Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,254 results · page 133 of 806
Jun 15, 2026Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.CVE-2026-39525 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
- Affected
- up to 1.16.48.1
- What to do
- Affects up to 1.16.48.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.CVE-2026-39524 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.CVE-2026-39519 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.CVE-2026-39518 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.
- Affected
- up to 4.3.0.0
- What to do
- Affects up to 4.3.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Motors < 1.4.107 versions.CVE-2026-39515 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Motors < 1.4.107 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.CVE-2026-39514 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.
- Affected
- up to 2.17.3
- What to do
- Affects up to 2.17.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.CVE-2026-39513 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.
- Affected
- up to 3.12.21
- What to do
- Affects up to 3.12.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.CVE-2026-39512 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
- Affected
- up to 2.8.152
- What to do
- Affects up to 2.8.152. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.CVE-2026-39511 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.
- Affected
- up to 9.1.08.001
- What to do
- Affects up to 9.1.08.001. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.CVE-2026-39507 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.CVE-2026-39503 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
- Affected
- up to 3.6.5
- What to do
- Affects up to 3.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.CVE-2026-39502 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.
- Affected
- up to 1.15.38
- What to do
- Affects up to 1.15.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.CVE-2026-39499 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.19 versions.
- Affected
- up to 1.6.19
- What to do
- Affects up to 1.6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.CVE-2026-39498 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.CVE-2026-39493 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.
- Affected
- up to 1.6.9.27
- What to do
- Affects up to 1.6.9.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.CVE-2026-39492 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
- Affected
- up to 4.9.1
- What to do
- Affects up to 4.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.CVE-2026-39491 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.CVE-2026-39489 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.CVE-2026-39481 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.
- Affected
- up to 2.14.18
- What to do
- Affects up to 2.14.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.CVE-2026-39480 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.CVE-2026-39478 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions.
- Affected
- up to 4.23.87
- What to do
- Affects up to 4.23.87. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.CVE-2026-39474 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.
- Affected
- up to 3.0.10
- What to do
- Affects up to 3.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.CVE-2026-39472 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.CVE-2026-39471 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.
- Affected
- up to 6.4.3
- What to do
- Affects up to 6.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.CVE-2026-39470 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.CVE-2026-39468 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.
- Affected
- up to 5.11.1
- What to do
- Affects up to 5.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.CVE-2026-39465 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.
- Affected
- up to 3.106.0
- What to do
- Affects up to 3.106.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.CVE-2026-39463 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.
- Affected
- up to 4.9.31
- What to do
- Affects up to 4.9.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.CVE-2026-39451 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.
- Affected
- up to 18.0
- What to do
- Affects up to 18.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.CVE-2026-39450 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.CVE-2026-39449 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.CVE-2026-39447 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.
- Affected
- up to 1.6.10.6
- What to do
- Affects up to 1.6.10.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.CVE-2026-39441 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.CVE-2026-39435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.
- Affected
- up to 15.1.3
- What to do
- Affects up to 15.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.CVE-2026-39434 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.
- Affected
- up to 6.6.26
- What to do
- Affects up to 6.6.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.CVE-2026-34902 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.CVE-2026-34901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.CVE-2026-34900 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.
- Affected
- up to 4.14.2
- What to do
- Affects up to 4.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.CVE-2026-34898 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.CVE-2026-34892 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.
- Affected
- up to 1.0.271
- What to do
- Affects up to 1.0.271. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.CVE-2026-34891 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.CVE-2026-34886 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Editor Privilege Escalation in AI Engine <= 3.4.9 versions.CVE-2026-27407 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor Privilege Escalation in AI Engine <= 3.4.9 versions.
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.CVE-2026-27333 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.
- Affected
- up to 7.3.23
- What to do
- Affects up to 7.3.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.CVE-2026-27089 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.CVE-2026-27053 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.CVE-2026-25440 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.CVE-2026-25425 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.CVE-2026-24637 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.
- Affected
- up to 11.15.10
- What to do
- Affects up to 11.15.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.CVE-2026-23970 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.