Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,161 results · page 11 of 24
Aug 6, 2026WPCargo Track & Trace: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-12713 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
- Product
- WPCargo Track & Trace
- Fixed in
- 8.0.4
- What to do
- Update WPCargo Track & Trace to 8.0.4 or newer.
Aug 5, 2026Multi Uploader for Gravity Forms: Unauthorized arbitrary media deletionCVE-2026-5581 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object. This makes it possible for unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction.
- Product
- Multi Uploader for Gravity Forms
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026Easy Post Submission: Unauthorized modification of dataCVE-2026-4431 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is supplied. This makes it possible for unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, as well as change the post status to draft (effectively unpublishing them) via the 'postId' parameter.
- Product
- Easy Post Submission
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Easy Post Submission to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026Custom Fields: Does not validate a user-supplied file path before deletionCVE-2026-16940 · WordPress plugins & themes · reported by WPScanCritical 10
The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover.
- Product
- Custom Fields
- Fixed in
- 1.5.1
- What to do
- Update Custom Fields to 1.5.1 or newer.
Aug 5, 2026Ajax Load More: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-15360 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.
- Product
- Ajax Load More
- Fixed in
- 8.0.1
- What to do
- Update Ajax Load More to 8.0.1 or newer.
Aug 5, 2026OTP Login With Phone Number, OTP Verification: Does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guessCVE-2026-15210 · WordPress plugins & themes · reported by WPScanCritical 9.1
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.
- Product
- OTP Login With Phone Number, OTP Verification
- Fixed in
- 1.8.71
- What to do
- Update OTP Login With Phone Number, OTP Verification to 1.8.71 or newer.
Aug 5, 2026The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account tCVE-2026-9273 · WordPress plugins & themes · reported by WordfenceCritical 9.3
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 4, 2026Improve SEO: Does not properly validate uploaded filesCVE-2026-16618 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.
- Product
- Improve SEO
- Affected
- up to 2.0.11
- What to do
- Affects up to 2.0.11. Update Improve SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 4, 2026Easy Integration for Dropbox: Does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated usersCVE-2026-15958 · WordPress plugins & themes · reported by WPScanCritical 9.3
The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.
- Product
- Easy Integration for Dropbox
- Fixed in
- 2.2.0
- What to do
- Update Easy Integration for Dropbox to 2.2.0 or newer.
Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
- Product
- Import and export users and customers
- Fixed in
- 2.4.2
- What to do
- Update Import and export users and customers to 2.4.2 or newer.
Aug 3, 2026Link Library: Does not properly sanitise and escape a user-supplied value before using it in a SQL queryCVE-2026-16532 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
- Product
- Link Library
- Fixed in
- 7.9.3
- What to do
- Update Link Library to 7.9.3 or newer.
Aug 3, 2026ChamaWP: Does not properly validate a password reset requestCVE-2026-16300 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.
- Product
- ChamaWP
- Fixed in
- 1.0.13
- What to do
- Update ChamaWP to 1.0.13 or newer.
Aug 3, 2026Personal QR Message: Does not restrict the file types that can be uploaded through an unauthenticated handlerCVE-2026-16250 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.
- Product
- Personal QR Message
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Personal QR Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026Insert or Embed Articulate Content into: Does not correctly validate the contents of an uploaded archiveCVE-2026-16060 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code execution on servers configured to execute it.
- Product
- Insert or Embed Articulate Content into
- Affected
- up to 4.3000000027
- What to do
- Affects up to 4.3000000027. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026Simple Membership: Does not verify whether user creation failed during registration before using the returned valueCVE-2026-15930 · WordPress plugins & themes · reported by WPScanCritical 9.4
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
- Product
- Simple Membership
- Fixed in
- 4.7.8
- What to do
- Update Simple Membership to 4.7.8 or newer.
