Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,041 results · page 15 of 21
Jun 15, 2026Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.CVE-2026-39492 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.CVE-2026-39465 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.CVE-2026-39441 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.CVE-2026-34901 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.CVE-2026-27053 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Edgar Rojas WooCommerce PDF Invoice Builder: Improper Control of Generation of Code ('Code Injection')CVE-2026-52704 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
- Product
- Edgar Rojas WooCommerce PDF Invoice Builder
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update Edgar Rojas WooCommerce PDF Invoice Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbCVE-2018-25436 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code execution.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026WP MAPS PRO: Registers an unauthenticated AJAX action whichCVE-2026-8935 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
- Product
- WP MAPS PRO
- Fixed in
- 6.1.1
- What to do
- Update WP MAPS PRO to 6.1.1 or newer.
Jun 12, 2026WordPress Toolkit before 6: Argument injectionCVE-2026-47365 · WordPress plugins & themes · reported by support@hackerone.comCritical 9.9
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.
- Product
- WordPress Toolkit before 6
- Fixed in
- 6.11.0
- What to do
- Update WordPress Toolkit before 6 to 6.11.0 or newer.
Jun 11, 2026Hippoo Mobile App for WooCommerce: Incorrect Privilege AssignmentCVE-2026-49060 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.
- Product
- Hippoo Mobile App for WooCommerce
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026Beardev JoomSport: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42647 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport: from n/a through 5.7.7.
- Product
- Beardev JoomSport
- Affected
- up to 5.7.7
- What to do
- Affects up to 5.7.7. Update Beardev JoomSport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026WBW Plugins Product Filter by WBW: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39494 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.
- Product
- WBW Plugins Product Filter by WBW
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update WBW Plugins Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2026Doctreat Core: Privilege EscalationCVE-2025-6254 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.
- Product
- Doctreat Core
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update Doctreat Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 10, 2026Schema & Structured Data for WP & AMP: Does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media typeCVE-2026-9067 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.60
- What to do
- Update Schema & Structured Data for WP & AMP to 1.60 or newer.
Jun 9, 2026WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP codeCVE-2017-20251 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server.
- Fixed in
- 3.3.1
- What to do
- Update the plugin to 3.3.1 or newer.
Jun 7, 2026WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting CVE-2024-58349 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.
- What to do
- Update the plugin to the newest version.
Jun 7, 2026WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files byCVE-2024-58348 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.
- What to do
- Update the plugin to the newest version.
Jun 7, 2026WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious filCVE-2023-54352 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access.
- What to do
- Update the plugin to the newest version.
Jun 5, 2026Hippoo Mobile App for WooCommerce: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-10580 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a {"password":"<new_password>"} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.
- Product
- Hippoo Mobile App for WooCommerce
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2026ShapedPlugin, LLC Product Slider Pro for WooCommerce: Improper Validation of Specified Quantity in InputCVE-2026-49777 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.
- Product
- ShapedPlugin, LLC Product Slider Pro for WooCommerce
- Fixed in
- 3.5.4
- What to do
- Update ShapedPlugin, LLC Product Slider Pro for WooCommerce to 3.5.4 or newer.
Jun 4, 2026WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by eCVE-2019-25738 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthenticated attackers to modify WordPress options by exploiting the hc_ajax_save_option action. Attackers can send POST requests to the admin-ajax.php endpoint with the action parameter set to hc_ajax_save_option to enable user registration and set the default role to administrator, enabling account takeover.
- What to do
- Update the plugin to the newest version.
NVD recordwordpress.framework-y.comwordpress.framework-y.com
Jun 4, 2026WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manCVE-2019-25727 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.
- What to do
- Update the plugin to the newest version.
Jun 2, 2026ARMember Premium: An insecure password reset mechanismCVE-2026-5076 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the `arm_reset_password_key` user meta field when a user requests a password reset. This is in addition to the hashed key that WordPress core stores securely in `wp_users.user_activation_key`. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom `armrp` reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-5073, CVE-2026-5074), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators.
