Vulnerability database

40,719 results · page 165 of 815

• Apr 8, 2026FSM Custom Featured Image Caption: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39693 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fesomia FSM Custom Featured Image Caption fsm-custom-featured-image-caption allows DOM-Based XSS.This issue affects FSM Custom Featured Image Caption: from n/a through <= 1.25.1.

  Product

  FSM Custom Featured Image Caption

  Affected

  up to 1.25.1

  What to do

  Affects up to 1.25.1. Update FSM Custom Featured Image Caption to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39692 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Stored XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

  Product

  tagDiv Composer

  Affected

  up to 5.4.3

  What to do

  Affects up to 5.4.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Cryptocurrency Donation Box – Bitcoin & Crypto Donations: Missing AuthorizationCVE-2026-39691 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.

  Product

  Cryptocurrency Donation Box – Bitcoin & Crypto Donations

  Affected

  up to 2.2.13

  What to do

  Affects up to 2.2.13. Update Cryptocurrency Donation Box – Bitcoin & Crypto Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Author Avatars List/Block: Missing AuthorizationCVE-2026-39690 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.

  Product

  Author Avatars List/Block

  Affected

  up to 2.1.25

  What to do

  Affects up to 2.1.25. Update Author Avatars List/Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026eShipper Commerce: Missing AuthorizationCVE-2026-39689 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eShipper Commerce: from n/a through <= 2.16.12.

  Product

  eShipper Commerce

  Affected

  up to 2.16.12

  What to do

  Affects up to 2.16.12. Update eShipper Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026WP Frontend Profile: Missing AuthorizationCVE-2026-39688 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Frontend Profile: from n/a through <= 1.3.9.

  Product

  WP Frontend Profile

  Affected

  up to 1.3.9

  What to do

  Affects up to 1.3.9. Update WP Frontend Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Rapid Car Check Vehicle Data: Missing AuthorizationCVE-2026-39687 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.

  Product

  Rapid Car Check Vehicle Data

  Affected

  up to 2.0

  What to do

  Affects up to 2.0. Update Rapid Car Check Vehicle Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026BSK PDF Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39686 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.

  Product

  BSK PDF Manager

  Affected

  up to 3.7.2

  What to do

  Affects up to 3.7.2. Update BSK PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026The Moneytizer: Missing AuthorizationCVE-2026-39685 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Moneytizer: from n/a through <= 10.0.10.

  Product

  The Moneytizer

  Affected

  up to 10.0.10

  What to do

  Affects up to 10.0.10. Update The Moneytizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026OrganicFood: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39684 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnTheme OrganicFood organicfood allows PHP Local File Inclusion.This issue affects OrganicFood: from n/a through <= 3.6.4.

  Product

  OrganicFood

  Affected

  up to 3.6.4

  What to do

  Affects up to 3.6.4. Update OrganicFood to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Garden Gnome Package: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39683 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chief Gnome Garden Gnome Package garden-gnome-package allows DOM-Based XSS.This issue affects Garden Gnome Package: from n/a through <= 2.4.1.

  Product

  Garden Gnome Package

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Garden Gnome Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026linkPizza-Manager: Missing AuthorizationCVE-2026-39682 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5.

  Product

  linkPizza-Manager

  Affected

  up to 5.5.5

  What to do

  Affects up to 5.5.5. Update linkPizza-Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Homeo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39681 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Homeo homeo allows PHP Local File Inclusion.This issue affects Homeo: from n/a through <= 1.2.59.

  Product

  Homeo

  Affected

  up to 1.2.59

  What to do

  Affects up to 1.2.59. Update Homeo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Diet Calorie Calculator: Missing AuthorizationCVE-2026-39680 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in MWP Development Diet Calorie Calculator diet-calorie-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Diet Calorie Calculator: from n/a through <= 1.1.1.

  Product

  Diet Calorie Calculator

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Diet Calorie Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Freeio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39679 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Freeio freeio allows PHP Local File Inclusion.This issue affects Freeio: from n/a through <= 1.3.21.

  Product

  Freeio

  Affected

  up to 1.3.21

  What to do

  Affects up to 1.3.21. Update Freeio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Pinpoint Booking System: Missing AuthorizationCVE-2026-39678 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Pinpoint Booking System Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through 2.9.9.7.2.

  Product

  Pinpoint Booking System

  Affected

  up to 2.9.9.7.2

  What to do

  Affects up to 2.9.9.7.2. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Emphires: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39677 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Emphires emphires allows PHP Local File Inclusion.This issue affects Emphires: from n/a through <= 3.9.

  Product

  Emphires

  Affected

  up to 3.9

  What to do

  Affects up to 3.9. Update Emphires to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Download Manager: Missing AuthorizationCVE-2026-39676 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.

  Product

  Download Manager

  Affected

  up to 3.3.52

  What to do

  Affects up to 3.3.52. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Court Reservation: Missing AuthorizationCVE-2026-39675 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Court Reservation: from n/a through <= 1.10.11.

  Product

  Court Reservation

  Affected

  up to 1.10.11

  What to do

  Affects up to 1.10.11. Update Court Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026MK Google Directions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39674 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manoj Kumar MK Google Directions google-distance-calculator allows DOM-Based XSS.This issue affects MK Google Directions: from n/a through <= 3.1.1.

  Product

  MK Google Directions

  Affected

  up to 3.1.1

  What to do

  Affects up to 3.1.1. Update MK Google Directions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026iZooto: Missing AuthorizationCVE-2026-39673 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iZooto: from n/a through <= 3.7.20.

