Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42,654 results · page 142 of 854
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.CVE-2026-49106 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.CVE-2026-49105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.CVE-2026-49104 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.CVE-2026-49085 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.CVE-2026-49083 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 versions.CVE-2026-49082 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 versions.
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.CVE-2026-49078 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.
- Affected
- up to 6.7.10
- What to do
- Affects up to 6.7.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.CVE-2026-49070 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.
- Affected
- up to 9.4.0.0
- What to do
- Affects up to 9.4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions.CVE-2026-49068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions.
- Affected
- up to 7.8.1
- What to do
- Affects up to 7.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.CVE-2026-49067 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.CVE-2026-49066 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.
- Affected
- up to 6.0.0
- What to do
- Affects up to 6.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.CVE-2026-49065 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.CVE-2026-49063 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.CVE-2026-49061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.CVE-2026-49056 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.
- Affected
- up to 4.9.4
- What to do
- Affects up to 4.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.CVE-2026-49055 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.
- Affected
- up to 1.3.9.7
- What to do
- Affects up to 1.3.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.CVE-2026-49043 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.CVE-2026-48970 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.
- Affected
- up to 9.5.10
- What to do
- Affects up to 9.5.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.CVE-2026-48966 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.
- Affected
- up to 3.15.0.2
- What to do
- Affects up to 3.15.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.CVE-2026-48965 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.CVE-2026-48964 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Privilege Escalation in Amelia <= 2.3 versions.CVE-2026-48889 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in Amelia <= 2.3 versions.
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.CVE-2026-48887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.CVE-2026-48886 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.CVE-2026-48885 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.
- Affected
- up to 2.3.10.1
- What to do
- Affects up to 2.3.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.CVE-2026-48883 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.
- Affected
- up to 8.5.3
- What to do
- Affects up to 8.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.CVE-2026-48882 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.
- Affected
- up to 1.2.50
- What to do
- Affects up to 1.2.50. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.CVE-2026-48881 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.CVE-2026-48880 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.CVE-2026-48878 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.CVE-2026-48876 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.
- Affected
- up to 2026.3
- What to do
- Affects up to 2026.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber SQL Injection in GamiPress <= 7.8.7 versions.CVE-2026-48874 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in GamiPress <= 7.8.7 versions.
- Affected
- up to 7.8.7
- What to do
- Affects up to 7.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.CVE-2026-48873 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.
- Affected
- up to 10.1.2
- What to do
- Affects up to 10.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.CVE-2026-48872 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.
- Affected
- up to 4.5.2
- What to do
- Affects up to 4.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.CVE-2026-48871 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.
- Affected
- up to 5.1.3
- What to do
- Affects up to 5.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.CVE-2026-48870 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.
- Affected
- up to 51.1.62
- What to do
- Affects up to 51.1.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.CVE-2026-48868 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
- Affected
- up to 5.2.9
- What to do
- Affects up to 5.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.CVE-2026-48867 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.
- Affected
- up to 11.1.2
- What to do
- Affects up to 11.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.CVE-2026-48838 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.
- Affected
- up to 3.6.2
- What to do
- Affects up to 3.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.CVE-2026-48836 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.
- Affected
- up to 2.1.19
- What to do
- Affects up to 2.1.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.CVE-2026-48835 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.
- Affected
- up to 1.10.0.4
- What to do
- Affects up to 1.10.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.CVE-2026-45441 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.
- Affected
- up to 5.3.3
- What to do
- Affects up to 5.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.CVE-2026-45439 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-45437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.CVE-2026-42775 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.
- Affected
- up to 5.7.2
- What to do
- Affects up to 5.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.CVE-2026-42752 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.
- Affected
- up to 2.0.98
- What to do
- Affects up to 2.0.98. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.CVE-2026-42743 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.CVE-2026-42688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.
- Affected
- up to 2.14.23
- What to do
- Affects up to 2.14.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.CVE-2026-42687 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.
- Affected
- up to 4.3.2.1
- What to do
- Affects up to 4.3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.CVE-2026-42686 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.
- Affected
- up to 4.3.2.1
- What to do
- Affects up to 4.3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.