Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

472new WordPress flaws this week

390,714entries in the database

2,803 results · page 11 of 57

Jun 6, 2026Ad Inserter – Ad Manager & AdSense Ads: Reflected Cross-Site ScriptingCVE-2026-9280 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on the targeted page, which is a non-default but supported configuration commonly used for AdSense and JavaScript-based ads.
Product
Ad Inserter – Ad Manager & AdSense Ads
Affected
up to 2.8.15
What to do
Affects up to 2.8.15. Update Ad Inserter – Ad Manager & AdSense Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026MDJM Event Management: Arbitrary File UploadCVE-2026-7537 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.
Product
MDJM Event Management
Affected
up to 1.7.8.3
What to do
Affects up to 1.7.8.3. Update MDJM Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 5, 2026WP User Manager – User Profile Builder & Membership: Local File InclusionCVE-2026-9290 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Product
WP User Manager – User Profile Builder & Membership
Affected
up to 2.9.17
What to do
Affects up to 2.9.17. Update WP User Manager – User Profile Builder & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 5, 2026Event Monster – Event Management, Events Calendar, Tickets: Insufficient Verification of Data AuthenticityCVE-2026-8608 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capture_payment() AJAX handler (registered via wp_ajax_nopriv_em_capture_payment) trusting client-supplied payment data — including transaction ID, amount, and payment status — without performing any server-side verification against the PayPal API or any other payment gateway, and without nonce or capability checks. This makes it possible for unauthenticated attackers to forge payment records, mark bookings as Completed, and obtain confirmation emails containing valid QR code tickets without making any actual payment.
Product
Event Monster – Event Management, Events Calendar, Tickets
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Event Monster – Event Management, Events Calendar, Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2026WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database qCVE-2019-25745 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jun 4, 2026WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manCVE-2019-25727 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record web-dorado.com exploit-db.com
Jun 4, 2026Photo Gallery by 10Web: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49771 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.
Product
Photo Gallery by 10Web
Affected
up to 1.8.41
What to do
Affects up to 1.8.41. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 3, 2026SP Project & Document Manager: Unauthorized accessCVE-2026-10737 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass all preceding capability and ownership checks. The secondary fallback check only denies access for root-level files (pid == 0), leaving all files stored inside project folders fully exposed to unauthenticated users who supply only a valid file ID in a POST request to admin-ajax.php.
Product
SP Project & Document Manager
Affected
up to 4.71
What to do
Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 3, 2026School Management: Incorrect Privilege AssignmentCVE-2025-15656 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0.
Product
School Management
Affected
up to 93.2.0
What to do
Affects up to 93.2.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 3, 2026School Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-15655 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0.
Product
School Management
Affected
up to 93.2.0
What to do
Affects up to 93.2.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026EmergencyWP – Dead Man's switch & legacy deliverance: Cross-Site Request ForgeryCVE-2026-9732 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the form_settings_ui (settings save handler, procedural include scope) function. This makes it possible for unauthenticated attackers to modify plugin settings including the minimum access role (altering WordPress role capabilities via add_cap/remove_cap), the data-erasure-on-uninstall flag, life-check timing values, the mandator email address, the confirmation page ID, and date/time formats via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
EmergencyWP – Dead Man's switch & legacy deliverance
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update EmergencyWP – Dead Man's switch & legacy deliverance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2026WP Job Portal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42684 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.
Product
WP Job Portal
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 1, 2026Advanced Access Manager: Authentication Bypass by SpoofingCVE-2026-42674 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL Encoding. This issue affects Advanced Access Manager: from n/a through 7.1.0.
Product
Advanced Access Manager
Affected
up to 7.1.0
What to do
Affects up to 7.1.0. Update Advanced Access Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 1, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42672 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.
