Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

40,553 results · page 147 of 812

May 27, 2026Dideo: Stored Cross-Site ScriptingCVE-2026-8847 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute, which is interpolated directly into an HTML iframe 'src' attribute without escaping in the dideo() shortcode handler. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Dideo
What to do
Update Dideo to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Tuxquote: Stored Cross-Site ScriptingCVE-2026-8846 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tuxquote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'TUXQUOTE' shortcode in versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes ('title', 'align', and 'width') in the tuxquote_build_format() function, which are concatenated into the rendered HTML without being passed through esc_attr() or esc_html(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tuxquote
Affected
up to 1.3
What to do
Affects up to 1.3. Update Tuxquote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Islamic Database: Stored Cross-Site ScriptingCVE-2026-8845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within the islamicDB_sc_quran_qari_roqya() function, which are concatenated directly into HTML iframe attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Islamic Database
Affected
up to 1.0
What to do
Affects up to 1.0. Update Islamic Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Responsive Check: Stored Cross-Site ScriptingCVE-2026-8844 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping on the 'url' (and 'button') shortcode attributes in the rspc_check_shortcode() function, which are echoed directly into iframe src attributes without esc_attr() or esc_url(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Responsive Check
Affected
up to 0.0.3
What to do
Affects up to 0.0.3. Update Responsive Check to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Google+ Link Name: Stored Cross-Site ScriptingCVE-2026-8842 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Google+ Link Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gplusnamelink' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes ('id' and 'name') in the gplusnamelink_generate() function, which are concatenated directly into the rendered HTML without calling esc_attr() or esc_html(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Google+ Link Name
Affected
up to 1.0
What to do
Affects up to 1.0. Update Google+ Link Name to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026WP Iframe Geo Style for Amazon affiliates: Stored Cross-Site ScriptingCVE-2026-8837 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Iframe Geo Style for Amazon affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'adid' Shortcode Attribute in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Iframe Geo Style for Amazon affiliates
Affected
up to 1.1
What to do
Affects up to 1.1. Update WP Iframe Geo Style for Amazon affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Firebase Support & Chat Management: Privilege escalationCVE-2026-8787 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.
Product
Firebase Support & Chat Management
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Firebase Support & Chat Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Login with OTP: Authentication bypassCVE-2026-8760 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to `otpl_login_action()` was placed only inside the OTP-generation branch and is never evaluated on the OTP-validation branch, and the generated 6-digit OTP additionally has no expiration. This makes it possible for unauthenticated attackers to brute-force the 900,000-value OTP space for any user account (including administrators) and obtain a valid `wp_set_auth_cookie()` session, leading to full site compromise.
Product
Login with OTP
Affected
up to 1.6
What to do
Affects up to 1.6. Update Login with OTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record nvd.nist.gov plugins.trac.wordpress.org
May 27, 2026Genzel breadcrumbs: Cross-Site Request ForgeryCVE-2026-8708 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Genzel breadcrumbs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the _options_page function. This makes it possible for unauthenticated attackers to update the plugin's breadcrumb configuration, including templates, delimiter, home label, home URI, and breadcrumb rules via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Genzel breadcrumbs
Affected
up to 1.2
What to do
Affects up to 1.2. Update Genzel breadcrumbs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026NS Product icon badge: Reflected Cross-Site ScriptingCVE-2026-8707 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
NS Product icon badge
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update NS Product icon badge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Endless Scroll: Stored Cross-Site ScriptingCVE-2026-8703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Endless Scroll
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Endless Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026GBI To Print: Stored Cross-Site Scripting in version 1CVE-2026-8702 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GBI To Print plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the 'div' attribute of the 'gbitoprint' shortcode. This is due to insufficient output escaping in the gbi_toprint_shortcode() function, which concatenates the raw shortcode attribute value directly into an HTML attribute without applying esc_attr() or any other sanitization. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GBI To Print
What to do
Update GBI To Print to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 27, 2026GNTT Post Title Ticker: Stored Cross-Site Scripting in version 1CVE-2026-8701 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GNTT Post Title Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the `title-ticker-slide`, `title-ticker-fade`, and `title-ticker-typing` shortcodes. This is due to insufficient input sanitization and output escaping on shortcode attributes (notably `border`, `width`, `height`, `header_background`, `header_text_color`, and `id`) within the `gntt_title_ticker_slide()`, `gntt_title_ticker_fade()`, and `gntt_title_ticker_typing()` functions. None of these attribute values are passed through `esc_attr()` or any other escaping function before being concatenated into HTML output. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GNTT Post Title Ticker
What to do
