Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,273 results · page 16 of 86
Apr 8, 2026Leadrebel: Missing AuthorizationCVE-2026-39664 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadrebel: from n/a through <= 1.0.2.
- Product
- Leadrebel
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Leadrebel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026TrueBooker: Missing AuthorizationCVE-2026-39663 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.5.
- Product
- TrueBooker
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Product Price by Formula for WooCommerce: Missing AuthorizationCVE-2026-39662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Price by Formula for WooCommerce: from n/a through <= 2.5.6.
- Product
- Product Price by Formula for WooCommerce
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Product Price by Formula for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Panda Pods Repeater Field: Missing AuthorizationCVE-2026-39658 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through <= 1.5.12.
- Product
- Panda Pods Repeater Field
- Affected
- up to 1.5.12
- What to do
- Affects up to 1.5.12. Update Panda Pods Repeater Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026leadlovers forms: Missing AuthorizationCVE-2026-39657 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through <= 1.0.2.
- Product
- leadlovers forms
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update leadlovers forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Razorpay for WooCommerce: Missing AuthorizationCVE-2026-39656 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.
- Product
- Razorpay for WooCommerce
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Razorpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Video Conferencing with Zoom: Missing AuthorizationCVE-2026-39653 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Conferencing with Zoom: from n/a through <= 4.6.6.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.6.6
- What to do
- Affects up to 4.6.6. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026iGMS Direct Booking: Missing AuthorizationCVE-2026-39652 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iGMS Direct Booking: from n/a through <= 1.3.
- Product
- iGMS Direct Booking
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update iGMS Direct Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Total Poll Lite: Missing AuthorizationCVE-2026-39651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through <= 4.12.0.
- Product
- Total Poll Lite
- Affected
- up to 4.12.0
- What to do
- Affects up to 4.12.0. Update Total Poll Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026UnitechPay: Missing AuthorizationCVE-2026-39650 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through <= 1.0.2.
- Product
- UnitechPay
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update UnitechPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Royale News: Missing AuthorizationCVE-2026-39649 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royale News: from n/a through <= 2.2.4.
- Product
- Royale News
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Royale News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Cream Blog: Missing AuthorizationCVE-2026-39648 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.
- Product
- Cream Blog
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Cream Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Wp Ultimate Review: Missing AuthorizationCVE-2026-39644 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.
- Product
- Wp Ultimate Review
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Payment Plugins for PayPal WooCommerce: Missing AuthorizationCVE-2026-39643 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.
- Product
- Payment Plugins for PayPal WooCommerce
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update Payment Plugins for PayPal WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026RPS Include Content: Missing AuthorizationCVE-2026-39639 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RPS Include Content: from n/a through <= 1.2.2.
- Product
- RPS Include Content
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update RPS Include Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Mogi: Missing AuthorizationCVE-2026-39637 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.
- Product
- Mogi
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Mogi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WPSchoolPress: Missing AuthorizationCVE-2026-39631 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through <= 2.2.35.
- Product
- WPSchoolPress
- Affected
- up to 2.2.35
- What to do
- Affects up to 2.2.35. Update WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Ashe: Missing AuthorizationCVE-2026-39627 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wproyal Ashe ashe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe: from n/a through <= 2.266.
- Product
- Ashe
- Affected
- up to 2.266
- What to do
- Affects up to 2.266. Update Ashe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Biolife: Missing AuthorizationCVE-2026-39624 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kutethemes Biolife biolife allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Biolife: from n/a through <= 3.2.3.
- Product
- Biolife
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Biolife to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Education Base: Missing AuthorizationCVE-2026-39622 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in acmethemes Education Base education-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Base: from n/a through <= 3.0.8.
- Product
- Education Base
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Education Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026JW Player for: Missing AuthorizationCVE-2026-39614 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a through <= 2.3.6.
- Product
- JW Player for
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update JW Player for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026KuteShop: Missing AuthorizationCVE-2026-39612 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KuteShop: from n/a through <= 4.2.9.
- Product
- KuteShop
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update KuteShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WpXmas-Snow: Missing AuthorizationCVE-2026-39610 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpXmas-Snow: from n/a through <= 1.1.
- Product
- WpXmas-Snow
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WpXmas-Snow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Wava Payment: Missing AuthorizationCVE-2026-39609 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wava Payment: from n/a through <= 0.3.7.
- Product
- Wava Payment
- Affected
- up to 0.3.7
- What to do
- Affects up to 0.3.7. Update Wava Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026iPOSpays Gateways WC: Missing AuthorizationCVE-2026-39608 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through <= 1.3.7.
