Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,246 results · page 116 of 485
Apr 8, 2026Freeio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39679 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.
- Product
- Freeio
- Affected
- up to 1.3.21
- What to do
- Affects up to 1.3.21. Update Freeio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Pinpoint Booking System: Missing AuthorizationCVE-2026-39678 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pinpoint Booking System Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through 2.9.9.7.2.
- Product
- Pinpoint Booking System
- Affected
- up to 2.9.9.7.2
- What to do
- Affects up to 2.9.9.7.2. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Emphires: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39677 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires allows PHP Local File Inclusion.This issue affects Emphires: from n/a through <= 3.9.
- Product
- Emphires
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update Emphires to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Download Manager: Missing AuthorizationCVE-2026-39676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.
- Product
- Download Manager
- Affected
- up to 3.3.52
- What to do
- Affects up to 3.3.52. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Court Reservation: Missing AuthorizationCVE-2026-39675 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Court Reservation: from n/a through <= 1.10.11.
- Product
- Court Reservation
- Affected
- up to 1.10.11
- What to do
- Affects up to 1.10.11. Update Court Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026MK Google Directions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manoj Kumar MK Google Directions google-distance-calculator allows DOM-Based XSS.This issue affects MK Google Directions: from n/a through <= 3.1.1.
- Product
- MK Google Directions
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update MK Google Directions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026iZooto: Missing AuthorizationCVE-2026-39673 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iZooto: from n/a through <= 3.7.20.
- Product
- iZooto
- Affected
- up to 3.7.20
- What to do
- Affects up to 3.7.20. Update iZooto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026ShipTime: Discounted Shipping Rates: Missing AuthorizationCVE-2026-39672 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipTime: Discounted Shipping Rates: from n/a through <= 1.1.1.
- Product
- ShipTime: Discounted Shipping Rates
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update ShipTime: Discounted Shipping Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026NitroPack: Missing AuthorizationCVE-2026-39669 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.
- Product
- NitroPack
- Affected
- up to 1.19.3
- What to do
- Affects up to 1.19.3. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Book Previewer for Woocommerce: Missing AuthorizationCVE-2026-39668 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.
- Product
- Book Previewer for Woocommerce
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Book Previewer for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Korea SNS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39667 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jongmyoung Kim Korea SNS korea-sns allows DOM-Based XSS.This issue affects Korea SNS: from n/a through <= 1.7.0.
- Product
- Korea SNS
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Korea SNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Hello Bar Popup Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39666 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1.
- Product
- Hello Bar Popup Builder
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Hello Bar Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026SEO Friendly Images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39665 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac SEO Friendly Images seo-image allows DOM-Based XSS.This issue affects SEO Friendly Images: from n/a through <= 3.0.5.
- Product
- SEO Friendly Images
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update SEO Friendly Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Leadrebel: Missing AuthorizationCVE-2026-39664 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadrebel: from n/a through <= 1.0.2.
- Product
- Leadrebel
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Leadrebel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026TrueBooker: Missing AuthorizationCVE-2026-39663 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.5.
- Product
- TrueBooker
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Product Price by Formula for WooCommerce: Missing AuthorizationCVE-2026-39662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Price by Formula for WooCommerce: from n/a through <= 2.5.6.
- Product
- Product Price by Formula for WooCommerce
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Product Price by Formula for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Panda Pods Repeater Field: Missing AuthorizationCVE-2026-39658 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through <= 1.5.12.
- Product
- Panda Pods Repeater Field
- Affected
- up to 1.5.12
- What to do
- Affects up to 1.5.12. Update Panda Pods Repeater Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026leadlovers forms: Missing AuthorizationCVE-2026-39657 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through <= 1.0.2.
- Product
- leadlovers forms
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update leadlovers forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Razorpay for WooCommerce: Missing AuthorizationCVE-2026-39656 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.
- Product
- Razorpay for WooCommerce
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Razorpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WP Simple HTML Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39654 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.
- Product
- WP Simple HTML Sitemap
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Video Conferencing with Zoom: Missing AuthorizationCVE-2026-39653 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Conferencing with Zoom: from n/a through <= 4.6.6.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.6.6
- What to do
- Affects up to 4.6.6. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026iGMS Direct Booking: Missing AuthorizationCVE-2026-39652 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iGMS Direct Booking: from n/a through <= 1.3.
- Product
- iGMS Direct Booking
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update iGMS Direct Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Total Poll Lite: Missing AuthorizationCVE-2026-39651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through <= 4.12.0.
- Product
- Total Poll Lite
- Affected
- up to 4.12.0
- What to do
- Affects up to 4.12.0. Update Total Poll Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026UnitechPay: Missing AuthorizationCVE-2026-39650 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through <= 1.0.2.
