Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42,654 results · page 136 of 854
Jun 17, 2026Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.CVE-2026-39576 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.CVE-2026-39560 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.CVE-2026-39559 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.CVE-2026-39556 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.CVE-2026-39523 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.CVE-2026-39445 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.CVE-2026-39442 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.
- Affected
- up to 1.2.26
- What to do
- Affects up to 1.2.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026JobBank: Missing AuthorizationCVE-2025-69189 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3.
- Product
- JobBank
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update JobBank to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.CVE-2025-69175 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Etude <= 1.6 versions.CVE-2025-69174 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Etude <= 1.6 versions.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.CVE-2025-69170 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.CVE-2025-69166 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.CVE-2025-69164 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
- Affected
- up to 1.10
- What to do
- Affects up to 1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Granola <= 1.13 versions.CVE-2025-69158 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Granola <= 1.13 versions.
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.CVE-2025-69157 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.
- Affected
- up to 1.15
- What to do
- Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.CVE-2025-69144 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.
- Affected
- up to 1.10
- What to do
- Affects up to 1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.CVE-2025-69140 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Entrepreneur - Booking for Small Businesses: Deserialization of Untrusted DataCVE-2025-69130 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection. This issue affects Entrepreneur - Booking for Small Businesses WordPress Theme: from n/a before 3.1.5.
- Product
- Entrepreneur - Booking for Small Businesses
- Fixed in
- 3.1.5
- What to do
- Update Entrepreneur - Booking for Small Businesses to 3.1.5 or newer.
Jun 17, 2026JobCareer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-69128 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through 7.3.
- Product
- JobCareer
- Affected
- up to 7.3
- What to do
- Affects up to 7.3. Update JobCareer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.CVE-2025-69127 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.CVE-2025-69126 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.CVE-2025-69123 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.CVE-2025-69120 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.CVE-2025-69115 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.CVE-2025-69111 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.CVE-2025-69106 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.CVE-2025-68524 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Creatify: Deserialization of Untrusted DataCVE-2025-60236 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.
- Product
- Creatify
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Creatify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026The Hospital: Deserialization of Untrusted DataCVE-2025-60231 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1.
- Product
- The Hospital
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update The Hospital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026The Barber Shop: Deserialization of Untrusted DataCVE-2025-60230 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.
- Product
- The Barber Shop
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update The Barber Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Lagom: Deserialization of Untrusted DataCVE-2025-60229 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.
- Product
- Lagom
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Lagom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions.CVE-2025-59554 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.CVE-2025-15657 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.
- Affected
- up to 93.1.0
- What to do
- Affects up to 93.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.CVE-2026-9690 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Taskbuilder: Does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodesCVE-2026-9570 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.
- Product
- Taskbuilder
- Fixed in
- 5.0.8
- What to do
- Update Taskbuilder to 5.0.8 or newer.
Jun 17, 2026Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred: Stored Cross-Site ScriptingCVE-2026-8607 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026Permalink Manager Lite: Stored Cross-Site ScriptingCVE-2026-8494 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.
- Product
- Permalink Manager Lite
- Affected
- up to 2.5.3.3
- What to do
- Affects up to 2.5.3.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026LearnPress: Does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capabilityCVE-2026-8383 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request
- Product
- LearnPress
- Fixed in
- 4.3.7
- What to do
- Update LearnPress to 4.3.7 or newer.
Jun 17, 2026weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce: Does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected CVE-2026-8089 · WordPress plugins & themes · reported by WPScanHigh 7.1
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.
- Product
- weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce
- Fixed in
- 2.1.3
- What to do
- Update weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce to 2.1.3 or newer.
Jun 17, 2026WP Magnific Popup: Does not properly escape user-controlled link URLs before injecting them into the DOMCVE-2026-7850 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.
- Product
- WP Magnific Popup
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Magnific Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.CVE-2026-54811 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 17, 2026Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.CVE-2026-54807 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.CVE-2026-54806 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.
- Affected
- up to 5.6.3.1
- What to do
- Affects up to 5.6.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.CVE-2026-54805 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.CVE-2026-54804 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.
- Affected
- up to 2.16.3
- What to do
- Affects up to 2.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.CVE-2026-54803 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.CVE-2026-54802 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.
- Affected
- up to 3.9.3
- What to do
- Affects up to 3.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026JetFormBuilder: Incorrect Privilege AssignmentCVE-2026-54196 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.
- Product
- JetFormBuilder
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.CVE-2026-54195 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.
- Affected
- up to 3.6.0.1
- What to do
- Affects up to 3.6.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.CVE-2026-54194 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.
- Affected
- up to 3.15.4
- What to do
- Affects up to 3.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.