Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,229 results · page 11 of 185
Aug 13, 2026Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.CVE-2026-73346 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 13, 2026Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-28002 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.
- Product
- Booktics
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.CVE-2026-27536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026Tablesome Table: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-66659 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.
- Product
- Tablesome Table
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Tablesome Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026Import WP: Does not perform any authorization check on one of its export-file download handlersCVE-2026-14925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
- Product
- Import WP
- Fixed in
- 2.14.23
- What to do
- Update Import WP to 2.14.23 or newer.
Aug 10, 2026RSS Aggregator by Feedzy: Does not verify that the requesting user owns or is allowed to edit the import job named in the requestCVE-2026-18934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.
- Product
- RSS Aggregator by Feedzy
- Fixed in
- 5.2.6
- What to do
- Update RSS Aggregator by Feedzy to 5.2.6 or newer.
Aug 7, 2026Simple CAPTCHA with Cloudflare Turnstile: Does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integrationCVE-2026-15239 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
- Product
- Simple CAPTCHA with Cloudflare Turnstile
- Fixed in
- 1.42.0
- What to do
- Update Simple CAPTCHA with Cloudflare Turnstile to 1.42.0 or newer.
Aug 6, 2026Simple Membership: Does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membershipCVE-2026-14936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.
- Product
- Simple Membership
- Fixed in
- 4.7.7
- What to do
- Update Simple Membership to 4.7.7 or newer.
Aug 6, 2026Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.CVE-2026-66712 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
- Affected
- up to 4.7.8
- What to do
- Affects up to 4.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.CVE-2026-66684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
- Product
- Events Manager
- Affected
- up to 7.4.2
- What to do
- Affects up to 7.4.2. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
- Affected
- up to 1.6.12.10
- What to do
- Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65508 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
- Affected
- up to 1.6.12.10
- What to do
- Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Popup Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28177 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.
- Product
- Popup Maker
- Affected
- up to 1.23.0
- What to do
- Affects up to 1.23.0. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Welcart e-Commerce: Does not properly sanitise a value taken from an imported CSV file before using it in a SQL statementCVE-2026-16065 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.
- Product
- Welcart e-Commerce
- Fixed in
- 2.11.32
- What to do
- Update Welcart e-Commerce to 2.11.32 or newer.
Aug 5, 2026Content Egg – Affiliate Product Importer & Price Comparison: Arbitrary File DeletionCVE-2026-15979 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'img_file' field within the cegg_data post metadata: the value passes only through wp_strip_all_tags() (which does not strip path traversal sequences), is stored directly in post meta, and is later concatenated without normalization into a filesystem path in getFullImgPath() before being passed to PHP's unlink(). This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Content Egg – Affiliate Product Importer & Price Comparison
- Affected
- up to 11.3.0
- What to do
- Affects up to 11.3.0. Update Content Egg – Affiliate Product Importer & Price Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026MailChimp Forms by MailMunch: Unauthorized modification of dataCVE-2026-7520 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.
- Product
- MailChimp Forms by MailMunch
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026Simple Yearly Archive: Stored Cross-Site ScriptingCVE-2026-7441 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlyArchive` shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Yearly Archive
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Simple Yearly Archive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings: Does not have authorisation and CSRF checks in one of its AJAX actionsCVE-2026-17515 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.
- Product
- MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings
- Fixed in
- 7.0.4
- What to do
- Update MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings to 7.0.4 or newer.
Aug 4, 2026Improve SEO: Does not properly validate uploaded filesCVE-2026-16618 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.
- Product
- Improve SEO
- Affected
- up to 2.0.11
- What to do
- Affects up to 2.0.11. Update Improve SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 4, 2026Wired Impact Volunteer Management: Does not have authorisation checks in one of its AJAX actionsCVE-2026-16546 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.
- Product
- Wired Impact Volunteer Management
- Fixed in
- 2.8.2
- What to do
- Update Wired Impact Volunteer Management to 2.8.2 or newer.
Aug 4, 2026Simple Google Calendar Outlook Events Widget: Does not validate a user-supplied URL before performing a server-side requestCVE-2026-16536 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.
- Product
- Simple Google Calendar Outlook Events Widget
- Fixed in
- 3.1.0
- What to do
- Update Simple Google Calendar Outlook Events Widget to 3.1.0 or newer.
Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
- Product
- Import and export users and customers
- Fixed in
- 2.4.2
- What to do
- Update Import and export users and customers to 2.4.2 or newer.
Aug 3, 2026Simple Membership: Does not sanitise a subscriber name value received from an unauthenticated payment approval requestCVE-2026-15931 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
- Product
- Simple Membership
- Fixed in
- 4.7.8
- What to do
- Update Simple Membership to 4.7.8 or newer.
Aug 3, 2026Simple Membership: Does not verify whether user creation failed during registration before using the returned valueCVE-2026-15930 · WordPress plugins & themes · reported by WPScanCritical 9.4
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
- Product
- Simple Membership
- Fixed in
- 4.7.8
- What to do
- Update Simple Membership to 4.7.8 or newer.