- Product
- ARMember Premium
- Affected
- up to 7.3.1
- What to do
- Affects up to 7.3.1. Update ARMember Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Ahmad WP Job Portal: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42684 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.
- Product
- Ahmad WP Job Portal
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Ahmad WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Themeisle Masteriyo LMS PRO: Incorrect Privilege AssignmentCVE-2025-53209 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a through 2.20.0.
- Product
- Themeisle Masteriyo LMS PRO
- Affected
- up to 2.20.0
- What to do
- Affects up to 2.20.0. Update Themeisle Masteriyo LMS PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 2, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Privilege escalationCVE-2026-8206 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
- Product
- Kirki – Freeform Page Builder, Website Builder & Customizer
- What to do
- Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 1, 2026Wp Directory Kit WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42672 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.
- Product
- Wp Directory Kit WP Directory Kit
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Wp Directory Kit WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026Sergey AIWU: Incorrect Privilege AssignmentCVE-2026-48879 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation. This issue affects AIWU: from n/a through 1.4.17.
- Product
- Sergey AIWU
- Affected
- up to 1.4.17
- What to do
- Affects up to 1.4.17. Update Sergey AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026Rocketgenius Inc: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-48866 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1.
- Product
- Rocketgenius Inc
- Affected
- up to 2.10.0.1
- What to do
- Affects up to 2.10.0.1. Update Rocketgenius Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026Tomdever wpForo Forum: Missing AuthorizationCVE-2026-42682 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 3.0.6.
- Product
- Tomdever wpForo Forum
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update Tomdever wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2026Wasiliy Strecker / ContestGallery developer Contest Gallery Pro: Incorrect Privilege AssignmentCVE-2026-42680 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro allows Privilege Escalation. This issue affects Contest Gallery Pro: from n/a through 29.0.1.
- Product
- Wasiliy Strecker / ContestGallery developer Contest Gallery Pro
- Affected
- up to 29.0.1
- What to do
- Affects up to 29.0.1. Update Wasiliy Strecker / ContestGallery developer Contest Gallery Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2026WP Travel Pro: Arbitrary user deletionCVE-2026-4290 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.
- Product
- WP Travel Pro
- Affected
- up to 10.6.0
- What to do
- Affects up to 10.6.0. Update WP Travel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2026OTP Login With Phone Number, OTP Verification: Authentication bypassCVE-2026-3655 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared against the victim's stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim's phone number in the same request.
- Product
- OTP Login With Phone Number, OTP Verification
- Affected
- up to 1.8.60
- What to do
- Affects up to 1.8.60. Update OTP Login With Phone Number, OTP Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 29, 2026WP Maps Pro: Privilege EscalationCVE-2026-8732 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.
- Product
- WP Maps Pro
- Affected
- up to 6.1.0
- What to do
- Affects up to 6.1.0. Update WP Maps Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 28, 2026Advanced Custom Fields: Extended: Privilege EscalationCVE-2026-8809 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting the attacker-controlled _acf_post_id POST parameter — with no authentication or integrity verification — to select a cleanup branch that silently discards all validation errors not prefixed with acfe:. This makes it possible for unauthenticated attackers to suppress both the role allow-list validation error added by acfe_field_user_roles::validate_front_value() and the administrator-role capability guard error added by acfe_module_form_action_user::validate_action(), causing wp_insert_user() to execute with an attacker-supplied administrator role argument and resulting in the creation of a new administrator-level user account. Exploitation requires the target site to expose a public ACFE frontend form configured with a Create User action that maps a role field.
- Product
- Advanced Custom Fields: Extended
- Affected
- up to 0.9.2.5
- What to do
- Affects up to 0.9.2.5. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 27, 2026RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42761 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.9.
- Product
- RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce
- What to do
- Update RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce to the newest version.
May 27, 2026Saleswonder Team: Tobias WebinarIgnition webinar-ignition: Incorrect Privilege AssignmentCVE-2026-42758 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privilege Escalation.This issue affects WebinarIgnition: from n/a through < 4.08.253.
