Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

4,273 results · page 15 of 86

Apr 22, 2026TP Restore Categories And Taxonomies: Missing AuthorizationCVE-2026-4128 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_term() function, which handles the 'tpmcattt_delete_term' AJAX action, does not perform any capability check (e.g., current_user_can()) to verify the user has sufficient permissions. While it does verify a nonce via check_ajax_referer(), this nonce is generated for all authenticated users via the admin_enqueue_scripts hook and exposed on any wp-admin page (including profile.php, which subscribers can access). This makes it possible for authenticated attackers, with Subscriber-level access and above, to permanently delete taxonomy term records from the plugin's trash/backup tables by sending a crafted AJAX request with a valid nonce and an arbitrary term_id.
Product
TP Restore Categories And Taxonomies
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update TP Restore Categories And Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 22, 2026CalJ: Missing AuthorizationCVE-2026-4117 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CalJ plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5. This is due to a missing capability check in the CalJSettingsPage class constructor, which processes the 'save-obtained-key' operation directly from POST data without verifying that the requesting user has the 'manage_options' capability, and without any nonce verification. The plugin bootstrap file (calj.php) instantiates CalJSettingsPage whenever is_admin() returns true, which is the case for any authenticated user making requests to wp-admin URLs (including admin-ajax.php). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API key setting and clear the Shabbat cache, effectively taking control of the plugin's API integration.
Product
CalJ
Affected
up to 1.5
What to do
Affects up to 1.5. Update CalJ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2026Canto: Missing AuthorizationCVE-2026-6441 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check or nonce verification in the updateOptions() function, which is exposed via two AJAX hooks: wp_ajax_updateOptions (class-canto.php line 231) and wp_ajax_fbc_updateOptions (class-canto-settings.php line 76). Both hooks are registered exclusively under the wp_ajax_ prefix (requiring only a logged-in user), with no call to current_user_can() or check_ajax_referer(). This makes it possible for authenticated attackers with subscriber-level access and above to arbitrarily modify or delete plugin options controlling cron scheduling behavior (fbc_duplicates, fbc_cron, fbc_schedule, fbc_cron_time_day, fbc_cron_time_hour, fbc_cron_start) and to manipulate or clear the plugin's scheduled WordPress cron event (fbc_scheduled_update).
Product
Canto
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Canto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2026WP Statistics: Missing AuthorizationCVE-2026-3488 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4. This is due to missing capability checks on multiple AJAX handlers including `wp_statistics_get_filters`, `wp_statistics_getPrivacyStatus`, `wp_statistics_updatePrivacyStatus`, and `wp_statistics_dismiss_notices`. These endpoints only verify a `wp_rest` nonce via `check_ajax_referer()` but do not enforce any capability checks such as `current_user_can()` or the plugin's own `User::Access()` method. Since the `wp_rest` nonce is available to all authenticated WordPress users, this makes it possible for authenticated attackers, with Subscriber-level access and above, to access sensitive analytics data (user IDs, usernames, emails, visitor tracking data), retrieve and modify privacy audit compliance status, and dismiss administrative notices.
Product
WP Statistics
Affected
up to 14.16.4
What to do
Affects up to 14.16.4. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2026Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: Missing AuthorizationCVE-2026-4949 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.16.12. This is due to the 'process_checkout' function not properly enforcing the plan active status check when a 'change_plan_sub_id' parameter is provided. This makes it possible for authenticated attackers, with Subscriber-level access and above, to subscribe to inactive membership plans by supplying an arbitrary 'change_plan_sub_id' value in the checkout request.
Product
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Affected
up to 4.16.12
What to do
Affects up to 4.16.12. Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2026Accept Cryptocurrencies with Plisio: Missing AuthorizationCVE-2026-6372 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept Cryptocurrencies with Plisio: from n/a through 2.0.5.
Product
Accept Cryptocurrencies with Plisio
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update Accept Cryptocurrencies with Plisio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026MyRewards: Missing AuthorizationCVE-2026-40786 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through <= 5.7.3.