Aug 3, 2026Simply Schedule Appointments: Does not perform a capability check on an administrative appointment-listing shortcodeCVE-2026-15254 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
- Product
- Simply Schedule Appointments
- Fixed in
- 1.6.12.11
- What to do
- Update Simply Schedule Appointments to 1.6.12.11 or newer.
Aug 3, 2026Import and export users and customers: Does not restrict the path of a file it reads and displays during a CSV importCVE-2025-15673 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
- Product
- Import and export users and customers
- Fixed in
- 2.4.3
- What to do
- Update Import and export users and customers to 2.4.3 or newer.
Aug 2, 2026Simply Schedule Appointments: Does not correctly restrict a bulk appointment operation to the requester's own recordsCVE-2026-16540 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.
- Product
- Simply Schedule Appointments
- Fixed in
- 1.6.12.6
- What to do
- Update Simply Schedule Appointments to 1.6.12.6 or newer.
Aug 2, 2026POUCO Import Users: Does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accountsCVE-2026-16256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
- Product
- POUCO Import Users
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update POUCO Import Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026Simple Restrict: Does not enforce its content-restriction permission check on the REST API the way it does on the front endCVE-2026-15939 · WordPress plugins & themes · reported by WPScanLow 2.7
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.
- Product
- Simple Restrict
- Fixed in
- 1.2.9
- What to do
- Update Simple Restrict to 1.2.9 or newer.
Aug 2, 2026FluentBoards: Does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to accessCVE-2026-14938 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.
- Product
- FluentBoards
- Fixed in
- 1.95.3
- What to do
- Update FluentBoards to 1.95.3 or newer.
Aug 1, 2026MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: Stored Cross-Site ScriptingCVE-2026-15052 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Everest Toolkit: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13158 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
- Product
- Everest Toolkit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Everest Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026Demo Import: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13157 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
- Product
- Demo Import
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2026Improved Save Button: Second-order SQL InjectionCVE-2026-16092 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Improved Save Button
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Improved Save Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 29, 2026Link Library: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2026-18197 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.4
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4.
- Product
- Link Library
- Fixed in
- 7.9.4
- What to do
- Update Link Library to 7.9.4 or newer.
Full record and what to do →NVD recordtenable.comwordpress.org
Jul 28, 2026Demi – One Click Demo Import, WP Backup & Site Migration: Arbitrary Directory CopyCVE-2026-15012 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/ directory, which exposes the cryptographic restore key used to both authenticate the unauthenticated AJAX handler and forge signed restore-state envelopes. This makes it possible for unauthenticated attackers to copy arbitrary files to attacker-controlled destinations on the server. An active restore operation must have been initiated, which writes the .restore_key and .restore_step_token files to the public upload directory, before the exposed secrets can be harvested and chained to achieve unauthenticated arbitrary file copy.
- Product
- Demi – One Click Demo Import, WP Backup & Site Migration
- Affected
- up to 0.0.8
- What to do
- Affects up to 0.0.8. Update Demi – One Click Demo Import, WP Backup & Site Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026Demi – One Click Demo Import, WP Backup & Site Migration: Arbitrary Directory DeletionCVE-2026-14490 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explicitly accepts possession of the on-disk signing key as a standalone alternative to WordPress capability and nonce checks; an unauthenticated attacker who retrieves the exposed key can forge a valid signed state envelope to invoke `CleanDir::execute()` with a caller-supplied absolute path that is subject to no allow-list or path-canonicalization check. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server.
- Product
- Demi – One Click Demo Import, WP Backup & Site Migration
- Affected
- up to 0.0.7
- What to do
- Affects up to 0.0.7. Update Demi – One Click Demo Import, WP Backup & Site Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.CVE-2026-61953 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.
- Affected
- up to 15.0.6
- What to do
- Affects up to 15.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Quiz and Survey Master (QSM): Does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accountsCVE-2026-14820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 11.1.3
- What to do
- Update Quiz and Survey Master (QSM) to 11.1.3 or newer.
Jul 27, 2026Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2.CVE-2026-13400 · WordPress plugins & themes · reported by WPScanMedium 6.1
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.
- Affected
- up to 1.6.12.2
- Fixed in
- 1.6.12.4
- What to do
- Update the plugin to 1.6.12.4 or newer.
Jul 27, 2026Events Calendar: Does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status valueCVE-2026-13390 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.
- Product
- Events Calendar
- Fixed in
- 6.16.5.1
- What to do
- Update Events Calendar to 6.16.5.1 or newer.
Jul 23, 2026Visualizer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-65526 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.
- Product
- Visualizer
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Dokan Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65492 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.
- Product
- Dokan Pro
- Fixed in
- 5.0.7
- What to do
- Update Dokan Pro to 5.0.7 or newer.
Jul 23, 2026Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.CVE-2026-65483 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026TheGem: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.
- Product
- TheGem
- Fixed in
- 5.12.1.1
- What to do
- Update TheGem to 5.12.1.1 or newer.
Jul 23, 2026Modula Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65475 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
- Product
- Modula Image Gallery
- Affected
- up to 2.14.30
- What to do
- Affects up to 2.14.30. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.CVE-2026-65461 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.CVE-2026-61981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
- Affected
- up to 15.0.8
- What to do
- Affects up to 15.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.