Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42,546 results · page 116 of 851
Jul 13, 2026WPJAM Basic: Server-Side Request Forgery (SSRF)CVE-2026-57372 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server Side Request Forgery.This issue affects WPJAM Basic: from n/a through <= 7.0.
- Product
- WPJAM Basic
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WPJAM Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026WPJAM Basic: Deserialization of Untrusted DataCVE-2026-57371 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.
- Product
- WPJAM Basic
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WPJAM Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Themify Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57369 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.
- Product
- Themify Builder
- Affected
- up to 7.7.4
- What to do
- Affects up to 7.7.4. Update Themify Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Jobmonster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57368 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.8.5.
- Product
- Jobmonster
- Affected
- up to 4.8.5
- What to do
- Affects up to 4.8.5. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026reCAPTCHA (v2 & v3) for Asgaros Forum: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 & v3) for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA (v2 & v3) for Asgaros Forum: from n/a through <= 1.1.0.
- Product
- reCAPTCHA (v2 & v3) for Asgaros Forum
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update reCAPTCHA (v2 & v3) for Asgaros Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More: Improper Validation of Specified Quantity in InputCVE-2026-57364 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More: from n/a through <= 2.2.0.
- Product
- Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026ChatBot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57363 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue affects ChatBot: from n/a through <= 8.3.7.
- Product
- ChatBot
- Affected
- up to 8.3.7
- What to do
- Affects up to 8.3.7. Update ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ paraCVE-2026-14846 · Websites & servers · reported by cve-coordination@incibe.esMedium 4.5
In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an CVE-2026-57830 · Websites & servers · reported by security@joomla.orgHigh 8.8
Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticatCVE-2026-57829 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026Library Management System: Does not sanitize and escape a user-supplied parameter before using it in a SQL statementCVE-2026-12582 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.
- Product
- Library Management System
- Fixed in
- 3.5.8
- What to do
- Update Library Management System to 3.5.8 or newer.
Jul 13, 2026WP Job Portal: Does not verify ownershipCVE-2026-12397 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.
- Product
- WP Job Portal
- Fixed in
- 2.5.5
- What to do
- Update WP Job Portal to 2.5.5 or newer.
Jul 13, 2026WP Job Portal: Does not perform capability or ownership checks before allowing job moderation actionsCVE-2026-12396 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.
- Product
- WP Job Portal
- Fixed in
- 2.5.5
- What to do
- Update WP Job Portal to 2.5.5 or newer.
Jul 13, 2026Tutor LMS: Does notCVE-2026-12275 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
- Product
- Tutor LMS
- Fixed in
- 3.9.13
- What to do
- Update Tutor LMS to 3.9.13 or newer.
Jul 13, 2026Tutor LMS: Does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlersCVE-2026-12274 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
- Product
- Tutor LMS
- Fixed in
- 3.9.13
- What to do
- Update Tutor LMS to 3.9.13 or newer.
Jul 13, 2026Tutor LMS: Does not perform any authorization or post-target validation before creating a comment in one of its handlersCVE-2026-12273 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.
- Product
- Tutor LMS
- Fixed in
- 3.9.13
- What to do
- Update Tutor LMS to 3.9.13 or newer.
Jul 13, 2026Tutor LMS: Does not verify ownership of the targeted quiz attempt before writing to itCVE-2026-12271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.
- Product
- Tutor LMS
- Fixed in
- 3.9.13
- What to do
- Update Tutor LMS to 3.9.13 or newer.
Jul 13, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not restrict the PHP classes allowedCVE-2026-12081 · WordPress plugins & themes · reported by WPScanMedium 5
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
- Product
- Database for Contact Form 7, WPforms, Elementor forms
- Fixed in
- 1.5.2
- What to do
- Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.2 or newer.
Jul 13, 2026User Registration & Membership: Does not verify the authenticity of incoming payment-provider webhook notifications before acting on themCVE-2026-11964 · WordPress plugins & themes · reported by WPScanCritical 9.1
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
- Product
- User Registration & Membership
- Fixed in
- 5.2.2
- What to do
- Update User Registration & Membership to 5.2.2 or newer.
Jul 13, 2026User Registration & Membership: Does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current userCVE-2026-11963 · WordPress plugins & themes · reported by WPScanHigh 8.1
The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.
- Product
- User Registration & Membership
- Fixed in
- 5.2.2
- What to do
- Update User Registration & Membership to 5.2.2 or newer.
Jul 13, 2026Breeze Cache: Is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expressionCVE-2026-10551 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
- Product
- Breeze Cache
- Fixed in
- 2.5.6
- What to do
- Update Breeze Cache to 2.5.6 or newer.
Jul 11, 2026Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authentiCVE-2026-57828 · Websites & servers · reported by security@joomla.orgCritical 9
Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2026Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated CVE-2026-57827 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2026Genolve – AI image AI video generation: Unauthorized modification of dataCVE-2026-1359 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() function in all versions up to, and including, 5.0.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary WordPress options, including enabling user registration and setting the default role to administrator, resulting in privilege escalation.