Update GNTT Post Title Ticker to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Cryptocurrency Prijsvergelijking Widget: Stored Cross-Site Scripting in version 1CVE-2026-8698 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cryptocurrency Prijsvergelijking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0. This is due to insufficient output escaping in the as_get_coin_shortcode() function, which renders the 'width' (and 'height') shortcode attribute directly into the style attribute of an <iframe> element without applying any escaping function such as esc_attr(). An attacker-controlled value like '100px;"onload="alert(1)" x="' terminates the style attribute prematurely and injects an arbitrary HTML attribute into the iframe tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cryptocurrency Prijsvergelijking Widget
What to do
Update Cryptocurrency Prijsvergelijking Widget to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026My Email Shortcode: Stored Cross-Site ScriptingCVE-2026-8048 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-email' shortcode in all versions up to, and including, 0.91 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My Email Shortcode
Affected
up to 0.91
What to do
Affects up to 0.91. Update My Email Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026faq shortocde: Stored Cross-Site ScriptingCVE-2026-8040 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
faq shortocde
Affected
up to 1.0
What to do
Affects up to 1.0. Update faq shortocde to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Old Posts Highlighter: Cross-Site Request ForgeryCVE-2026-7614 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the OPH_options function. This makes it possible for unauthenticated attackers to update the plugin's configuration settings without authorization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Old Posts Highlighter
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Old Posts Highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026EventPress: Does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the responseCVE-2026-6268 · WordPress plugins & themes · reported by WPScanHigh 7.1
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
Product
EventPress
Fixed in
22.2
What to do
Update EventPress to 22.2 or newer.
Full record and what to do →NVD record wpscan.com
May 27, 2026CM Ad Changer – A simple tool to control and optimize your site's banners: Cross-Site Request ForgeryCVE-2026-9236 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CM Ad Changer – A simple tool to control and optimize your site's banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the cmac_campaigns_action function. This makes it possible for unauthenticated attackers to permanently delete arbitrary advertising campaigns, including their associated banner records and uploaded files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CM Ad Changer – A simple tool to control and optimize your site's banners
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update CM Ad Changer – A simple tool to control and optimize your site's banners to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026ShopLentor - WooCommerce Builder for Elementor & Gutenberg: Stored Cross-Site ScriptingCVE-2026-6287 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ShopLentor - WooCommerce Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blockUniqId' block attribute in multiple Product Gride blocks in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ShopLentor - WooCommerce Builder for Elementor & Gutenberg
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update ShopLentor - WooCommerce Builder for Elementor & Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 27, 2026Yoast SEO: Insecure Direct Object ReferencesCVE-2025-14481 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient authorization checks in the Meta Search REST API endpoint that fail to verify post ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to read sensitive SEO metadata from any post on the site via the 'post_id' parameter, including posts owned by other users, private posts, and draft posts.
Product
Yoast SEO
Affected
up to 26.5
What to do
Affects up to 26.5. Update Yoast SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 27, 2026Splide Carousel Block: Stored Cross-Site ScriptingCVE-2026-9022 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload must be published before it executes for site visitors, which requires an editor or administrator to approve and publish the contributor's post.
Product
Splide Carousel Block
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Splide Carousel Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 26, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Denial of serviceCVE-2026-7493 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to denial of service in all versions up to, and including, 1.6.11.5. This is due to a publicly accessible REST API endpoint (/wp-json/ssa/v1/async) that calls PHP's sleep() function on a user-supplied delay parameter without any rate limiting. This makes it possible for unauthenticated attackers to exhaust PHP worker processes, denying access to the site to legitimate users.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.11.5
What to do
Affects up to 1.6.11.5. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 26, 2026Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns: Stored Cross-Site ScriptingCVE-2026-6565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '/wp-json/agwp/v1/tokens/save' endpoint kit title parameter in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping in an admin attribute context. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 26, 2026Woocommerce Envato Affiliates: Missing AuthorizationCVE-2025-14361 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1.
Product
Woocommerce Envato Affiliates
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Woocommerce Envato Affiliates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026WpTravelly: Missing AuthorizationCVE-2026-27331 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpTravelly: from n/a through 2.1.5.
Product
WpTravelly
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026WpBookingly: Missing AuthorizationCVE-2026-25444 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.
Product
WpBookingly
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update WpBookingly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026Taxi Booking Manager for WooCommerce: Missing AuthorizationCVE-2026-25426 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.0.1.
Product
Taxi Booking Manager for WooCommerce
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026Tiktok Feed: Missing AuthorizationCVE-2026-24520 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24.
Product
Tiktok Feed
Affected
up to 1.0.24
What to do
Affects up to 1.0.24. Update Tiktok Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).CVE-2026-8174 · WordPress plugins & themes · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.7
Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2.
Fixed in
1.6.2
What to do
Update the plugin to 1.6.2 or newer.
