Unauthorized access and modification of dataCVE-2025-12027 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageInCustomizer" and "openPageInDefaultEditor" functions in all versions up to, and including, 1.6.158. This makes it possible for authenticated attackers - with subscriber level access and above, on websites with the Mesmerize theme activated - to mark arbitrary pages as maintainable, wrap their content in custom sections, change page template metadata, and toggle the default editor flag without proper authorization.
Product
Mesmerize Companion
Affected
up to 1.6.158
What to do
Affects up to 1.6.158. Update Mesmerize Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026GDPR Cookie Consent: Unauthorized access of dataCVE-2025-11754 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'gdpr/v1/settings' REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to retrieve sensitive plugin settings including API tokens, email addresses, account IDs, and site keys.
Product
GDPR Cookie Consent
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update GDPR Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026Order Splitter for WooCommerce: Unauthorized access of dataCVE-2025-12075 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wos_troubleshooting' AJAX endpoint in all versions up to, and including, 5.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view information pertaining to other user's orders.
Product
Order Splitter for WooCommerce
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update Order Splitter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 17, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Unauthorized accessCVE-2026-2608 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.
Product
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
Affected
up to 3.5.32
What to do
Affects up to 3.5.32. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org vdp.patchstack.com
Feb 17, 2026Zarinpal Gateway for WooCommerce: Improper Access Control to Payment Status UpdateCVE-2026-2592 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.
Product
Zarinpal Gateway for WooCommerce
Affected
up to 5.0.16
What to do
Affects up to 5.0.16. Update Zarinpal Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026Smart Forms: Unauthorized access of dataCVE-2026-2022 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Smart Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'rednao_smart_forms_get_campaigns' AJAX action in all versions up to, and including, 2.6.99. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve donation campaign data including campaign IDs and names.
Product
Smart Forms
Affected
up to 2.6.99
What to do
Affects up to 2.6.99. Update Smart Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 14, 2026WP Data Access: Stored Cross-Site ScriptingCVE-2026-0557 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpda_app' shortcode in all versions up to, and including, 5.5.63 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Data Access
Affected
up to 5.5.63
What to do
Affects up to 5.5.63. Update WP Data Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2026One to one user Chat by WPGuppy: Unauthorized access of dataCVE-2025-6792 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The One to one user Chat by WPGuppy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/guppylite/v2/channel-authorize rest endpoint in all versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to intercept and view private chat messages between users.
Product
One to one user Chat by WPGuppy
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update One to one user Chat by WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 13, 2026Easy Form Builder: Unauthorized access of dataCVE-2025-14067 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Form Builder plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX actions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive form response data, including messages, admin replies, and user information due to a logic error in the authorization check that uses AND (&&) instead of OR (||).
Product
Easy Form Builder
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 12, 2026Activity Log for: Unauthorized access of dataCVE-2026-1671 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the winter_activity_log_action() function in all versions up to, and including, 1.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view potentially sensitive information (e.g., the password of a higher level user, such as an administrator) contained in the exposed log files.
Product
Activity Log for
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Activity Log for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.