Aug 3, 2026SoftMarket — Digital Marketplace: Does not properly validate an authentication token in one branch of its email-verification flowCVE-2026-14557 · WordPress plugins & themes · reported by WPScanCritical 9.1
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.
- Product
- SoftMarket — Digital Marketplace
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update SoftMarket — Digital Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026Super Store Finder: Does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL queryCVE-2026-12965 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.
- Product
- Super Store Finder
- Fixed in
- 7.11
- What to do
- Update Super Store Finder to 7.11 or newer.
Aug 3, 2026Webinfos: Does not validate the type or name of uploaded filesCVE-2026-12872 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files (including PHP) to a web-accessible directory, leading to remote code execution on servers that execute PHP from the uploads path.
- Product
- Webinfos
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Webinfos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026POUCO Import Users: Does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accountsCVE-2026-16256 · WordPress plugins & themes · reported by WPScanCritical 9.8
The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site.
- Product
- POUCO Import Users
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update POUCO Import Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026WooCommerce - Social Login: Authentication BypassCVE-2026-8457 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id_token and decoding only its base64 payload without verifying the JWT signature against Apple's public keys or validating the issuer, audience, or expiry claims, combined with the security nonce required to invoke the login flow being publicly exposed to unauthenticated users via a localized JavaScript object on the login page. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying a forged id_token whose payload contains the target user's email address, as that email is used without any role exclusion to resolve a WordPress account and immediately issue an authenticated session for it.
- Product
- WooCommerce - Social Login
- Affected
- up to 2.8.7
- What to do
- Affects up to 2.8.7. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026Single Sign On For TNG: Authentication BypassCVE-2026-15964 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_ajax()` function — registered on `wp_ajax_nopriv_ssoprocess_ajax` and therefore reachable without authentication — accepting an attacker-supplied `email` parameter with the `setnewpassword` operation and calling `reset_password()` on the resolved account without any ownership token, email confirmation link, or capability check. The sole guard is a call to `check_ajax_referer()`, which provides no authorization barrier because the `ssoajaxnonce` nonce is publicly broadcast on every front-end page via `wp_localize_script()` into the `SSOPWDREQUIREMENT` JavaScript object; since WordPress computes nonces for logged-out visitors against a shared anonymous session context, any unauthenticated visitor can scrape a valid nonce from the homepage and use it to authenticate the request. This makes it possible for unauthenticated attackers to change the password of any WordPress account, including administrator accounts, enabling complete site takeover.
- Product
- Single Sign On For TNG
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Single Sign On For TNG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Participants Database: Does not properly sanitize and escape a user-supplied parameter before using it in a SQL queryCVE-2026-13596 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.
- Product
- Participants Database
- Fixed in
- 2.7.8.4
- What to do
- Update Participants Database to 2.7.8.4 or newer.
Aug 1, 2026FormGent: Unauthorized arbitrary file deletionCVE-2026-3141 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any authentication middleware in routes/rest/api.php. This makes it possible for unauthenticated attackers to delete arbitrary files within the formgent uploads directory. Additionally, on Linux servers where the wp-content/uploads/formgent directory does not yet exist (the default state after plugin installation), the path traversal protection can be bypassed, enabling deletion of arbitrary files including wp-config.php which can lead to complete site takeover via a fresh WordPress installation.
- Product
- FormGent
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update FormGent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 31, 2026Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.CVE-2026-58048 · Websites & servers · reported by support@hackerone.comCritical 9.4
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026ShopMonitor.io: Does not properly restrict its email-rerouting test modeCVE-2026-14919 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.
- Product
- ShopMonitor.io
- Fixed in
- 1.2.0
- What to do
- Update ShopMonitor.io to 1.2.0 or newer.
Jul 31, 2026Realtyna Organic IDX plugin + WPL Real Estate: Arbitrary File UploadCVE-2026-14483 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installations. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The WPL I/O service endpoint is registered on the public WordPress init hook with no WordPress capability check, and the required api_key and api_secret values are static defaults seeded by the plugin's own SQL migration files, meaning any unauthenticated attacker who knows these publicly documented defaults can reach and exploit the vulnerable upload path.
