Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,036 results · page 117 of 801
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.CVE-2026-57319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.CVE-2026-57318 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.CVE-2026-57317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.CVE-2026-57316 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.CVE-2026-57315 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.CVE-2026-57314 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.CVE-2026-57313 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.CVE-2026-57312 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.CVE-2026-56072 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.CVE-2026-56070 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.CVE-2026-56069 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.CVE-2026-56068 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.CVE-2026-56067 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.CVE-2026-56066 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber SQL Injection in Tourfic <= 2.22.5 versions.CVE-2026-56064 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Tourfic <= 2.22.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-56063 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.CVE-2026-56062 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.CVE-2026-56061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.CVE-2026-56060 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.CVE-2026-56059 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.CVE-2026-56058 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.CVE-2026-56057 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.CVE-2026-56055 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.CVE-2026-56048 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.CVE-2026-56047 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.CVE-2026-56046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.CVE-2026-56045 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.CVE-2026-56044 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.CVE-2026-56043 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.CVE-2026-56041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.CVE-2026-56040 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.CVE-2026-56039 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.CVE-2026-56038 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.CVE-2026-56036 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.CVE-2026-56035 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.CVE-2026-56034 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.CVE-2026-56033 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.CVE-2026-56032 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.CVE-2026-56031 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.CVE-2026-56030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.CVE-2026-56029 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions.CVE-2026-56028 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions.
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.CVE-2026-56027 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.CVE-2026-56026 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.CVE-2026-56025 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.CVE-2026-56011 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.CVE-2026-56010 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.CVE-2026-56008 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.CVE-2026-54847 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.CVE-2026-54846 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.