Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

3,183 results · page 13 of 64

Jun 24, 2026Cornerstone: Does not enforce capability checks on one of its REST API routesCVE-2026-9709 · WordPress plugins & themes · reported by WPScanHigh 7.7
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository.
Product
Cornerstone
Fixed in
7.8.9
What to do
Update Cornerstone to 7.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 24, 2026Blue Captcha: Cross-Site Request ForgeryCVE-2026-10552 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blue Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 2.0.1. This is due to missing or incorrect nonce validation on the main admin panel (blcap_main_page) and on the Hall of Shame and Log subpages, which accept a 'blcap_action' / 'action' parameter from $_REQUEST and perform destructive operations (plugin uninstall via blcap_uninstall(), log deletion via blcap_delete_logs(), Hall of Shame deletion via blcap_delete_ip_db(), and adding IPs to the banned list via update_option('blcap_settings')) with no wp_verify_nonce(), check_admin_referer(), or check_ajax_referer() calls anywhere in the codebase. This makes it possible for unauthenticated attackers to uninstall the plugin, delete audit logs, remove Hall of Shame entries, and add arbitrary IP addresses to the block list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Blue Captcha
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Blue Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 24, 2026AI Share & Summarize: Does not sanitise and escape some of its shortcode attributes before outputting them in a pageCVE-2026-10531 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them in a page, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
AI Share & Summarize
Fixed in
2.0.4
What to do
Update AI Share & Summarize to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com
Jun 23, 2026Frontend File Manager: Does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing itCVE-2026-8378 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.
Product
Frontend File Manager
Affected
up to 23.6
What to do
Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 23, 2026Simple Basic Contact Form: Does not escape user-supplied input before reflecting it into the contact form output on validation errorsCVE-2026-8172 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.
Product
Simple Basic Contact Form
Affected
up to 20250114
What to do
Affects up to 20250114. Update Simple Basic Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 23, 2026Infility Global: Does not properly sanitize and escape some parameters before using them in SQL statementsCVE-2026-8163 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.
Product
Infility Global
Fixed in
2.15.19
What to do
Update Infility Global to 2.15.19 or newer.
Full record and what to do →NVD record wpscan.com
Jun 22, 2026Transbank Webpay: Does not sanitize and escape logs to be displayedCVE-2026-6858 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator
Product
Transbank Webpay
Fixed in
1.14.0
What to do
Update Transbank Webpay to 1.14.0 or newer.
Full record and what to do →NVD record wpscan.com hackedalert.com
Jun 22, 2026ultimate-woocommerce-auction-pro: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-4259 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
ultimate-woocommerce-auction-pro
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update ultimate-woocommerce-auction-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 22, 2026ultimate-woocommerce-auction-pro: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-4110 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
ultimate-woocommerce-auction-pro
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update ultimate-woocommerce-auction-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 20, 2026WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by senCVE-2020-37255 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wptimecapsule.com exploit-db.com
Jun 19, 2026WP Hotel Booking: Does not enforce capability checks in several of its AJAX handlersCVE-2026-9822 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
Product
WP Hotel Booking
Fixed in
2.3.1
What to do
Update WP Hotel Booking to 2.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026LearnPress: Does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capabilityCVE-2026-8383 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request
Product
LearnPress
Fixed in
4.3.7
What to do
Update LearnPress to 4.3.7 or newer.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce: Does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected CVE-2026-8089 · WordPress plugins & themes · reported by WPScanHigh 7.1
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.
Product
weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce
Fixed in
2.1.3
What to do
Update weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce to 2.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026WP Magnific Popup: Does not properly escape user-controlled link URLs before injecting them into the DOMCVE-2026-7850 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.
Product
WP Magnific Popup
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Magnific Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 13, 2026Store Locator: Does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9061 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).
Product
Store Locator
Fixed in
1.6.9
What to do
Update Store Locator to 1.6.9 or newer.
Full record and what to do →NVD record wpscan.com
Jun 12, 2026Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2026-9269 · WordPress plugins & themes · reported by WPScanLow 3.5
The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Secure Copy Content Protection and Content Locking
Fixed in
5.1.5
What to do
Update Secure Copy Content Protection and Content Locking to 5.1.5 or newer.
Full record and what to do →NVD record wpscan.com
Jun 10, 2026Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template.CVE-2026-53742 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.
Affected
up to 9.0.4
What to do
Affects up to 9.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org vulncheck.com
Jun 10, 2026Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice.CVE-2026-53740 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.