Product
MyRewards
Affected
up to 5.7.3
What to do
Affects up to 5.7.3. Update MyRewards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026Majestic Support: Missing AuthorizationCVE-2026-40778 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.2.
Product
Majestic Support
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Majestic Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026Royal Elementor Addons: Missing AuthorizationCVE-2026-40763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1056.
Product
Royal Elementor Addons
Affected
up to 1.7.1056
What to do
Affects up to 1.7.1056. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026Nelio AB Testing: Missing AuthorizationCVE-2026-40742 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio AB Testing: from n/a through <= 8.2.8.
Product
Nelio AB Testing
Affected
up to 8.2.8
What to do
Affects up to 8.2.8. Update Nelio AB Testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026Tutor LMS: Missing AuthorizationCVE-2026-40740 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.7.
Product
Tutor LMS
Affected
up to 3.9.7
What to do
Affects up to 3.9.7. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026ThemeGrill Demo Importer: Missing AuthorizationCVE-2026-40730 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.
Product
ThemeGrill Demo Importer
Affected
up to 2.0.0.6
What to do
Affects up to 2.0.0.6. Update ThemeGrill Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 20263D viewer – Embed 3D Models: Missing AuthorizationCVE-2026-40729 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.
Product
3D viewer – Embed 3D Models
Affected
up to 1.8.5
What to do
Affects up to 1.8.5. Update 3D viewer – Embed 3D Models to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026Magazine Blocks: Missing AuthorizationCVE-2026-40728 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Blocks: from n/a through <= 1.8.3.
Product
Magazine Blocks
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Magazine Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026Katalogportal PDF Sync: Missing AuthorizationCVE-2026-3649 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal_popup_shortcode() function is registered as an AJAX handler via wp_ajax_katalogportal_shortcodePrinter but lacks any capability check (current_user_can()) or nonce verification. This allows any authenticated user, including Subscribers, to call the endpoint and retrieve a list of all synchronized PDF attachments (including those attached to private or draft posts) along with their titles, actual filenames, and the katalogportal_userid configuration value. The WP_Query uses post_status => 'any' which returns attachments regardless of the parent post's visibility status.
Product
Katalogportal PDF Sync
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Katalogportal PDF Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2026e-shot™ form builder: Missing AuthorizationCVE-2026-3642 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.2. The eshot_form_builder_update_field_data() AJAX handler lacks any capability checks (current_user_can()) or nonce verification (check_ajax_referer()/wp_verify_nonce()). The function is registered via the wp_ajax_ hook, making it accessible to any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify form field configurations including mandatory status, field visibility, and form display preferences via the eshot_form_builder_update_field_data AJAX action.
Product
e-shot™ form builder
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update e-shot™ form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2026Advanced Custom Fields (ACF): Missing Authorization to Arbitrary Post/Page DisclosureCVE-2026-4812 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration.
Product
Advanced Custom Fields (ACF)
Affected
up to 6.7.0
What to do
Affects up to 6.7.0. Update Advanced Custom Fields (ACF) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 13, 2026Product Filter for WooCommerce by WBW: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-3830 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
Product Filter for WooCommerce by WBW
Fixed in
3.1.3
What to do
Update Product Filter for WooCommerce by WBW to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Apr 10, 2026Gravity SMTP: Missing AuthorizationCVE-2026-4162 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to uninstall and deactivate the plugin and delete plugin options. NOTE: This vulnerability is also exploitable via a Cross-Site Request Forgery vector.
