Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,273 results · page 11 of 86
Jul 16, 2026Catch Themes Demo Import: Missing AuthorizationCVE-2026-15336 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes_demo_import_activate_plugin() function, hooked on admin_init when the activate_plugin GET parameter is present, calling Plugin_Upgrader::install() to download and install a plugin from WordPress.org before performing the current_user_can('activate_plugins') capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to install the hardcoded 'essential-content-types' plugin from the WordPress.
- Product
- Catch Themes Demo Import
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Catch Themes Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-14987 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as that is when the unescaped twitter_message value is evaluated inside the JavaScript template literal.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 4.16.3
- What to do
- Affects up to 4.16.3. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 15, 2026Quotes llama: Does not properly sanitize and escape a user-supplied parameter before using it in a SQL queryCVE-2026-12512 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.
- Product
- Quotes llama
- Fixed in
- 3.1.6
- What to do
- Update Quotes llama to 3.1.6 or newer.
Jul 14, 2026AI Engine: Does not sanitize a user-supplied filename before using it to write a downloaded fileCVE-2026-12511 · WordPress plugins & themes · reported by WPScanHigh 8.1
The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.
- Product
- AI Engine
- Fixed in
- 3.5.5
- What to do
- Update AI Engine to 3.5.5 or newer.
Jul 13, 2026FoodBook Lite - Online Food Ordering System: Missing AuthorizationCVE-2026-11802 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.
- Product
- FoodBook Lite - Online Food Ordering System
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update FoodBook Lite - Online Food Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026Car Rental Manager: Missing AuthorizationCVE-2026-61985 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.
- Product
- Car Rental Manager
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Car Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Church Admin: Missing AuthorizationCVE-2026-61983 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.
- Product
- Church Admin
- Affected
- up to 5.0.30
- What to do
- Affects up to 5.0.30. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026myCred: Missing AuthorizationCVE-2026-61968 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 3.1.2.
- Product
- myCred
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026License Manager for WooCommerce: Missing AuthorizationCVE-2026-61958 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.17.
- Product
- License Manager for WooCommerce
- Affected
- up to 3.0.17
- What to do
- Affects up to 3.0.17. Update License Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026WooCommerce Bulk Edit Products – WP Sheet Editor: Missing AuthorizationCVE-2026-61952 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a through <= 1.8.21.
- Product
- WooCommerce Bulk Edit Products – WP Sheet Editor
- Affected
- up to 1.8.21
- What to do
- Affects up to 1.8.21. Update WooCommerce Bulk Edit Products – WP Sheet Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2026-59523 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.11.11.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.11.11
- What to do
- Affects up to 1.6.11.11. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2026-57812 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.12.4.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.12.4
- What to do
- Affects up to 1.6.12.4. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026EduMall: Missing AuthorizationCVE-2026-57797 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through <= 4.5.1.
- Product
- EduMall
- Affected
- up to 4.5.1
- What to do
- Affects up to 4.5.1. Update EduMall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Universal Clocks: Missing AuthorizationCVE-2026-57782 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.
- Product
- Universal Clocks
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Universal Clocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026MeetingHub: Missing AuthorizationCVE-2026-57781 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MeetingHub: from n/a through <= 1.25.10.
- Product
- MeetingHub
- Affected
- up to 1.25.10
- What to do
- Affects up to 1.25.10. Update MeetingHub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Fascinate: Missing AuthorizationCVE-2026-57779 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through <= 1.1.5.
- Product
- Fascinate
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Fascinate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Booking calendar, Appointment Booking System: Missing AuthorizationCVE-2026-57778 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.36
- What to do
- Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026VW Wedding: Missing AuthorizationCVE-2026-57776 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.
- Product
- VW Wedding
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update VW Wedding to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026VW Food Corner: Missing AuthorizationCVE-2026-57774 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.
- Product
- VW Food Corner
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update VW Food Corner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026AcyMailing SMTP Newsletter: Missing AuthorizationCVE-2026-57740 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.1.
- Product
- AcyMailing SMTP Newsletter
- Affected
- up to 10.11.1
- What to do
- Affects up to 10.11.1. Update AcyMailing SMTP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Flatsome: Missing AuthorizationCVE-2026-57729 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.
- Product
- Flatsome
- Affected
- up to 3.20.5
- What to do
- Affects up to 3.20.5. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Kirki: Missing AuthorizationCVE-2026-57727 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0.
- Product
- Kirki
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update Kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Event Tickets: Missing AuthorizationCVE-2026-57705 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.
- Product
- Event Tickets
- Affected
- up to 5.28.5
- What to do
- Affects up to 5.28.5. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Abandoned Cart Recovery for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57698 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <= 1.1.12.
- Product
- Abandoned Cart Recovery for WooCommerce
- Affected
- up to 1.1.12
- What to do
- Affects up to 1.1.12. Update Abandoned Cart Recovery for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026ProfileGrid: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57697 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6.
- Product
- ProfileGrid
- Affected
- up to 5.9.9.6
- What to do
- Affects up to 5.9.9.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Razorpay Payment Links for WooCommerce: Missing AuthorizationCVE-2026-57424 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through <= 2.1.4.
- Product
- Razorpay Payment Links for WooCommerce
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Razorpay Payment Links for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Stock Locations for WooCommerce: Missing AuthorizationCVE-2026-57419 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 3.1.8.
- Product
- Stock Locations for WooCommerce
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update Stock Locations for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-57418 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.13.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.13
- What to do
- Affects up to 20.8.13. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Gift Vouchers: Missing AuthorizationCVE-2026-57412 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gift Vouchers: from n/a through <= 4.6.9.