- Product
- Realtyna Organic IDX plugin + WPL Real Estate
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update Realtyna Organic IDX plugin + WPL Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 30, 2026Remote API: Does not authenticate a request before deserializing user-supplied inputCVE-2026-14602 · WordPress plugins & themes · reported by WPScanCritical 9
The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.
- Product
- Remote API
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Remote API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2026Admin and Site Enhancements (ASE) Pro: Remote Code ExecutionCVE-2026-16610 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA validation is bypassable by omitting an attacker-supplied key, and repeater row keys from cfgroup[input] are stored verbatim and later spliced into an eval() call in recursive_html without any sanitization or identifier validation. This makes it possible for unauthenticated attackers to execute code on the server. This requires the [post_cf_form] shortcode to be present on at least one publicly accessible page, as the nonce and session ID needed to reach the vulnerable save handler are emitted to unauthenticated visitors by that shortcode.
- Product
- Admin and Site Enhancements (ASE) Pro
- Affected
- up to 8.9.0
- What to do
- Affects up to 8.9.0. Update Admin and Site Enhancements (ASE) Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2026Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the tarCVE-2026-65888 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user passworCVE-2026-65887 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary fCVE-2026-65886 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queriesCVE-2026-65890 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directoriCVE-2026-65889 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrarCVE-2026-65885 · Websites & servers · reported by security@joomla.orgCritical 9.4
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticateCVE-2026-65884 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection inCVE-2026-65883 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026Cost Calculator Builder PRO: Remote Code ExecutionCVE-2026-14900 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.
- Product
- Cost Calculator Builder PRO
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update Cost Calculator Builder PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2026Meta Box AIO: Missing AuthorizationCVE-2026-14488 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_delete action without any capability or ownership check, and the nonce verification in check_ajax() being gated behind is_ajax() which is false for template_redirect requests, making it bypassable. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages by supplying an attacker-controlled post ID via the rwmb_frontend_field_object_id GET parameter on any page that hosts a frontend submission form regardless of whether allow_delete is enabled.
- Product
- Meta Box AIO
- Affected
- up to 3.8.0
- What to do
- Affects up to 3.8.0. Update Meta Box AIO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2026Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: Missing AuthorizationCVE-2025-10656 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user_filter function. This makes it possible for unauthenticated attackers to create admin accounts.
- Product
- Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light
- Affected
- up to 2.4.37
- What to do
- Affects up to 2.4.37. Update Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2026Streamit: Does not perform any authorization or nonce verification on one of its unauthenticated AJAX routesCVE-2026-13423 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.
- Product
- Streamit
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update Streamit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 29, 2026Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …: Authentication BypassCVE-2026-18072 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.
- Product
- Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …
- What to do
- Update Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … to the newest version.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for fCVE-2026-65880 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery: Authentication Bypass leading to Account TakeoverCVE-2026-15014 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated attackers to complete OTP verification for a phone number they control, then resubmit the registration request with a victim's `billing_phone` value to have `wp_set_auth_cookie()` called for the resolved victim account, enabling full authentication as any existing WordPress user whose registered phone number is known or guessable, including administrators.
- Product
- SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
- Affected
- up to 3.9.7
- What to do
- Affects up to 3.9.7. Update SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2026TrueBooker: Does not validate account ownershipCVE-2026-14545 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
- Product
- TrueBooker
- Fixed in
- 1.2.4
- What to do
- Update TrueBooker to 1.2.4 or newer.
Jul 27, 2026Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.CVE-2026-59550 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.CVE-2026-59549 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.CVE-2026-59538 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.CVE-2026-59533 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-59527 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 27, 2026Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attaCVE-2026-65879 · Websites & servers · reported by security@joomla.orgCritical 9.8
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.