- Product
- UnitechPay
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update UnitechPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Royale News: Missing AuthorizationCVE-2026-39649 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royale News: from n/a through <= 2.2.4.
- Product
- Royale News
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Royale News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Cream Blog: Missing AuthorizationCVE-2026-39648 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.
- Product
- Cream Blog
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Cream Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39646 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bozdoz Leaflet Map leaflet-map allows Stored XSS.This issue affects Leaflet Map: from n/a through <= 3.4.4.
- Product
- Leaflet Map
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Wp Ultimate Review: Missing AuthorizationCVE-2026-39644 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.
- Product
- Wp Ultimate Review
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Payment Plugins for PayPal WooCommerce: Missing AuthorizationCVE-2026-39643 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.
- Product
- Payment Plugins for PayPal WooCommerce
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update Payment Plugins for PayPal WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026RPS Include Content: Missing AuthorizationCVE-2026-39639 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RPS Include Content: from n/a through <= 1.2.2.
- Product
- RPS Include Content
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update RPS Include Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Qubely: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39638 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through <= 1.8.14.
- Product
- Qubely
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update Qubely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Mogi: Missing AuthorizationCVE-2026-39637 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.
- Product
- Mogi
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Mogi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Livemesh Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39636 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through <= 9.0.
- Product
- Livemesh Addons for Elementor
- Affected
- up to 9.0
- What to do
- Affects up to 9.0. Update Livemesh Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WPSchoolPress: Missing AuthorizationCVE-2026-39631 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through <= 2.2.35.
- Product
- WPSchoolPress
- Affected
- up to 2.2.35
- What to do
- Affects up to 2.2.35. Update WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Uminex: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39629 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affects Uminex: from n/a through <= 1.0.9.
- Product
- Uminex
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Uminex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026DukaMarket: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39628 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issue affects DukaMarket: from n/a through <= 1.3.0.
- Product
- DukaMarket
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update DukaMarket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Ashe: Missing AuthorizationCVE-2026-39627 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wproyal Ashe ashe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe: from n/a through <= 2.266.
- Product
- Ashe
- Affected
- up to 2.266
- What to do
- Affects up to 2.266. Update Ashe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Armania: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39626 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Armania armania allows Code Injection.This issue affects Armania: from n/a through <= 1.4.8.
- Product
- Armania
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Armania to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026TechOne: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39625 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes TechOne techone allows Code Injection.This issue affects TechOne: from n/a through <= 3.0.3.
- Product
- TechOne
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update TechOne to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Biolife: Missing AuthorizationCVE-2026-39624 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kutethemes Biolife biolife allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Biolife: from n/a through <= 3.2.3.
- Product
- Biolife
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Biolife to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Biolife: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39623 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Biolife biolife allows PHP Local File Inclusion.This issue affects Biolife: from n/a through <= 3.2.3.
- Product
- Biolife
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Biolife to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Education Base: Missing AuthorizationCVE-2026-39622 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in acmethemes Education Base education-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Base: from n/a through <= 3.0.8.
- Product
- Education Base
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Education Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Download Attachments: Authorization Bypass Through User-Controlled KeyCVE-2026-39616 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.4.0.
- Product
- Download Attachments
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Download Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Download Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39615 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Download Manager download-manager allows Stored XSS.This issue affects Download Manager: from n/a through <= 3.3.53.
- Product
- Download Manager
- Affected
- up to 3.3.53
- What to do
- Affects up to 3.3.53. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026JW Player for: Missing AuthorizationCVE-2026-39614 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a through <= 2.3.6.
- Product
- JW Player for
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update JW Player for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Boutique: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39613 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes Boutique kute-boutique allows PHP Local File Inclusion.This issue affects Boutique: from n/a through <= 2.3.3.
- Product
- Boutique
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Boutique to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026KuteShop: Missing AuthorizationCVE-2026-39612 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KuteShop: from n/a through <= 4.2.9.
- Product
- KuteShop
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update KuteShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026KuteShop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39611 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in kutethemes KuteShop kuteshop allows PHP Local File Inclusion.This issue affects KuteShop: from n/a through <= 4.2.9.
- Product
- KuteShop
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update KuteShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WpXmas-Snow: Missing AuthorizationCVE-2026-39610 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpXmas-Snow: from n/a through <= 1.1.
- Product
- WpXmas-Snow
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WpXmas-Snow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Wava Payment: Missing AuthorizationCVE-2026-39609 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wava Payment: from n/a through <= 0.3.7.
- Product
- Wava Payment
- Affected
- up to 0.3.7
- What to do
- Affects up to 0.3.7. Update Wava Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.