Affected
up to 4.6
What to do
Affects up to 4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org vulncheck.com
Jun 10, 2026the duplicate_post_dismiss_notice handler, which verifies no nonce or capability: Yoast Duplicate Post through 4.6 contains a cross-site request forgeryCVE-2026-53739 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.
Product
the duplicate_post_dismiss_notice handler, which verifies no nonce or capability
Affected
up to 4.6
What to do
Affects up to 4.6. Update the duplicate_post_dismiss_notice handler, which verifies no nonce or capability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org vulncheck.com
Jun 10, 2026Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page.CVE-2026-53737 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.
Affected
up to 1.12.18
What to do
Affects up to 1.12.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org vulncheck.com
Jun 10, 2026Schema & Structured Data for WP & AMP: Does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media typeCVE-2026-9067 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
Product
Schema & Structured Data for WP & AMP
Fixed in
1.60
What to do
Update Schema & Structured Data for WP & AMP to 1.60 or newer.
Full record and what to do →NVD record wpscan.com
Jun 10, 2026Store Locator: Does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1CVE-2026-9060 · WordPress plugins & themes · reported by WPScanLow 3.5
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).
Product
Store Locator
Fixed in
1.6.6
What to do
Update Store Locator to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com
Jun 10, 2026Xstore: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2026-3326 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Xstore
Fixed in
9.7.3
What to do
Update Xstore to 9.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Jun 9, 2026WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameteCVE-2016-20064 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
Jun 9, 2026Custom Block Builder: Does not consistently check the unfiltered_html capability across all paths that write to its block template code fieldsCVE-2026-8981 · WordPress plugins & themes · reported by WPScanLow 3.5
The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.
Product
Custom Block Builder
Fixed in
4.3.0
What to do
Update Custom Block Builder to 4.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Jun 7, 2026WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting CVE-2024-58349 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Jun 5, 2026WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug): Authentication BypassCVE-2026-5415 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via wp_localize_script() on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.
Product
WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug)
Affected
up to 5.38
What to do
Affects up to 5.38. Update WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record getwpcaptcha.com wordfence.com
Jun 5, 2026WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug): Arbitrary file uploadCVE-2026-5411 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.
Product
WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug)
Affected
up to 5.38
What to do
Affects up to 5.38. Update WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record getwpcaptcha.com wordfence.com
May 28, 2026Login No Captcha reCAPTCHA: Stored Cross-Site ScriptingCVE-2026-2374 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `$_SERVER['PHP_SELF']` superglobal in all versions up to, and including, 1.8.0. This is due to the `authenticate()` function storing the unsanitized output of `basename($_SERVER['PHP_SELF'])` in the `login_nocaptcha_error` WordPress option when a login attempt is made from a non-standard login page (e.g., xmlrpc.php). The `admin_notices()` function then echoes this stored value directly into the admin dashboard HTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator with a whitelisted IP address visits the WordPress dashboard within 30 seconds of the attack.
Product
Login No Captcha reCAPTCHA
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Login No Captcha reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Backup and Staging by WP Time Capsule: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-42760 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.25.
Product
Backup and Staging by WP Time Capsule
Affected
up to 1.22.25
What to do
Affects up to 1.22.25. Update Backup and Staging by WP Time Capsule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026EventPress: Does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the responseCVE-2026-6268 · WordPress plugins & themes · reported by WPScanHigh 7.1
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
Product
EventPress
Fixed in
22.2
What to do
Update EventPress to 22.2 or newer.
Full record and what to do →NVD record wpscan.com
May 20, 2026Email Encoder: Does not escape email addresses retrieved via user inputCVE-2026-5776 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
Product
Email Encoder
Fixed in
2.4.7
What to do
Update Email Encoder to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com
May 18, 2026Ajax Load More: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-6495 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ajax Load More
Fixed in
7.8.4
What to do
Update Ajax Load More to 7.8.4 or newer.
Full record and what to do →NVD record wpscan.com
May 18, 2026WP Photo Album Plus: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-6379 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Product
WP Photo Album Plus
Fixed in
9.1.11.001
What to do
Update WP Photo Album Plus to 9.1.11.001 or newer.
