Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

3,798 results · page 11 of 76

Jul 8, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Insecure Direct Object ReferenceCVE-2026-5459 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.
Product
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 8, 2026Bulk Order Update for WooCommerce: Arbitrary File ReadCVE-2026-14500 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook with no capability or nonce check, and passing the attacker-supplied csv_url POST parameter — filtered only by esc_url_raw() (which leaves absolute filesystem paths intact) and validate_file() (which only rejects '..' traversal patterns) — directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle.
Product
Bulk Order Update for WooCommerce
Affected
up to 1.6
What to do
Affects up to 1.6. Update Bulk Order Update for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2026WHMCS Bridge: Arbitrary file uploadsCVE-2026-14489 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect() function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
WHMCS Bridge
Affected
up to 6.9
What to do
Affects up to 6.9. Update WHMCS Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2026Simple Coherent Form: Arbitrary file deletionCVE-2026-14487 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a hardcoded salt embedded in the plugin source, meaning neither control presents a real authorization boundary.
Product
Simple Coherent Form
Affected
up to 2.4.13
What to do
Affects up to 2.4.13. Update Simple Coherent Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 7, 2026AMP for WP – Accelerated Mobile Pages: Arbitrary File WriteCVE-2026-6101 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in the uploads directory.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 7, 2026Frontend File Manager: Does not validate a file path derived from user input before deleting the referenced fileCVE-2026-12277 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.
Product
Frontend File Manager
Affected
up to 23.6
What to do
Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 7, 2026WP Travel Engine: Does not properly validate the source of a user-supplied profile image path before moving the fileCVE-2026-10834 · WordPress plugins & themes · reported by WPScanMedium 4.6
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.
Product
WP Travel Engine
Fixed in
6.8.1
What to do
Update WP Travel Engine to 6.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 6, 2026The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File MCVE-2026-6382 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
Fixed in
1.1.9
What to do
Update the plugin to 1.1.9 or newer.
Full record and what to do →NVD record wpscan.com
Jul 6, 2026FileOrganizer: Does not validate the file type on several of its file-management operationsCVE-2026-11962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
Product
FileOrganizer
Fixed in
1.2.0
What to do
Update FileOrganizer to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 6, 2026Ultimate Member: Does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profilesCVE-2026-11766 · WordPress plugins & themes · reported by WPScanHigh 8
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
Product
Ultimate Member
Fixed in
2.12.0
What to do
Update Ultimate Member to 2.12.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 6, 2026Notifications for Forms & WordPress Actions: Does not validate a user-supplied value before using it to build a server-side file inclusion pathCVE-2024-6228 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server.
Product
Notifications for Forms & WordPress Actions
Fixed in
2.6
What to do
Update Notifications for Forms & WordPress Actions to 2.6 or newer.
Full record and what to do →NVD record wpscan.com
Jul 3, 2026RTMKit (rometheme-for-elementor): Local File InclusionCVE-2026-5137 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute files on the server ending in _templates.php, allowing the execution of any PHP code in those files.
Product
RTMKit (rometheme-for-elementor)
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update RTMKit (rometheme-for-elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2026Printcart Web to Print Product Designer for WooCommerce: Arbitrary File DeletionCVE-2026-9725 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path traversal sequences — and then passes that path directly to Nbdesigner_IO::delete_folder() and PHP's rename(). The nonce protecting the nbd_save_customer_design AJAX action is freely obtainable by unauthenticated users via the nbd_check_use_logged_in endpoint. This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible.
Product
Printcart Web to Print Product Designer for WooCommerce
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Printcart Web to Print Product Designer for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2026-8489 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'about_me' parameter in all versions up to, and including, 2.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.11.4
What to do
Affects up to 2.11.4. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 3, 2026Ninja Forms - File Uploads: Authorization bypassCVE-2026-12557 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read all plugin debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table.
Product
Ninja Forms - File Uploads
Affected
up to 3.3.29
What to do
Affects up to 3.3.29. Update Ninja Forms - File Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 2, 2026TinyPNG – JPEG, PNG & WebP image compression: Arbitrary file deletionCVE-2026-7311 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and including, 3.6.13. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can exploit this by injecting an arbitrary server file path into the 'convert.path' field of the 'tiny_compress_images' post meta on an attachment they own, then triggering attachment deletion to invoke the vulnerable code path.
Product
TinyPNG – JPEG, PNG & WebP image compression
Affected
up to 3.6.13
What to do
Affects up to 3.6.13. Update TinyPNG – JPEG, PNG & WebP image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Divi Form Builder: Arbitrary File Upload leading to Remote Code ExecutionCVE-2026-5524 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.
Product
Divi Form Builder
Affected
up to 5.1.8
What to do
Affects up to 5.1.8. Update Divi Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record diviengine.com wordfence.com
Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.CVE-2026-57766 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026ProfileGrid: Cross-Site Request Forgery (CSRF)CVE-2026-57759 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.
Product
ProfileGrid
Affected
up to 6.0.0.2
What to do
Affects up to 6.0.0.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.CVE-2026-57749 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Contributor Local File Inclusion in Shopify <= 1.0.0 versions.CVE-2026-57748 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Shopify <= 1.0.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.CVE-2026-42382 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.CVE-2026-27436 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.CVE-2026-27419 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.CVE-2026-27412 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.CVE-2025-69133 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.
Affected
up to 5.4.5
What to do
Affects up to 5.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.CVE-2025-58902 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.