- Product
- iPOSpays Gateways WC
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update iPOSpays Gateways WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Filter Plus: Missing AuthorizationCVE-2026-39607 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter Plus: from n/a through <= 1.1.17.
- Product
- Filter Plus
- Affected
- up to 1.1.17
- What to do
- Affects up to 1.1.17. Update Filter Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026BizReview: Missing AuthorizationCVE-2026-39606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizReview: from n/a through <= 1.5.13.
- Product
- BizReview
- Affected
- up to 1.5.13
- What to do
- Affects up to 1.5.13. Update BizReview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Super Custom Login: Missing AuthorizationCVE-2026-39605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Custom Login: from n/a through <= 1.1.
- Product
- Super Custom Login
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Super Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Order Tracking: Missing AuthorizationCVE-2026-39602 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3.
- Product
- Order Tracking
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026DEPART: Missing AuthorizationCVE-2026-39592 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through <= 1.0.7.
- Product
- DEPART
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update DEPART to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026NM Gift Registry and Wishlist Lite: Missing AuthorizationCVE-2026-39588 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nmerii NM Gift Registry and Wishlist Lite nm-gift-registry-and-wishlist-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NM Gift Registry and Wishlist Lite: from n/a through <= 5.13.
- Product
- NM Gift Registry and Wishlist Lite
- Affected
- up to 5.13
- What to do
- Affects up to 5.13. Update NM Gift Registry and Wishlist Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Booktics: Missing AuthorizationCVE-2026-39585 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.
- Product
- Booktics
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 202612 Step Meeting List: Missing AuthorizationCVE-2026-39569 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.19.9.
- Product
- 12 Step Meeting List
- Affected
- up to 3.19.9
- What to do
- Affects up to 3.19.9. Update 12 Step Meeting List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WpTravelly: Missing AuthorizationCVE-2026-39565 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.
- Product
- WpTravelly
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update WpTravelly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Share This Image: Missing AuthorizationCVE-2026-39563 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through <= 2.12.
- Product
- Share This Image
- Affected
- up to 2.12
- What to do
- Affects up to 2.12. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-39562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.10
- What to do
- Affects up to 20.8.10. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Revive.so: Missing AuthorizationCVE-2026-39561 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.7.
- Product
- Revive.so
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Revive.so to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Tourfic: Missing AuthorizationCVE-2026-39543 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4.
- Product
- Tourfic
- Affected
- up to 2.21.4
- What to do
- Affects up to 2.21.4. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Display Eventbrite Events: Missing AuthorizationCVE-2026-39535 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: from n/a through <= 6.5.6.
- Product
- Display Eventbrite Events
- Affected
- up to 6.5.6
- What to do
- Affects up to 6.5.6. Update Display Eventbrite Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WP Delicious: Missing AuthorizationCVE-2026-39528 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.5.
- Product
- WP Delicious
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026weDocs: Missing AuthorizationCVE-2026-39520 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through <= 2.1.18.
- Product
- weDocs
- Affected
- up to 2.1.18
- What to do
- Affects up to 2.1.18. Update weDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Directorist: Missing AuthorizationCVE-2026-39509 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.
- Product
- Directorist
- Affected
- up to 8.5.10
- What to do
- Affects up to 8.5.10. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026AI Engine (Pro): Missing AuthorizationCVE-2026-39506 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine (Pro): from n/a through < 3.4.2.
- Product
- AI Engine (Pro)
- What to do
- Update AI Engine (Pro) to the newest version.
Apr 8, 2026Seriously Simple Podcasting: Missing AuthorizationCVE-2026-39505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.14.2
- What to do
- Affects up to 3.14.2. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026InstaWP Connect: Missing AuthorizationCVE-2026-39504 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.
- Product
- InstaWP Connect
- Affected
- up to 0.1.2.5
- What to do
- Affects up to 0.1.2.5. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026FOX: Missing AuthorizationCVE-2026-39501 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.
- Product
- FOX
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update FOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026SureCart: Missing AuthorizationCVE-2026-39488 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.
- Product
- SureCart
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Youtube Embed Plus: Missing AuthorizationCVE-2026-39485 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Embed Plus: from n/a through <= 14.2.4.
- Product
- Youtube Embed Plus
- Affected
- up to 14.2.4
- What to do
- Affects up to 14.2.4. Update Youtube Embed Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026CartFlows: Missing AuthorizationCVE-2026-39477 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.
- Product
- CartFlows
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026User Feedback: Missing AuthorizationCVE-2026-39476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.
- Product
- User Feedback
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.