Full record and what to do →NVD record wpscan.com
May 17, 2026Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete arbitrary files by submitting unescaped filenamCVE-2018-25325 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete arbitrary files by submitting unescaped filenames through the delete_export_file AJAX action. Attackers can craft POST requests with directory traversal sequences in the filename parameter to delete sensitive files like wp-config.php outside the intended export directory.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lenonleite.com.br exploit-db.com
Apr 23, 2026reCaptcha by WebDesignBy: Does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() functionCVE-2026-4512 · WordPress plugins & themes · reported by WPScanLow 3.5
The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputting it in a JavaScript string context via the grecaptcha_js() function. This allows administrators on multisite installations (who do not have the unfiltered_html capability) to inject arbitrary JavaScript that executes for all visitors to the WordPress login page.
Product
reCaptcha by WebDesignBy
Fixed in
2.0
What to do
Update reCaptcha by WebDesignBy to 2.0 or newer.
Full record and what to do →NVD record wpscan.com
Apr 22, 2026Kcaptcha: Cross-Site Request ForgeryCVE-2026-4121 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Kcaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.1. This is due to missing nonce validation in the plugin's settings page handler (admin/setting.php). The settings form does not include a wp_nonce_field() and the form processing code does not call wp_verify_nonce() or check_admin_referer() before saving settings to the database via $wpdb->update(). This makes it possible for unauthenticated attackers to modify the plugin's CAPTCHA settings (enabling or disabling CAPTCHA on login, registration, lost password, and comment forms) via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
Product
Kcaptcha
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Kcaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 20, 2026Image Source Control Lite – Show Image Credits and Captions: Stored Cross-Site ScriptingCVE-2026-4852 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image Source' attachment field in all versions up to, and including, 3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Source Control Lite – Show Image Credits and Captions
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update Image Source Control Lite – Show Image Credits and Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 20, 2026Email Encoder: Does not sanitise and escape some of its settingsCVE-2024-7083 · WordPress plugins & themes · reported by WPScanLow 3.5
The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Email Encoder
Fixed in
2.3.4
What to do
Update Email Encoder to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com
Apr 13, 2026Product Filter for WooCommerce by WBW: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-3830 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
Product Filter for WooCommerce by WBW
Fixed in
3.1.3
What to do
Update Product Filter for WooCommerce by WBW to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Apr 8, 2026WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4CVE-2026-3396 · WordPress plugins & themes · reported by WordfenceHigh 7.5
WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026FSM Custom Featured Image Caption: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39693 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.
Product
FSM Custom Featured Image Caption
Affected
up to 1.25.1
What to do
Affects up to 1.25.1. Update FSM Custom Featured Image Caption to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 7, 2026SQL Chart Builder: Does not properly escape user inputCVE-2026-4079 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL Injection attacks against the dynamic filter functionality.
Product
SQL Chart Builder
Fixed in
2.3.8
What to do
Update SQL Chart Builder to 2.3.8 or newer.
Full record and what to do →NVD record wpscan.com
Mar 28, 2026Restaurant Cafeteria: Exposes insecure admin-ajax actions without nonce or capability checksCVE-2025-15445 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including Restaurant Cafeteria WordPress theme through 0.4.6_mods, pages, menus, and front page settings.
Product
Restaurant Cafeteria
Affected
up to 0.4.6
What to do
Affects up to 0.4.6. Update Restaurant Cafeteria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 26, 2026WP Lightbox 2: Does not sanitise and escape some of its settingsCVE-2026-1430 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Lightbox 2
Fixed in
3.0.7
What to do
Update WP Lightbox 2 to 3.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Mar 25, 2026Scape: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-31913 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Scape: from n/a through < 1.5.16.
Product
Scape
What to do
Update Scape to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 19, 2026Woocommerce Wholesale Lead Capture: Incorrect Privilege AssignmentCVE-2026-27542 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.
Product
Woocommerce Wholesale Lead Capture
Affected
up to 2.0.3.1
What to do
Affects up to 2.0.3.1. Update Woocommerce Wholesale Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 19, 2026Woocommerce Wholesale Lead Capture: Unrestricted Upload of File with Dangerous TypeCVE-2026-27540 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.
Product
Woocommerce Wholesale Lead Capture
Affected
up to 2.0.3.1
What to do
Affects up to 2.0.3.1. Update Woocommerce Wholesale Lead Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026PublishPress Capabilities: Missing AuthorizationCVE-2026-32394 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through <= 2.31.0.
Product
PublishPress Capabilities
Affected
up to 2.31.0
What to do
Affects up to 2.31.0. Update PublishPress Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML ouCVE-2026-22210 · WordPress plugins & themes · reported by VulnCheckLow 2.1
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.