- Product
- Genolve – AI image AI video generation
- Affected
- up to 5.0.5
- What to do
- Affects up to 5.0.5. Update Genolve – AI image AI video generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2026W3 Total Cache: Directory TraversalCVE-2026-9282 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().
- Product
- W3 Total Cache
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026NEX-Forms – Ultimate Forms Plugin for: Authorization bypassCVE-2026-9017 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users, and cause the site to dispatch attacker-controlled email content to attacker-chosen recipient addresses.
- Product
- NEX-Forms – Ultimate Forms Plugin for
- Affected
- up to 9.2.2
- What to do
- Affects up to 9.2.2. Update NEX-Forms – Ultimate Forms Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026CorvusPay WooCommerce Payment Gateway: Stored Cross-Site ScriptingCVE-2026-6939 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unauthenticated REST endpoint POST /wp-json/corvuspay/success/ is registered with permission_callback set to __return_true, and although a signature validation step exists it only logs the result without halting execution, meaning an attacker can supply a completely arbitrary signature and have a malicious approval_code stored in the database unchallenged.
- Product
- CorvusPay WooCommerce Payment Gateway
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update CorvusPay WooCommerce Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Context Blog: Sensitive Information ExposureCVE-2026-6801 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it possible for unauthenticated attackers to extract the content of password-protected posts.
- Product
- Context Blog
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Context Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2026WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales: Time-based blind SQL InjectionCVE-2026-4661 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete absence of authorization checks and the endpoint being registered for unauthenticated users via wp_ajax_nopriv_. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries and extract sensitive information from the database via time-based blind SQL injection techniques, including administrator password hashes.
- Product
- WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026fresh Podcaster: Stored Cross-Site ScriptingCVE-2026-1382 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'freshpodcaster' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- fresh Podcaster
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update fresh Podcaster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Essential Addons for Elementor – Popular Elementor Templates & Widgets: Authenticated Account TakeoverCVE-2026-15155 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the client-side editor UI and not on the server, and the applied sanitization does not strip or encode CR/LF characters, allowing CRLF sequences stored in that setting to survive into raw mail headers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject an additional Bcc header into the WordPress administrator's password-reset notification email, receive a copy of a valid administrator password-reset link, and achieve full administrator account takeover.
- Product
- Essential Addons for Elementor – Popular Elementor Templates & Widgets
- Affected
- up to 6.6.10
- What to do
- Affects up to 6.6.10. Update Essential Addons for Elementor – Popular Elementor Templates & Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026bbp Style Pack: Stored Cross-Site ScriptingCVE-2026-15010 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsp_topic_fields_form_save() (which writes $_POST['bsp_topic_fields_label{n}'] directly to post meta via update_post_meta() with no filtering) and missing output escaping in bsp_topic_content_append_topic_fields() (which concatenates the stored meta value into an HTML <span> and echoes it via apply_filters/echo without esc_html()). This makes it possible for authenticated attackers, with Subscriber-level access and above (who have bbPress topic-creation privileges), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, including unauthenticated visitors.
- Product
- bbp Style Pack
- Affected
- up to 6.4.5
- What to do
- Affects up to 6.4.5. Update bbp Style Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026WCFM – Frontend Manager for WooCommerce: Authorization bypassCVE-2026-12994 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to inject arbitrary reply content into any store inquiry, overwrite the main inquiry record in wp_wcfm_enquiries, and trigger unsolicited notification emails to customers and vendors. Unlike sibling controller branches (wcfm-enquiry and wcfm-enquiry-manage), the wcfm-my-account-enquiry-manage branch performs no is_user_logged_in() or current_user_can() check, and the nonce that serves as the sole barrier is embedded into every public page load without any login gate.
- Product
- WCFM – Frontend Manager for WooCommerce
- Affected
- up to 6.7.27
- What to do
- Affects up to 6.7.27. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026WP Easy Pay – Payment and Donation form Builder for Square: Authorization bypassCVE-2026-12738 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the status of arbitrary posts and pages to 'draft', effectively unpublishing arbitrary site content.
- Product
- WP Easy Pay – Payment and Donation form Builder for Square
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update WP Easy Pay – Payment and Donation form Builder for Square to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026WCFM Marketplace – Multivendor Marketplace for WooCommerce: Stored Cross-Site ScriptingCVE-2026-12126 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in all versions up to, and including, 3.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Vendor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An attacker can plant the payload by uploading a media attachment with a crafted title via the WordPress REST API (/wp-json/wp/v2/media), without ever invoking the AJAX endpoint themselves, as the unescaped title is later emitted inside DataTables JSON and inserted as innerHTML upon any privileged user loading the media dashboard.
- Product
- WCFM Marketplace – Multivendor Marketplace for WooCommerce
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update WCFM Marketplace – Multivendor Marketplace for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Wallet for WooCommerce: Authorization bypassCVE-2026-12103 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the login name, email address, and user ID of all WordPress accounts — including administrators — by submitting arbitrary search terms to the AJAX handler. The required 'search-user' nonce is localized into the wallet_param object on the standard WooCommerce My Account page, which is accessible to any authenticated user, making it trivially obtainable by a Subscriber.
