Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,604 results · page 16 of 93
Aug 27, 2026Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.CVE-2026-78292 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.CVE-2026-78289 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
- Affected
- up to 1.10.0
- What to do
- Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.CVE-2026-78288 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.CVE-2026-78286 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
- Affected
- up to 8.9.8
- What to do
- Affects up to 8.9.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.CVE-2026-78283 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.CVE-2026-78281 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.CVE-2026-78261 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
- Affected
- up to 5.4.1
- What to do
- Affects up to 5.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.CVE-2026-78260 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
- Affected
- up to 8.4.6
- What to do
- Affects up to 8.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.CVE-2026-32566 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
- Affected
- up to 2.0.63
- What to do
- Affects up to 2.0.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.CVE-2026-32479 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.
- Affected
- up to 11.17
- What to do
- Affects up to 11.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.CVE-2026-27330 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.
- Affected
- up to 0.4.62
- What to do
- Affects up to 0.4.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 202612 Step Meeting List: Does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area pageCVE-2026-78333 · WordPress plugins & themes · reported by WPScanHigh 8.8
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.
- Product
- 12 Step Meeting List
- Fixed in
- 3.19.17
- What to do
- Update 12 Step Meeting List to 3.19.17 or newer.
Aug 27, 2026StoreGrowth: Does not validate a browser-supplied product price on two of its unauthenticated actionsCVE-2026-78137 · WordPress plugins & themes · reported by WPScanHigh 7.5
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.
- Product
- StoreGrowth
- Fixed in
- 2.1.2
- What to do
- Update StoreGrowth to 2.1.2 or newer.
Aug 26, 2026Classified Listing - Mobile Number Verification: Authentication BypassCVE-2026-15985 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.
- Product
- Classified Listing - Mobile Number Verification
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Classified Listing - Mobile Number Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordradiustheme.comwordfence.com
Aug 26, 2026Return Refund and Exchange For WooCommerce: Does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated usersCVE-2026-77695 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
- Product
- Return Refund and Exchange For WooCommerce
- Fixed in
- 4.6.4
- What to do
- Update Return Refund and Exchange For WooCommerce to 4.6.4 or newer.
Aug 26, 2026Booking for Appointments and Events Calendar: Does not require authentication before processing its pending notification queueCVE-2026-14216 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queue, allowing an unauthenticated user to force the dispatch of queued notifications and integration callbacks.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.7
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.7 or newer.
Aug 26, 2026Booking for Appointments and Events Calendar: Does not verify that an authenticated employee (provider) owns the provider account being updatedCVE-2026-14212 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their account.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 9.8
- What to do
- Update Booking for Appointments and Events Calendar to 9.8 or newer.
Aug 25, 2026eCommerce Product Catalog: Stored Cross-Site ScriptingCVE-2026-76128 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses WordPress's save-time wp_kses_post sanitization because the malicious content is stored inside shortcode brackets with no HTML tags; the tainted HTML output is only generated at render time by the shortcode handler.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.5.10
- What to do
- Affects up to 3.5.10. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026CM Map Locations – Visualize and share your locations in a few clicks: Limited Arbitrary File UploadCVE-2026-16601 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extension filtering without MIME-type checks or upload capability verification before passing attacker-supplied files to move_uploaded_file(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The required nonce is exposed to any logged-in Subscriber via the CMLOC_Editor_Images JavaScript object on the front-end location editor page.
- Product
- CM Map Locations – Visualize and share your locations in a few clicks
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update CM Map Locations – Visualize and share your locations in a few clicks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026LearnPress: Unauthorized modification of arbitrary WordPress optionsCVE-2026-75982 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive integer (a newly created page ID), enabling actions such as flipping users_can_register to a truthy value to open public registration, corrupting active_plugins to break the site, or otherwise tampering with site-wide settings normally reserved for administrators.
- Product
- LearnPress
- Affected
- up to 4.4.4
- What to do
- Affects up to 4.4.4. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses: Insecure Direct Object ReferenceCVE-2026-10630 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to read any other user's quiz answers and scores by enumerating the incrementing resultID value via the wpcq_get_quiz_result AJAX action. The only access control on this endpoint is a nonce check (wpc_nonce) that is exposed to every logged-in user on the frontend, providing no meaningful authorization barrier.
- Product
- WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
- Affected
- up to 3.2.29
- What to do
- Affects up to 3.2.29. Update WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.CVE-2026-78284 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
- Affected
- up to 3.7.42
- What to do
- Affects up to 3.7.42. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.CVE-2026-78282 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.CVE-2026-78268 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.CVE-2026-78267 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.CVE-2026-78265 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
- Affected
- up to 6.17.2
- What to do
- Affects up to 6.17.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.CVE-2026-78264 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.
- Affected
- up to 1.6.26
- What to do
- Affects up to 1.6.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.CVE-2026-78263 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
- Affected
- up to 5.29.2.1
- What to do
- Affects up to 5.29.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.CVE-2026-78262 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
- Affected
- up to 4.0.6
- What to do
- Affects up to 4.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.CVE-2026-78259 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.CVE-2026-32556 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated SQL Injection in Boost <= 2.0.4 versions.CVE-2026-32555 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Boost <= 2.0.4 versions.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.CVE-2026-32554 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
- Affected
- up to 3.1.8
- What to do
- Affects up to 3.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.CVE-2026-78291 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
- Affected
- up to 4.1223
- What to do
- Affects up to 4.1223. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.CVE-2026-78280 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.CVE-2026-78279 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-78258 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.CVE-2026-66671 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Local File Inclusion in Måne <= 1.7 versions.CVE-2026-66670 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.CVE-2026-66650 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.CVE-2026-66648 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.CVE-2026-66623 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
- Affected
- up to 2.9.9
- What to do
- Affects up to 2.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.CVE-2026-66610 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.CVE-2026-66599 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
- Affected
- up to 2.9.5.6
- What to do
- Affects up to 2.9.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66587 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
- What to do
- Update the plugin to the newest version.
Aug 24, 2026Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.CVE-2026-66585 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
- What to do
- Update the plugin to the newest version.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.CVE-2026-66584 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
- Affected
- up to 3.19.16
- What to do
- Affects up to 3.19.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.CVE-2026-32558 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.
- Affected
- up to 8.9.1
- What to do
- Affects up to 8.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.CVE-2026-32477 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.CVE-2026-32476 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
- Affected
- up to 0.8.6
- What to do
- Affects up to 0.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.