Product
WP Directory Kit
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 28, 2026Visualizer: Tables and Charts Manager for: Missing AuthorizationCVE-2026-8689 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.11.14. This is due to a missing capability check on the renderChartPages() and uploadData() functions, where the wp_ajax_visualizer-create-chart and wp_ajax_visualizer-edit-chart AJAX actions invoke renderChartPages() without any current_user_can() check, and wp_ajax_visualizer-upload-data invokes uploadData() which also lacks a capability check and validates its nonce without an action argument, making it trivially bypassable. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary chart posts and access or modify chart data belonging to other users, including administrators.
Product
Visualizer: Tables and Charts Manager for
Affected
up to 3.11.14
What to do
Affects up to 3.11.14. Update Visualizer: Tables and Charts Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2026Easy Updates Manager: Reflected Cross-Site ScriptingCVE-2026-7660 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link.
Product
Easy Updates Manager
Affected
up to 9.0.20
What to do
Affects up to 9.0.20. Update Easy Updates Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Account Manager for WooCommerce: Missing AuthorizationCVE-2022-41656 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bizswoop Account Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Account Manager for WooCommerce: from n/a through 2.1.2.
Product
Account Manager for WooCommerce
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Account Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Duplicate Page and Post: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49046 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Duplicate Page and Post allows Blind SQL Injection. This issue affects Duplicate Page and Post: from n/a through 2.9.5.
Product
Duplicate Page and Post
Affected
up to 2.9.5
What to do
Affects up to 2.9.5. Update Duplicate Page and Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Active Products Tables for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42761 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.9.
Product
Active Products Tables for WooCommerce
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026TableOn: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42755 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn posts-table-filterable allows Blind SQL Injection.This issue affects TableOn: from n/a through <= 1.0.5.1.
Product
TableOn
Affected
up to 1.0.5.1
What to do
Affects up to 1.0.5.1. Update TableOn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Booking Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42751 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Booking Manager booking-manager allows Stored XSS.This issue affects Booking Manager: from n/a through <= 2.1.18.
Product
Booking Manager
Affected
up to 2.1.18
What to do
Affects up to 2.1.18. Update Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Easy Form Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42747 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through <= 4.0.6.
Product
Easy Form Builder
Affected
up to 4.0.6
What to do
Affects up to 4.0.6. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Tainacan: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42740 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.
Product
Tainacan
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026MasterStudy LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42730 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.
Product
MasterStudy LMS
Affected
up to 3.7.29
What to do
Affects up to 3.7.29. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Active Products Tables for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42727 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.8.
Product
Active Products Tables for WooCommerce
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager: Remote Code ExecutionCVE-2026-8832 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability_type or capability restrictions in the wpcode_register_post_type() function, allowing WordPress core to fall back to standard post capabilities for all creation paths including XML-RPC. This makes it possible for authenticated attackers, with author-level access and above, to create and publish executable PHP snippet posts via XML-RPC wp.newPost, which are then executed server-side via eval() in the run_eval() function when the snippet is rendered through the [wpcode] shortcode.
Product
WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Firebase Support & Chat Management: Privilege escalationCVE-2026-8787 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.
Product
Firebase Support & Chat Management
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Firebase Support & Chat Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 26, 2026Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2026-25426 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.0.1.
Product
Taxi Booking Manager for WooCommerce
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-48837 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection. This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.
Product
Unlimited Elements For Elementor
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Smart Manager: Incorrect Privilege AssignmentCVE-2026-45216 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0.
Product
Smart Manager
Affected
up to 8.85.0
What to do
Affects up to 8.85.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42774 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.
Product
JetEngine
Affected
up to 3.8.8.1
What to do
Affects up to 3.8.8.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026eMagicOne Store Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2.
Product
eMagicOne Store Manager
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update eMagicOne Store Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026RSVP and Event Management: Missing AuthorizationCVE-2026-27398 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RSVP and Event Management: from n/a through 2.7.16.