- Product
- Wallet for WooCommerce
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Wallet for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026WP Hotel Booking: Insufficient Verification of Data AuthenticityCVE-2026-11901 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the `web_hook_process_paypal_standard()` IPN handler selecting its PayPal validation endpoint from the attacker-controlled `$_REQUEST['test_ipn']` parameter, force-upgrading any `pending` transaction to `completed` when `test_ipn=1`, and omitting post-verification checks on `receiver_email`, `mc_currency`, and `txn_id` uniqueness after receiving a `VERIFIED` response from PayPal. This makes it possible for unauthenticated attackers to mark arbitrary hotel bookings as fully paid without submitting genuine payment to the merchant — either by routing IPN validation through PayPal's sandbox using a free sandbox account, or by replaying a previously verified IPN from a nominal payment to an attacker-controlled PayPal account. An attacker requires only a free PayPal sandbox account (or any PayPal account) to obtain a `VERIFIED` response; no site credentials or special configuration are needed.
- Product
- WP Hotel Booking
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026White Label CMS: Stored Cross-Site ScriptingCVE-2026-11898 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- White Label CMS
- Affected
- up to 2.7.12
- What to do
- Affects up to 2.7.12. Update White Label CMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Widgets for Google Reviews: Stored Cross-Site ScriptingCVE-2026-11591 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Widgets for Google Reviews
- Affected
- up to 13.3
- What to do
- Affects up to 13.3. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Cost Calculator Builder: Sensitive Information ExposureCVE-2026-10865 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
- Product
- Cost Calculator Builder
- Affected
- up to 4.0.11
- What to do
- Affects up to 4.0.11. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026WCFM – Frontend Manager for WooCommerce: Insecure Direct Object ReferenceCVE-2026-10041 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.
- Product
- WCFM – Frontend Manager for WooCommerce
- Affected
- up to 6.7.27
- What to do
- Affects up to 6.7.27. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Code Engine: Remote Code ExecutionCVE-2025-6784 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
- Product
- Code Engine
- Affected
- up to 0.3.5
- What to do
- Affects up to 0.3.5. Update Code Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2026Catalyst Connect Zoho CRM Client Portal: Time-based SQL InjectionCVE-2025-5017 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Catalyst Connect Zoho CRM Client Portal
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Catalyst Connect Zoho CRM Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2026SureCart: Privilege escalationCVE-2026-7655 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, including administrators if the administrator account is linked to a SureCart customer record, and leverage that to reset the user's password and gain access to their account if the customer ID is known.
- Product
- SureCart
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2026Form Vibes – Database Manager for Forms: Stored Cross-Site ScriptingCVE-2026-13378 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Form Vibes – Database Manager for Forms
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Form Vibes – Database Manager for Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Print, PDF, Email by PrintFriendly: Stored Cross-Site ScriptingCVE-2026-9738 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versions up to, and including, 5.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Print, PDF, Email by PrintFriendly
- Affected
- up to 5.5.10
- What to do
- Affects up to 5.5.10. Update Print, PDF, Email by PrintFriendly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Notification for Telegram: Authorization bypassCVE-2026-7620 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthorized manipulation of the plugin's background task scheduling logic.
- Product
- Notification for Telegram
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026Affilia – Affiliate Program & Referral Tracking for: Unauthorized accessCVE-2026-7559 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, enabling financial fraud. The nonce required to pass the only authentication check is embedded in every frontend page load via rtwalwm_global_params.rtwalwm_nonce, making it trivially accessible to any authenticated user regardless of role.
- Product
- Affilia – Affiliate Program & Referral Tracking for
- Affected
- up to 3.3.3
- What to do
- Affects up to 3.3.3. Update Affilia – Affiliate Program & Referral Tracking for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026AI Chatbot & Workflow Automation by AIWU: Authorization bypassCVE-2026-6804 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to publish draft WordPress posts, exposing unpublished content, or unpublish live content, causing service disruption, by supplying arbitrary scenario IDs.
- Product
- AI Chatbot & Workflow Automation by AIWU
- Affected
- up to 1.4.12
- What to do
- Affects up to 1.4.12. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026AI Chatbot & Workflow Automation by AIWU: Missing AuthorizationCVE-2026-6803 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is due to missing capability checks and nonce verification on AJAX actions registered under both wp_ajax_ and wp_ajax_nopriv_ hooks, as the base controller's getPermissions() returns an empty array and neither removeGroup nor clear are added to getNoncedMethods(), causing the authorization gate to unconditionally return true for these actions. This makes it possible for unauthenticated attackers to delete specific records by ID or delete all records from any module's database table by unauthenticated attackers.
- Product
- AI Chatbot & Workflow Automation by AIWU
- Affected
- up to 1.4.12
- What to do
- Affects up to 1.4.12. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.