Affected
up to 1.2.12
What to do
Affects up to 1.2.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026WP Database Backup – Unlimited Database & Files Backup by Backup for WP: OS Command InjectionCVE-2026-9834 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/admin/class-wpdb-admin.php` without wrapping them in `escapeshellarg()`—every other argument in the same command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the exclude-table values the sole exception—and because the only applied filtering, `sanitize_text_field()` via `recursive_sanitize_text_field()`, strips HTML tags but leaves shell metacharacters such as `;`, `|`, `` ` ``, and `$()` intact. This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary operating system commands on the server, potentially enabling full remote code execution. The injection is stored: malicious values submitted through the plugin settings form are persisted to the WordPress options table via `update_option('wp_db_exclude_ta
Product
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
Affected
up to 7.11
What to do
Affects up to 7.11. Update WP Database Backup – Unlimited Database & Files Backup by Backup for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Database for Contact Form 7, WPforms, Elementor forms: Arbitrary File CopyCVE-2026-9145 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() without validating that the value corresponds to a legitimately uploaded file — when no file is present in $_FILES, raw_value reflects the attacker-controlled POST string. copy() accepts both local filesystem paths and URL sources, so the attacker can target any file readable by the PHP process or supply an attacker-controlled remote URL. Elementor Pro is a prerequisite for triggering the code path (it owns the elementor_pro/forms/new_record hook and populates the Form_Record object), but the bug itself is entirely in Contact Form Entries' handler. This could allow unauthenticated attackers to disclose arbitrary files on the affected site's server. The file is copied to a directory unknown to the attacker; the hashed directory name provides defense-in-depth but is generated from non-cryptographic sources (uniqid() + rand()) and should not be relied upon as the prim
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Ninja Forms - File Uploads: Arbitrary File ReadCVE-2026-13369 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.
Product
Ninja Forms - File Uploads
Affected
up to 3.3.29
What to do
Affects up to 3.3.29. Update Ninja Forms - File Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Image Optimizer: Arbitrary file deletionCVE-2026-5821 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_optimizer_metadata post meta field and trusts these paths completely when deleting backups on the delete_attachment hook. An authenticated attacker with Author-level access can edit the image_optimizer_metadata post meta on their own attachments via WordPress's Custom Fields interface, injecting arbitrary absolute file paths into the backups array. When the attacker subsequently deletes the attachment, the plugin calls File_System::delete() on each path without validation. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server within the web server's filesystem permissions, potentially leading to denial of service, data loss, or security degradation.
Product
Image Optimizer
Affected
up to 1.7.4
What to do
Affects up to 1.7.4. Update Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026WP-BusinessDirectory: Unauthenticated Arbitrary File DeletionCVE-2026-6070 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is accepted with RAW filter (no sanitization), and the helper function makePathFile() only normalizes directory separator characters without stripping path traversal sequences (../). When combined with the _path_type=2 parameter, which sets the base directory to the plugin's site folder, an attacker can supply a _filename value containing ../ sequences to traverse outside the plugin directory and call PHP's unlink() on arbitrary files — including wp-config.php, wp-config-backup.php, or other critical server files accessible to the web server process. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
Product
WP-BusinessDirectory
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP-BusinessDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 30, 2026Export User Data: Arbitrary file deletionCVE-2026-12240 · WordPress plugins & themes · reported by WordfenceHigh 8
The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to trigger a user data export while a subscriber-level (or higher) user has stored a crafted serialized XLSXWriter object payload as their display name.
Product
Export User Data
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update Export User Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 30, 2026WP Support Plus Responsive Ticket System: Does not properly validate uploaded filesCVE-2026-11589 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
Product
WP Support Plus Responsive Ticket System
Affected
up to 9.1.2
What to do
Affects up to 9.1.2. Update WP Support Plus Responsive Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 30, 2026ProfileGrid – User Profiles, Groups and Communities: Privilege escalationCVE-2026-12073 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.9.5
What to do
Affects up to 5.9.9.5. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 29, 2026Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.CVE-2026-57331 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 27, 2026Frontend File Manager: Authenticated Arbitrary File DeletionCVE-2026-8095 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path that is then passed directly to unlink() in delete_file_locally() without any directory containment validation. This makes it possible for authenticated attackers with Subscriber-level access to delete arbitrary files on the server, including sensitive files such as wp-config.php, potentially leading to full site takeover.
Product
Frontend File Manager
Affected
up to 23.6
What to do
Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 27, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not verify that the user performing a subscription action owns the targeted subscriptionCVE-2026-10820 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
Fixed in
4.16.17
What to do
Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.16.17 or newer.
Full record and what to do →NVD record wpscan.com
Jun 26, 2026Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.CVE-2026-57658 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.
Affected
up to 4.2.0
What to do
Affects up to 4.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.CVE-2026-57647 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.CVE-2026-57321 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.CVE-2026-56066 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.CVE-2026-56059 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.CVE-2026-56058 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.CVE-2026-56027 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.CVE-2025-68064 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.CVE-2025-68063 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.
Affected
up to 4.4.3
What to do
Affects up to 4.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin CVE-2026-1869 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the confirm_payment() function in all versions up to, and including, 5.2.0. This makes it possible for unauthenticated attackers to bypass payment processing and activate paid memberships.
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 26, 2026Frontend File Manager: Does not properly verify ownership of every targeted post before permanent deletionCVE-2026-8380 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
Product
Frontend File Manager
Affected
up to 23.6
What to do
Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 25, 2026OMGF Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-57700 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6.
Product
OMGF Pro
Affected
up to 5.2.6
What to do
Affects up to 5.2.6. Update OMGF Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.