Product
RSVP and Event Management
Affected
up to 2.7.16
What to do
Affects up to 2.7.16. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 23, 2026WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate daCVE-2018-25352 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the entry_id POST parameter. Attackers can send POST requests to the admin-ajax.php endpoint with the ufbl_get_entry_detail_action action to extract, modify, or escalate privileges within the WordPress database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record vulnerablesite.com exploit-db.com
May 23, 2026WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through theCVE-2018-25347 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 23, 2026WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injectCVE-2018-25346 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through the FormMakerSQLMapping and generete_csv actions. Attackers can submit POST requests with malicious SQL payloads in the name and search_labels parameters to extract, modify, or escalate privileges within the WordPress database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
May 23, 2026WooCommerce PayPal Payments: Unauthorized order manipulation and information disclosureCVE-2026-9284 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an arbitrary WooCommerce order ID in the `pay-now` context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers' order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim's WC order and then retrieving the PayPal order data.
Product
WooCommerce PayPal Payments
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WooCommerce PayPal Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 21, 2026WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39531 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.
Product
WP Directory Kit
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 20, 2026YITH WooCommerce Product Add-Ons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42383 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.
Product
YITH WooCommerce Product Add-Ons
Affected
up to 4.29.0
What to do
Affects up to 4.29.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 19, 2026Logo Manager For Enamad: Stored Cross-Site ScriptingCVE-2026-6549 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Logo Manager For Enamad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the `vc_enamad_namad`, `vc_enamad_shamed`, and `vc_enamad_custom` shortcodes in all versions up to, and including, 0.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Logo Manager For Enamad
Affected
up to 0.7.4
What to do
Affects up to 0.7.4. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2026WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating CVE-2021-47979 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 16, 2026WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldCVE-2021-47975 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldtitle` parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wplearnmanager.com
May 14, 2026Taskbuilder – Project Management & Task Management Tool With Kanban Board: Time-based blind SQL InjectionCVE-2026-6225 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'project_search' parameter in all versions up to, and including, 5.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Taskbuilder – Project Management & Task Management Tool With Kanban Board
Affected
up to 5.0.6
What to do
Affects up to 5.0.6. Update Taskbuilder – Project Management & Task Management Tool With Kanban Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026ManageWP Worker: Stored Cross-Site ScriptingCVE-2026-3718 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator visits the plugin's connection management page with debug parameters.
Product
ManageWP Worker
Affected
up to 4.9.31
What to do
Affects up to 4.9.31. Update ManageWP Worker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 14, 2026My Calendar – Accessible Event Manager: Authorization bypassCVE-2026-7525 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to bypass the moderation and approval workflow by tampering with the POST body to publish events or set other unauthorized statuses such as cancelled or private, in ways their role does not permit. While the UI correctly restricts low-privilege users to a draft-only submit button, this restriction is enforced only client-side, making it trivially bypassable by directly manipulating the POST request.
Product
My Calendar – Accessible Event Manager
Affected
up to 3.7.9
What to do
Affects up to 3.7.9. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 13, 2026WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulatCVE-2020-37169 · WordPress plugins & themes · reported by VulnCheckMedium 6.8
WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the pack parameter in class-admin-upgrade.php. Attackers can send POST requests with malicious pack values to include unintended PHP files from the packages directory and execute arbitrary code.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
May 13, 2026WPC Badge Management for WooCommerce: Stored Cross-Site ScriptingCVE-2025-14767 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcbm_best_seller` shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPC Badge Management for WooCommerce
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update WPC Badge Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026Cost Calculator Builder: Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR)CVE-2025-14755 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccb_woocommerce_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the renderWooCommercePayment() function passing user-controlled data directly to CCBWooCheckout::init() without authorization checks. This makes it possible for unauthenticated attackers to add WooCommerce products to their cart with attacker-controlled prices.
Product
Cost Calculator Builder
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 12, 2026Court Reservation – Manage Your Court Bookings Online: Generic SQL InjectionCVE-2026-1250 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.10.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Court Reservation – Manage Your Court Bookings Online
Affected
up to 1.10.11
What to do
Affects up to 1.10.11. Update Court Reservation – Manage Your Court Bookings Online to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 12, 2026WP Travel: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-45218 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection.This issue affects WP Travel: from n/a through <= 11.4.0.
Product
WP Travel
Affected
up to 11.4.0
What to do
Affects up to 11.4.0. Update WP Travel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.