Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
42,654 results · page 145 of 854
Jun 15, 2026Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.CVE-2026-39441 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
- Affected
- up to 5.3
- What to do
- Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.CVE-2026-39435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.
- Affected
- up to 15.1.3
- What to do
- Affects up to 15.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.CVE-2026-39434 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.
- Affected
- up to 6.6.26
- What to do
- Affects up to 6.6.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.CVE-2026-34902 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.CVE-2026-34901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.CVE-2026-34900 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.
- Affected
- up to 4.14.2
- What to do
- Affects up to 4.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.CVE-2026-34898 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.CVE-2026-34892 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.
- Affected
- up to 1.0.271
- What to do
- Affects up to 1.0.271. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.CVE-2026-34891 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.CVE-2026-34886 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Editor Privilege Escalation in AI Engine <= 3.4.9 versions.CVE-2026-27407 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Editor Privilege Escalation in AI Engine <= 3.4.9 versions.
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.CVE-2026-27333 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.
- Affected
- up to 7.3.23
- What to do
- Affects up to 7.3.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.CVE-2026-27089 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.CVE-2026-27053 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.CVE-2026-25440 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.CVE-2026-25425 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.CVE-2026-24637 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.
- Affected
- up to 11.15.10
- What to do
- Affects up to 11.15.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.CVE-2026-23970 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Bookify <= 1.1.1 versions.CVE-2025-69332 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Bookify <= 1.1.1 versions.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions.CVE-2025-68872 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions.
- Affected
- up to 1.3.03.27
- What to do
- Affects up to 1.3.03.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.CVE-2025-68851 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.CVE-2025-68840 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.CVE-2025-68049 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.CVE-2025-60175 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.CVE-2025-59133 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.
- Affected
- up to 5.1.25.2
- What to do
- Affects up to 5.1.25.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.CVE-2025-15659 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.CVE-2025-15658 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.
- Affected
- up to 0.3.4
- What to do
- Affects up to 0.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WooCommerce PDF Invoice Builder: Improper Control of Generation of Code ('Code Injection')CVE-2026-52704 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
- Product
- WooCommerce PDF Invoice Builder
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Masteriyo - LMS: Incorrect Privilege AssignmentCVE-2026-49111 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0.
- Product
- Masteriyo - LMS
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026GetPaid: Insertion of Sensitive Information Into Sent DataCVE-2026-49064 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.
- Product
- GetPaid
- Affected
- up to 2.8.49
- What to do
- Affects up to 2.8.49. Update GetPaid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Faust.Js: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-49062 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7.
- Product
- Faust.Js
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update Faust.Js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions.CVE-2026-48969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions.
- Affected
- up to 9.5.9
- What to do
- Affects up to 9.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026MasterStudy LMS Pro: Missing AuthorizationCVE-2025-64215 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects MasterStudy LMS Pro: from n/a before 4.7.16.
- Product
- MasterStudy LMS Pro
- Fixed in
- 4.7.16
- What to do
- Update MasterStudy LMS Pro to 4.7.16 or newer.
Jun 15, 2026WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injeCVE-2019-25746 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup filesCVE-2018-25437 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbCVE-2018-25436 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar setCVE-2016-20084 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitrary scripts when the calendar is displayed or accessed in the administration interface.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF tokCVE-2016-20083 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests to the options-general.php endpoint.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the actioCVE-2016-20082 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipuCVE-2016-20081 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026callback.php that: WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusionCVE-2016-20080 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_abspath parameter to read sensitive files like wp-config.php or execute remote code.
- Product
- callback.php that
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update callback.php that to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by maCVE-2016-20079 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.
- Affected
- up to 2.28.3
- What to do
- Affects up to 2.28.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating CVE-2016-20078 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress IMDb Profile Widget 1.0.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the url parameter. Attackers can supply directory traversal sequences in GET requests to pic.php to access sensitive files like wp-config.php containing database credentials and configuration data.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting inCVE-2016-20077 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by CVE-2016-20076 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive files, or delete critical files .htaccess to expose backup directories.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or adCVE-2016-20075 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
WordPress Ultimate Product Catalog 3.8.6 contains an arbitrary file upload vulnerability that allows authenticated users with contributor, editor, author, or administrator roles to upload malicious files by exploiting the custom fields functionality. Attackers can upload PHP shells through the Products tab custom file field and access them via the upcp-product-file-uploads directory to execute arbitrary code on the server.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting mCVE-2016-20074 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs_admin.php to modify plugin configuration parameters like lzcs_color and lzcs_count.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Answer My Question 1.3: SQL injectionCVE-2016-20073 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.
- Product
- Answer My Question 1.3
- What to do
- Update Answer My Question 1.3 to the newest version.
Jun 15, 2026BBS e-Franchise 1.1.1: SQL injectionCVE-2016-20072 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.
- Product
- BBS e-Franchise 1.1.1
- What to do
- Update BBS e-Franchise 1.1.1 to the newest version.
Jun 15, 2026The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbCVE-2016-20071 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. Attackers can craft GET requests with SQL injection payloads to manipulate database queries and extract sensitive information from the WordPress database.
- Product
- 404 Redirection Manager
- What to do
- Update 404 Redirection Manager to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.