Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,032 results · page 116 of 801
Jun 26, 2026Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.CVE-2026-57663 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.CVE-2026-57662 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.CVE-2026-57661 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.CVE-2026-57660 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.CVE-2026-57659 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.CVE-2026-57658 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.CVE-2026-57657 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.CVE-2026-57656 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.CVE-2026-57655 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.CVE-2026-57654 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.CVE-2026-57653 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.CVE-2026-57652 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.CVE-2026-57651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.CVE-2026-57650 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.CVE-2026-57649 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.CVE-2026-57648 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.CVE-2026-57647 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.CVE-2026-57646 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.CVE-2026-57645 · WordPress plugins & themes · reported by PatchstackHigh 8.1
newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.CVE-2026-57644 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor SQL Injection in WP Post Author <= 3.9.1 versions.CVE-2026-57643 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in WP Post Author <= 3.9.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor SQL Injection in Gallery <= 4.7.8 versions.CVE-2026-57642 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Gallery <= 4.7.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.CVE-2026-57641 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.CVE-2026-57640 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.CVE-2026-57638 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.CVE-2026-57637 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.CVE-2026-57636 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.CVE-2026-57635 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.CVE-2026-57634 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare <= 1.1.0 versions.CVE-2026-57633 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare <= 1.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.CVE-2026-57632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Administrator SQL Injection in Popup box <= 6.0.1 versions.CVE-2026-57631 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Popup box <= 6.0.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-57630 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.CVE-2026-57629 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-57628 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP All Import <= 4.0.1 versions.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.CVE-2026-57627 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.CVE-2026-57622 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.CVE-2026-57618 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.CVE-2026-57617 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.CVE-2026-57431 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.CVE-2026-57430 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.CVE-2026-57325 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.CVE-2026-57324 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.CVE-2026-57323 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026weDevs weMail wemail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2.
- Product
- weDevs weMail wemail
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update weDevs weMail wemail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.CVE-2026-57321 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.CVE-2026-57319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.CVE-2026-57318 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.CVE-2026-57317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.CVE-2026-57316 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.