Full record and what to do →NVD record wordpress.org
May 26, 2026SW Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39661 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magentech SW Core allows PHP Local File Inclusion. This issue affects SW Core: from n/a through 1.7.18.
Product
SW Core
Affected
up to 1.7.18
What to do
Affects up to 1.7.18. Update SW Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026Nyla: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-39642 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code Injection. This issue affects Nyla: from n/a through 1.7.
Product
Nyla
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nyla to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27427 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup allows Stored XSS. This issue affects Geo Mashup: from n/a through 1.13.18.
Product
Geo Mashup
Affected
up to 1.13.18
What to do
Affects up to 1.13.18. Update Geo Mashup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026RepairBuddy: Missing AuthorizationCVE-2026-24638 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RepairBuddy: from n/a through 4.1121.
Product
RepairBuddy
Affected
up to 4.1121
What to do
Affects up to 4.1121. Update RepairBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026Paid Videochat Turnkey Site: Missing AuthorizationCVE-2026-24590 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.
Product
Paid Videochat Turnkey Site
Affected
up to 7.3.23
What to do
Affects up to 7.3.23. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 26, 2026Mayosis Core: Missing AuthorizationCVE-2026-39655 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mayosis Core: from n/a through 5.4.7.
Product
Mayosis Core
Affected
up to 5.4.7
What to do
Affects up to 5.4.7. Update Mayosis Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Unlimited Elements For Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-48837 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection. This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.
Product
Unlimited Elements For Elementor
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Unlimited Elements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Smart Coupons for WooCommerce: Missing AuthorizationCVE-2026-45438 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0.
Product
Smart Coupons for WooCommerce
Fixed in
2.3.0
What to do
Update Smart Coupons for WooCommerce to 2.3.0 or newer.
Full record and what to do →NVD record patchstack.com
May 25, 2026WP Activity Log: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-45435 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3.
Product
WP Activity Log
Affected
up to 5.6.3
What to do
Affects up to 5.6.3. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Stripe Payment Gateway for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-45217 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery Exploitation. This issue affects Stripe Payment Gateway for WooCommerce: from n/a through 5.0.7.
Product
Stripe Payment Gateway for WooCommerce
Affected
up to 5.0.7
What to do
Affects up to 5.0.7. Update Stripe Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Smart Manager: Incorrect Privilege AssignmentCVE-2026-45216 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0.
Product
Smart Manager
Affected
up to 8.85.0
What to do
Affects up to 8.85.0. Update Smart Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026MyCryptoCheckout: Missing AuthorizationCVE-2026-45209 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in edward_plainview MyCryptoCheckout allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MyCryptoCheckout: from n/a through 2.161.
Product
MyCryptoCheckout
Affected
up to 2.161
What to do
Affects up to 2.161. Update MyCryptoCheckout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026Sunshine Photo Cart: Missing AuthorizationCVE-2026-42776 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sunshine Photo Cart: from n/a through 3.6.7.
Product
Sunshine Photo Cart
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update Sunshine Photo Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42774 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.
Product
JetEngine
Affected
up to 3.8.8.1
What to do
Affects up to 3.8.8.1. Update JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026eMagicOne Store Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2.
Product
eMagicOne Store Manager
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update eMagicOne Store Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026SePay Gateway: Missing AuthorizationCVE-2026-42763 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SePay team SePay Gateway allows Retrieve Embedded Sensitive Data. This issue affects SePay Gateway: from n/a through 1.1.20.
Product
SePay Gateway
Affected
up to 1.1.20
What to do
Affects up to 1.1.20. Update SePay Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026CformsII: Cross-Site Request Forgery (CSRF)CVE-2026-39436 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n/a through 15.1.3.
Product
CformsII
Affected
up to 15.1.3
What to do
Affects up to 15.1.3. Update CformsII to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 25, 2026NanoCare: Missing AuthorizationCVE-2026-32389 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Linethemes NanoCare allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects NanoCare: from n/a before 1.2.2.
Product
NanoCare
Fixed in
1.2.2
What to do
Update NanoCare to 1.2.2 or newer.
Full record and what to do →NVD record patchstack.com
May 25, 2026Broadcast Live Video: Improper Control of Generation of Code ('Code Injection')CVE-2026-24937 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. This issue affects Broadcast Live Video: from n/a before 7.1.3.
Product
Broadcast Live Video
Fixed in
7.1.3
What to do
Update Broadcast Live Video to 7.1.3 or newer.
Full record and what to do →NVD record patchstack.com
May 25, 2026RSVP and Event Management: Missing AuthorizationCVE-2026-27398 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RSVP and Event Management: from n/a through 2.7.16.
Product
RSVP and Event Management
Affected
up to 2.7.16
What to do
Affects up to 2.7.16. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.