Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,036 results · page 123 of 801
Jun 17, 2026Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.CVE-2026-54805 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.CVE-2026-54804 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.
- Affected
- up to 2.16.3
- What to do
- Affects up to 2.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.CVE-2026-54803 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.CVE-2026-54802 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.
- Affected
- up to 3.9.3
- What to do
- Affects up to 3.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026JetFormBuilder: Incorrect Privilege AssignmentCVE-2026-54196 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.
- Product
- JetFormBuilder
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.CVE-2026-54195 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.
- Affected
- up to 3.6.0.1
- What to do
- Affects up to 3.6.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.CVE-2026-54194 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.
- Affected
- up to 3.15.4
- What to do
- Affects up to 3.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.CVE-2026-54192 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.
- Affected
- up to 6.2.9
- What to do
- Affects up to 6.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.CVE-2026-54189 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
- Affected
- up to 3.8.10
- What to do
- Affects up to 3.8.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.CVE-2026-54188 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
- Affected
- up to 3.8.10
- What to do
- Affects up to 3.8.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.CVE-2026-54187 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.
- Affected
- up to 3.8.10.1
- What to do
- Affects up to 3.8.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.CVE-2026-54186 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber SQL Injection in Cornerstone < 7.8.8 versions.CVE-2026-54185 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Cornerstone < 7.8.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.CVE-2026-54184 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.
- Affected
- up to 1.15
- What to do
- Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.CVE-2026-52706 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.
- Affected
- up to 3.8.10
- What to do
- Affects up to 3.8.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.CVE-2026-52705 · WordPress plugins & themes · reported by PatchstackCritical 9
Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.CVE-2026-52698 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.CVE-2026-52696 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.
- Affected
- up to 2.4.8
- What to do
- Affects up to 2.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.CVE-2026-49778 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.CVE-2026-49767 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.CVE-2026-49113 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.CVE-2026-49107 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.CVE-2026-49084 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.CVE-2026-49081 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.CVE-2026-49080 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.
- Affected
- up to 7.3.6
- What to do
- Affects up to 7.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.CVE-2026-49079 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.
- Affected
- up to 3.5.17
- What to do
- Affects up to 3.5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49076 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.
- Product
- JetEngine
- Affected
- up to 3.8.9.1
- What to do
- Affects up to 3.8.9.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.CVE-2026-49075 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.
- Affected
- up to 3.8.9.1
- What to do
- Affects up to 3.8.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.CVE-2026-49074 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.
- Affected
- up to 3.8.9.1
- What to do
- Affects up to 3.8.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Directorist Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49073 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.
- Product
- Directorist Booking
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Directorist Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.CVE-2026-49072 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.
- Affected
- up to 7.2.6
- What to do
- Affects up to 7.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.CVE-2026-49071 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.
- Affected
- up to 5.2.4
- What to do
- Affects up to 5.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.CVE-2026-49058 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.
- Affected
- up to 6.2.2
- What to do
- Affects up to 6.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.CVE-2026-49057 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.CVE-2026-48967 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.
- Affected
- up to 1.13.19
- What to do
- Affects up to 1.13.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.CVE-2026-48875 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.CVE-2026-48869 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.
- Affected
- up to 7.1.4
- What to do
- Affects up to 7.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.CVE-2026-45436 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.
- Affected
- up to 8.7.2
- What to do
- Affects up to 8.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.CVE-2026-42629 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.CVE-2026-42385 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.
- Affected
- up to 3.15.0
- What to do
- Affects up to 3.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.CVE-2026-42380 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.CVE-2026-41557 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.CVE-2026-40783 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.
- Affected
- up to 2.1.37
- What to do
- Affects up to 2.1.37. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.CVE-2026-40768 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.
- Affected
- up to 10.30.24
- What to do
- Affects up to 10.30.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.CVE-2026-40765 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.CVE-2026-40761 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Behold <= 1.5 versions.CVE-2026-40760 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Behold <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.CVE-2026-40759 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.CVE-2026-40758 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.CVE-2026-40755 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.