Product
Gravity SMTP
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Gravity SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gravityforms.com wordfence.com
Apr 9, 2026Ziggeo: Missing AuthorizationCVE-2026-4124 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wp_ajax_ziggeo_ajax handler only verifies a nonce (check_ajax_referer) but performs no capability checks via current_user_can(). Furthermore, the nonce ('ziggeo_ajax_nonce') is exposed to all logged-in users on every page via the wp_head and admin_head hooks . This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke multiple administrative operations including: saving arbitrary translation strings (translations_panel_save_strings via update_option('ziggeo_translations')), creating/updating/deleting event templates (event_editor_save_template/update_template/remove_template via update_option('ziggeo_events')), modifying SDK application settings (sdk_applications operations), and managing notifications (notification_handler via update_option('ziggeo_notifications')).
Product
Ziggeo
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Ziggeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026Vertex Addons for Elementor: Missing AuthorizationCVE-2026-4326 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate_required_plugins() function. Specifically, the current_user_can('install_plugins') capability check does not terminate execution when it fails — it only sets an error message variable while allowing the plugin installation and activation code to execute. The error response is only sent after the installation and activation have already completed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins from the WordPress.
Product
Vertex Addons for Elementor
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Vertex Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026Flipmart: Missing AuthorizationCVE-2026-39716 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CKThemes Flipmart flipmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flipmart: from n/a through <= 2.8.
Product
Flipmart
Affected
up to 2.8
What to do
Affects up to 2.8. Update Flipmart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026AnyTrack Affiliate Link Manager: Missing AuthorizationCVE-2026-39715 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyTrack Affiliate Link Manager: from n/a through <= 1.5.5.
Product
AnyTrack Affiliate Link Manager
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update AnyTrack Affiliate Link Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026G5Plus April: Missing AuthorizationCVE-2026-39714 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.
Product
G5Plus April
Affected
up to 6.8
What to do
Affects up to 6.8. Update G5Plus April to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Mailercloud – Integrate webforms and synchronize website contacts: Missing AuthorizationCVE-2026-39713 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize-contacts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mailercloud – Integrate webforms and synchronize website contacts: from n/a through <= 1.0.7.
Product
Mailercloud – Integrate webforms and synchronize website contacts
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Mailercloud – Integrate webforms and synchronize website contacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Accept PayPal Payments using Contact Form 7: Missing AuthorizationCVE-2026-39707 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept PayPal Payments using Contact Form 7: from n/a through <= 4.0.4.
Product
Accept PayPal Payments using Contact Form 7
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update Accept PayPal Payments using Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Make My Trivia: Missing AuthorizationCVE-2026-39706 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Netro Systems Make My Trivia trivialy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Make My Trivia: from n/a through <= 1.1.0.
Product
Make My Trivia
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Make My Trivia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026MIPL WC Multisite Sync: Missing AuthorizationCVE-2026-39705 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MIPL WC Multisite Sync: from n/a through <= 1.4.4.
Product
MIPL WC Multisite Sync
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update MIPL WC Multisite Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Precious Metals Automated Product Pricing – Pro: Missing AuthorizationCVE-2026-39704 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.
Product
Precious Metals Automated Product Pricing – Pro
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Precious Metals Automated Product Pricing – Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026ShopWP: Missing AuthorizationCVE-2026-39701 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopWP: from n/a through <= 5.2.4.
Product
ShopWP
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update ShopWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026WowOptin: Missing AuthorizationCVE-2026-39700 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPXPO WowOptin optin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowOptin: from n/a through <= 1.4.32.
Product
WowOptin
Affected
up to 1.4.32
What to do
Affects up to 1.4.32. Update WowOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026AI Workflow Automation: Missing AuthorizationCVE-2026-39699 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in massiveshift AI Workflow Automation ai-workflow-automation-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Workflow Automation: from n/a through <= 1.4.2.
Product
AI Workflow Automation
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update AI Workflow Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026The Publisher Desk ads.txt: Missing AuthorizationCVE-2026-39698 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through <= 1.5.0.
Product
The Publisher Desk ads.txt
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update The Publisher Desk ads.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026MAIO – The new AI GEO / SEO tool: Missing AuthorizationCVE-2026-39697 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in HBSS Technologies MAIO – The new AI GEO / SEO tool maio-the-new-ai-geo-seo-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAIO – The new AI GEO / SEO tool: from n/a through <= 6.2.8.