- Product
- Saleswonder Team: Tobias WebinarIgnition webinar-ignition
- What to do
- Update Saleswonder Team: Tobias WebinarIgnition webinar-ignition to the newest version.
May 27, 2026Saleswonder Team: Tobias WebinarIgnition webinar-ignition: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42757 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Path Traversal.This issue affects WebinarIgnition: from n/a through < 4.08.253.
- Product
- Saleswonder Team: Tobias WebinarIgnition webinar-ignition
- What to do
- Update Saleswonder Team: Tobias WebinarIgnition webinar-ignition to the newest version.
May 27, 2026Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly quickwebp: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-42756 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly quickwebp allows Path Traversal.This issue affects QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly: from n/a through <= 3.2.7.
- Product
- Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly quickwebp
- What to do
- Update Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly quickwebp to the newest version.
May 27, 2026RealMag777 TableOn posts-table-filterable: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42755 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn posts-table-filterable allows Blind SQL Injection.This issue affects TableOn: from n/a through <= 1.0.5.1.
- Product
- RealMag777 TableOn posts-table-filterable
- What to do
- Update RealMag777 TableOn posts-table-filterable to the newest version.
May 27, 2026WPify WPify Woo Czech wpify-woo: Unrestricted Upload of File with Dangerous TypeCVE-2026-42748 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in WPify WPify Woo Czech wpify-woo allows Upload a Web Shell to a Web Server.This issue affects WPify Woo Czech: from n/a through <= 5.4.1.
- Product
- WPify WPify Woo Czech wpify-woo
- What to do
- Update WPify WPify Woo Czech wpify-woo to the newest version.
May 27, 2026hassantafreshi Easy Form Builder easy-form-builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42747 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through <= 4.0.6.
- Product
- hassantafreshi Easy Form Builder easy-form-builder
- What to do
- Update hassantafreshi Easy Form Builder easy-form-builder to the newest version.
May 27, 2026tainacan Tainacan tainacan: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42740 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.
- Product
- tainacan Tainacan tainacan
- What to do
- Update tainacan Tainacan tainacan to the newest version.
May 27, 2026miniOrange miniorange otp verification miniorange-otp-verification: Incorrect Privilege AssignmentCVE-2026-42731 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.
- Product
- miniOrange miniorange otp verification miniorange-otp-verification
- What to do
- Update miniOrange miniorange otp verification miniorange-otp-verification to the newest version.
May 27, 2026RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42727 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.8.
- Product
- RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce
- What to do
- Update RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce to the newest version.
May 27, 2026Login with OTP: Authentication bypassCVE-2026-8760 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6. This is due to an incomplete fix for CVE-2024-11178: the rate-limit/lockout check added to `otpl_login_action()` was placed only inside the OTP-generation branch and is never evaluated on the OTP-validation branch, and the generated 6-digit OTP additionally has no expiration. This makes it possible for unauthenticated attackers to brute-force the 900,000-value OTP space for any user account (including administrators) and obtain a valid `wp_set_auth_cookie()` session, leading to full site compromise.
- Product
- Login with OTP
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Login with OTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026Crocoblock JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42774 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue affects JetEngine: from n/a through 3.8.8.1.
- Product
- Crocoblock JetEngine
- Affected
- up to 3.8.8.1
- What to do
- Affects up to 3.8.8.1. Update Crocoblock JetEngine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026eMagicOne eMagicOne Store Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42773 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2.
- Product
- eMagicOne eMagicOne Store Manager
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update eMagicOne eMagicOne Store Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2026BookingPress Pro: Arbitrary file uploadsCVE-2026-6960 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.
- Product
- BookingPress Pro
- Affected
- up to 5.6
- What to do
- Affects up to 5.6. Update BookingPress Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2026Wp Directory Kit WP Directory Kit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39531 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.
- Product
- Wp Directory Kit WP Directory Kit
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Wp Directory Kit WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.