Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,036 results · page 127 of 801
Jun 17, 2026Integrate Google Drive: Missing AuthorizationCVE-2024-32949 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Integrate Google Drive: from n/a through 1.3.8.
- Product
- Integrate Google Drive
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Conversational Forms for ChatBot: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-32729 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Traversal. This issue affects Conversational Forms for ChatBot: from n/a through 1.1.8.
- Product
- Conversational Forms for ChatBot
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Conversational Forms for ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Social Media & Share Icons: : Missing AuthorizationCVE-2024-31435 · WordPress plugins & themes · reported by PatchstackMedium 4.3
: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Media & Share Icons: from n/a through 2.8.6.
- Product
- Social Media & Share Icons
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Social Media & Share Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Shareaholic: Missing AuthorizationCVE-2024-24709 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shareaholic: from n/a through 9.7.11.
- Product
- Shareaholic
- Affected
- up to 9.7.11
- What to do
- Affects up to 9.7.11. Update Shareaholic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Kids Online Store: Unrestricted Upload of File with Dangerous TypeCVE-2026-40750 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.
- Product
- Kids Online Store
- Affected
- up to 0.8.9
- What to do
- Affects up to 0.8.9. Update Kids Online Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026WP Review Slider Pro: Arbitrary File DeletionCVE-2026-8442 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected prefix but fails to sanitize path traversal sequences in the remaining relative path before passing it to unlink(). This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WP Review Slider Pro
- Affected
- up to 12.6.8
- What to do
- Affects up to 12.6.8. Update WP Review Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege Escalation to AdministratorCVE-2026-8176 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.CVE-2026-54198 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.
- Affected
- up to 3.35
- What to do
- Affects up to 3.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.CVE-2026-54197 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.CVE-2026-54191 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.CVE-2026-54190 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.
- Affected
- up to 1.12.5
- What to do
- Affects up to 1.12.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.CVE-2026-52715 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.
- Affected
- up to 4.5.5
- What to do
- Affects up to 4.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.CVE-2026-52714 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.
- Affected
- up to 12.4.16
- What to do
- Affects up to 12.4.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.CVE-2026-52712 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.CVE-2026-52711 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026RD Station: Improper Control of Generation of Code ('Code Injection')CVE-2026-49774 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.
- Product
- RD Station
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update RD Station to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026The Events Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-49772 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
- Product
- The Events Calendar
- Affected
- up to 6.16.2
- What to do
- Affects up to 6.16.2. Update The Events Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Metro Magazine: Missing AuthorizationCVE-2026-40809 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1.
- Product
- Metro Magazine
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Metro Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.CVE-2026-39581 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.CVE-2026-39574 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
- Affected
- up to 2.1.4.6
- What to do
- Affects up to 2.1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.CVE-2026-39490 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.CVE-2026-39437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.
- Affected
- up to 5.2.2
- What to do
- Affects up to 5.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026WooCommerce Stripe Payment Gateway: Unauthorized modification of dataCVE-2026-2381 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.
- Product
- WooCommerce Stripe Payment Gateway
- Affected
- up to 10.7.0
- What to do
- Affects up to 10.7.0. Update WooCommerce Stripe Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026WP Event Solution: Missing AuthorizationCVE-2025-68045 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.12.
- Product
- WP Event Solution
- Affected
- up to 4.1.12
- What to do
- Affects up to 4.1.12. Update WP Event Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026WP Review Slider Pro: SQL InjectionCVE-2026-8444 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Review Slider Pro
- Affected
- up to 12.6.8
- What to do
- Affects up to 12.6.8. Update WP Review Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026File Sharing & Download Manager – User Private Files: Stored Cross-Site ScriptingCVE-2026-10093 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- File Sharing & Download Manager – User Private Files
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update File Sharing & Download Manager – User Private Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026Abandoned Contact Form 7: Unauthorized arbitrary post deletionCVE-2026-9187 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, which is registered to both the wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks. The handler takes a user-supplied recover_id parameter from $_POST and passes it directly to wp_delete_post() with the force-delete flag set to true, without verifying that the ID belongs to the plugin's own cf7af_data post type. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, or other content on the affected site by sending a single admin-ajax.
- Product
- Abandoned Contact Form 7
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Abandoned Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026WP Review Slider Pro: SQL InjectionCVE-2026-8443 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The handler also returns the executed SQL string in its JSON response, which simplifies oracle construction for blind exploitation.
- Product
- WP Review Slider Pro
- Affected
- up to 12.6.8
- What to do
- Affects up to 12.6.8. Update WP Review Slider Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Premmerce Dev Tools: Remote Code ExecutionCVE-2026-6933 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' parameter directly into PHP stub files written to the wp-content/plugins/ directory. An attacker can inject a semicolon followed by arbitrary PHP code into the namespace parameter, causing the generated plugin file to contain and execute that code when accessed via HTTP. This makes it possible for authenticated attackers with Subscriber-level access and above to create arbitrary PHP files on the server and achieve remote code execution.
- Product
- Premmerce Dev Tools
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Premmerce Dev Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026RTMKit: Incorrect AuthorizationCVE-2026-5149 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to access the requested form submission data. This makes it possible for authenticated attackers, with Contributor-level access and above, to view arbitrary form submissions from other users by iterating the entries_id parameter.
- Product
- RTMKit
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update RTMKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026Static Block: Insecure Direct Object ReferenceCVE-2026-10780 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shortcode handler retrieving a post via get_post() using an attacker-supplied 'id' attribute and outputting its post_content without verifying the post's status (private, draft, pending) or the requesting user's capability to view it. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary posts, including private and draft static blocks (and any other post type) created by administrators, by embedding the [static_block_content id="X"] shortcode in their own content and previewing it.
- Product
- Static Block
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Static Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026Video Conferencing with Zoom: Authorization bypassCVE-2026-6964 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain the site's Zoom SDK API key and a freshly-signed JWT that can be used with the Zoom Web SDK to join any Zoom meeting associated with those credentials without a legitimate invitation.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.6.7
- What to do
- Affects up to 4.6.7. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.CVE-2026-9691 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.CVE-2026-52703 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.
- Affected
- up to 2.7.2
- What to do
- Affects up to 2.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.CVE-2026-52702 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.
- Affected
- up to 9.17
- What to do
- Affects up to 9.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.CVE-2026-52700 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.CVE-2026-52699 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.CVE-2026-52697 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.
- Affected
- up to 5.0.7
- What to do
- Affects up to 5.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.CVE-2026-52695 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.CVE-2026-52694 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.CVE-2026-52693 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.CVE-2026-52692 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.
- Affected
- up to 2.9.50
- What to do
- Affects up to 2.9.50. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.CVE-2026-49781 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.
- Affected
- up to 1.1.27
- What to do
- Affects up to 1.1.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Customer Privilege Escalation in Dokan <= 5.0.2 versions.CVE-2026-49780 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Customer Privilege Escalation in Dokan <= 5.0.2 versions.
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.CVE-2026-49776 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.
- Affected
- up to 2.32.6
- What to do
- Affects up to 2.32.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.CVE-2026-49775 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
- Affected
- up to 2.11.28
- What to do
- Affects up to 2.11.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.CVE-2026-49773 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.CVE-2026-49770 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.
- Affected
- up to 6.7.12
- What to do
- Affects up to 6.7.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.CVE-2026-49769 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.CVE-2026-49768 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
- Affected
- up to 1.26.13
- What to do
- Affects up to 1.26.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.