- Product
- Gift Vouchers
- Affected
- up to 4.6.9
- What to do
- Affects up to 4.6.9. Update Gift Vouchers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Peach Payments Gateway: Missing AuthorizationCVE-2026-57408 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 4.0.2.
- Product
- Peach Payments Gateway
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Peach Payments Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026FundEngine: Missing AuthorizationCVE-2026-57406 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FundEngine: from n/a through <= 1.7.6.
- Product
- FundEngine
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update FundEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Open Shop: Missing AuthorizationCVE-2026-57405 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Shop: from n/a through <= 1.7.1.
- Product
- Open Shop
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Open Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Booking and Rental Manager: Missing AuthorizationCVE-2026-57404 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.9.
- Product
- Booking and Rental Manager
- Affected
- up to 2.6.9
- What to do
- Affects up to 2.6.9. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Event Tickets Manager for WooCommerce: Missing AuthorizationCVE-2026-57400 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets Manager for WooCommerce: from n/a through <= 1.5.5.
- Product
- Event Tickets Manager for WooCommerce
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Event Tickets Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Tourfic: Missing AuthorizationCVE-2026-57395 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.
- Product
- Tourfic
- Affected
- up to 2.22.5
- What to do
- Affects up to 2.22.5. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Tourfic: Missing AuthorizationCVE-2026-57392 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.
- Product
- Tourfic
- Affected
- up to 2.22.5
- What to do
- Affects up to 2.22.5. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Extra Product Options Builder for WooCommerce: Missing AuthorizationCVE-2026-57390 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extra Product Options Builder for WooCommerce: from n/a through <= 1.2.167.
- Product
- Extra Product Options Builder for WooCommerce
- Affected
- up to 1.2.167
- What to do
- Affects up to 1.2.167. Update Extra Product Options Builder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Advanced Forms: Missing AuthorizationCVE-2026-57378 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Forms: from n/a through <= 1.9.3.7.
- Product
- Advanced Forms
- Affected
- up to 1.9.3.7
- What to do
- Affects up to 1.9.3.7. Update Advanced Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026WowAddons: Missing AuthorizationCVE-2026-57377 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through <= 1.6.8.
- Product
- WowAddons
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update WowAddons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026MStore API: Missing AuthorizationCVE-2026-57375 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.
- Product
- MStore API
- Affected
- up to 4.18.4
- What to do
- Affects up to 4.18.4. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More: Improper Validation of Specified Quantity in InputCVE-2026-57364 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More: from n/a through <= 2.2.0.
- Product
- Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Library Management System: Does not sanitize and escape a user-supplied parameter before using it in a SQL statementCVE-2026-12582 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.
- Product
- Library Management System
- Fixed in
- 3.5.8
- What to do
- Update Library Management System to 3.5.8 or newer.
Jul 13, 2026Breeze Cache: Is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expressionCVE-2026-10551 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
- Product
- Breeze Cache
- Fixed in
- 2.5.6
- What to do
- Update Breeze Cache to 2.5.6 or newer.
Jul 11, 2026AI Chatbot & Workflow Automation by AIWU: Missing AuthorizationCVE-2026-6803 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, as the base controller's getPermissions() returns an empty array and neither removeGroup nor clear are added to getNoncedMethods(), causing the authorization gate to unconditionally return true for these actions. This makes it possible for unauthenticated attackers to delete specific records by ID or delete all records from any module's database table by unauthenticated attackers.
- Product
- AI Chatbot & Workflow Automation by AIWU
- Affected
- up to 1.4.12
- What to do
- Affects up to 1.4.12. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2026OAuth Single Sign On - SSO (OAuth Client): Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57807 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.
- Product
- OAuth Single Sign On - SSO (OAuth Client)
- Affected
- up to 38.5.8
- What to do
- Affects up to 38.5.8. Update OAuth Single Sign On - SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2026Easy Invoice: Missing AuthorizationCVE-2026-9021 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes — and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) — by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.
- Product
- Easy Invoice
- Affected
- up to 2.1.19
- What to do
- Affects up to 2.1.19. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026DSGVO All in one for WP: Missing AuthorizationCVE-2026-4298 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset_policy_service_func() function lacking both capability checks and nonce verification while processing user-supplied parameters to reset plugin options. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all customized privacy policy content including cookie notices, Google Analytics policies, Facebook policies, and YouTube policies to their default values.
- Product
- DSGVO All in one for WP
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update DSGVO All in one for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026WP DSGVO Tools (GDPR): Does not perform an authorization check on the immediate-processing path of its data subject access request featureCVE-2026-11869 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP DSGVO Tools (GDPR) WordPress plugin before 3.1.40 does not perform an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.
- Product
- WP DSGVO Tools (GDPR)
- Fixed in
- 3.1.40
- What to do
- Update WP DSGVO Tools (GDPR) to 3.1.40 or newer.
Jul 9, 2026Everest Forms: Does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directoryCVE-2026-11571 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames.
- Product
- Everest Forms
- Fixed in
- 3.5.0
- What to do
- Update Everest Forms to 3.5.0 or newer.
Jul 9, 2026Divi Form Builder: Missing AuthorizationCVE-2026-5523 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() function accepting a user ID parameter from form submissions without verifying that the authenticated user has permission to edit that specific user account, and the handle_register_submission() function only checking if any user is logged in rather than validating permissions for the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address and password of any user account, including administrators, resulting in complete account takeover.
- Product
- Divi Form Builder
- Affected
- up to 5.1.8
- What to do
- Affects up to 5.1.8. Update Divi Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddiviengine.comwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.