Product
MAIO – The new AI GEO / SEO tool
Affected
up to 6.2.8
What to do
Affects up to 6.2.8. Update MAIO – The new AI GEO / SEO tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2026-39694 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.
Product
Simply Schedule Appointments
Affected
up to 1.6.10.2
What to do
Affects up to 1.6.10.2. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Cryptocurrency Donation Box – Bitcoin & Crypto Donations: Missing AuthorizationCVE-2026-39691 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.
Product
Cryptocurrency Donation Box – Bitcoin & Crypto Donations
Affected
up to 2.2.13
What to do
Affects up to 2.2.13. Update Cryptocurrency Donation Box – Bitcoin & Crypto Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Author Avatars List/Block: Missing AuthorizationCVE-2026-39690 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.
Product
Author Avatars List/Block
Affected
up to 2.1.25
What to do
Affects up to 2.1.25. Update Author Avatars List/Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026eShipper Commerce: Missing AuthorizationCVE-2026-39689 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eShipper Commerce: from n/a through <= 2.16.12.
Product
eShipper Commerce
Affected
up to 2.16.12
What to do
Affects up to 2.16.12. Update eShipper Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026WP Frontend Profile: Missing AuthorizationCVE-2026-39688 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Frontend Profile: from n/a through <= 1.3.9.
Product
WP Frontend Profile
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update WP Frontend Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Rapid Car Check Vehicle Data: Missing AuthorizationCVE-2026-39687 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.
Product
Rapid Car Check Vehicle Data
Affected
up to 2.0
What to do
Affects up to 2.0. Update Rapid Car Check Vehicle Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026The Moneytizer: Missing AuthorizationCVE-2026-39685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Moneytizer: from n/a through <= 10.0.10.
Product
The Moneytizer
Affected
up to 10.0.10
What to do
Affects up to 10.0.10. Update The Moneytizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026linkPizza-Manager: Missing AuthorizationCVE-2026-39682 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5.
Product
linkPizza-Manager
Affected
up to 5.5.5
What to do
Affects up to 5.5.5. Update linkPizza-Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Diet Calorie Calculator: Missing AuthorizationCVE-2026-39680 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in MWP Development Diet Calorie Calculator diet-calorie-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Diet Calorie Calculator: from n/a through <= 1.1.1.
Product
Diet Calorie Calculator
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Diet Calorie Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Pinpoint Booking System: Missing AuthorizationCVE-2026-39678 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pinpoint Booking System Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through 2.9.9.7.2.
Product
Pinpoint Booking System
Affected
up to 2.9.9.7.2
What to do
Affects up to 2.9.9.7.2. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Download Manager: Missing AuthorizationCVE-2026-39676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.
Product
Download Manager
Affected
up to 3.3.52
What to do
Affects up to 3.3.52. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Court Reservation: Missing AuthorizationCVE-2026-39675 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Court Reservation: from n/a through <= 1.10.11.
Product
Court Reservation
Affected
up to 1.10.11
What to do
Affects up to 1.10.11. Update Court Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026iZooto: Missing AuthorizationCVE-2026-39673 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iZooto: from n/a through <= 3.7.20.
Product
iZooto
Affected
up to 3.7.20
What to do
Affects up to 3.7.20. Update iZooto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026ShipTime: Discounted Shipping Rates: Missing AuthorizationCVE-2026-39672 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipTime: Discounted Shipping Rates: from n/a through <= 1.1.1.
Product
ShipTime: Discounted Shipping Rates
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update ShipTime: Discounted Shipping Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026NitroPack: Missing AuthorizationCVE-2026-39669 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.
Product
NitroPack
Affected
up to 1.19.3
What to do
Affects up to 1.19.3. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 8, 2026Book Previewer for Woocommerce: Missing AuthorizationCVE-2026-39668 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.
Product
Book Previewer for Woocommerce
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Book Previewer for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.