  Product

  iZooto

  Affected

  up to 3.7.20

  What to do

  Affects up to 3.7.20. Update iZooto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026ShipTime: Discounted Shipping Rates: Missing AuthorizationCVE-2026-39672 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipTime: Discounted Shipping Rates: from n/a through <= 1.1.1.

  Product

  ShipTime: Discounted Shipping Rates

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update ShipTime: Discounted Shipping Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Extra Fees Plugin for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2026-39671 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery.This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.

  Product

  Extra Fees Plugin for WooCommerce

  Affected

  up to 4.3.3

  What to do

  Affects up to 4.3.3. Update Extra Fees Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Visual Link Preview: Server-Side Request Forgery (SSRF)CVE-2026-39670 · WordPress plugins & themes · reported by PatchstackMedium 6

  Server-Side Request Forgery (SSRF) vulnerability in Brecht Visual Link Preview visual-link-preview allows Server Side Request Forgery.This issue affects Visual Link Preview: from n/a through <= 2.3.0.

  Product

  Visual Link Preview

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Visual Link Preview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026NitroPack: Missing AuthorizationCVE-2026-39669 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.

  Product

  NitroPack

  Affected

  up to 1.19.3

  What to do

  Affects up to 1.19.3. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Book Previewer for Woocommerce: Missing AuthorizationCVE-2026-39668 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.

  Product

  Book Previewer for Woocommerce

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Book Previewer for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Korea SNS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39667 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jongmyoung Kim Korea SNS korea-sns allows DOM-Based XSS.This issue affects Korea SNS: from n/a through <= 1.7.0.

  Product

  Korea SNS

  Affected

  up to 1.7.0

  What to do

  Affects up to 1.7.0. Update Korea SNS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Hello Bar Popup Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39666 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through <= 1.5.1.

  Product

  Hello Bar Popup Builder

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Hello Bar Popup Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026SEO Friendly Images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39665 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac SEO Friendly Images seo-image allows DOM-Based XSS.This issue affects SEO Friendly Images: from n/a through <= 3.0.5.

  Product

  SEO Friendly Images

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update SEO Friendly Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Leadrebel: Missing AuthorizationCVE-2026-39664 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadrebel: from n/a through <= 1.0.2.

  Product

  Leadrebel

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Leadrebel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026TrueBooker: Missing AuthorizationCVE-2026-39663 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.5.

  Product

  TrueBooker

  Affected

  up to 1.1.5

  What to do

  Affects up to 1.1.5. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Product Price by Formula for WooCommerce: Missing AuthorizationCVE-2026-39662 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Price by Formula for WooCommerce: from n/a through <= 2.5.6.

  Product

  Product Price by Formula for WooCommerce

  Affected

  up to 2.5.6

  What to do

  Affects up to 2.5.6. Update Product Price by Formula for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Panda Pods Repeater Field: Missing AuthorizationCVE-2026-39658 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through <= 1.5.12.

  Product

  Panda Pods Repeater Field

  Affected

  up to 1.5.12

  What to do

  Affects up to 1.5.12. Update Panda Pods Repeater Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026leadlovers forms: Missing AuthorizationCVE-2026-39657 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through <= 1.0.2.

  Product

  leadlovers forms

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update leadlovers forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Razorpay for WooCommerce: Missing AuthorizationCVE-2026-39656 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.

  Product

  Razorpay for WooCommerce

  Affected

  up to 4.8.2

  What to do

  Affects up to 4.8.2. Update Razorpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026WP Simple HTML Sitemap: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39654 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.

  Product

  WP Simple HTML Sitemap

  Affected

  up to 3.8

  What to do

  Affects up to 3.8. Update WP Simple HTML Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Video Conferencing with Zoom: Missing AuthorizationCVE-2026-39653 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Conferencing with Zoom: from n/a through <= 4.6.6.

  Product

  Video Conferencing with Zoom

  Affected

  up to 4.6.6

  What to do

  Affects up to 4.6.6. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026iGMS Direct Booking: Missing AuthorizationCVE-2026-39652 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iGMS Direct Booking: from n/a through <= 1.3.

  Product

  iGMS Direct Booking

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update iGMS Direct Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Total Poll Lite: Missing AuthorizationCVE-2026-39651 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through <= 4.12.0.

  Product

  Total Poll Lite

  Affected

  up to 4.12.0

  What to do

  Affects up to 4.12.0. Update Total Poll Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026UnitechPay: Missing AuthorizationCVE-2026-39650 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through <= 1.0.2.

  Product

  UnitechPay

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update UnitechPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Royale News: Missing AuthorizationCVE-2026-39649 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royale News: from n/a through <= 2.2.4.

  Product

  Royale News

  Affected

  up to 2.2.4

  What to do

  Affects up to 2.2.4. Update Royale News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Cream Blog: Missing AuthorizationCVE-2026-39648 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.

  Product

  Cream Blog

  Affected

  up to 2.1.7

  What to do

  Affects up to 2.1.7. Update Cream Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026MP3 Audio Player for Music, Radio & Podcast by Sonaar: Server-Side Request Forgery (SSRF)CVE-2026-39647 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Server Side Request Forgery.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.11.

  Product

  MP3 Audio Player for Music, Radio & Podcast by Sonaar

  Affected

  up to 5.11

  What to do

  Affects up to 5.11. Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39646 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bozdoz Leaflet Map leaflet-map allows Stored XSS.This issue affects Leaflet Map: from n/a through <= 3.4.4.

  Product

  Leaflet Map

  Affected

  up to 3.4.4

  What to do

  Affects up to 3.4.4. Update Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026GlobalPayments WooCommerce: Server-Side Request Forgery (SSRF)CVE-2026-39645 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Server-Side Request Forgery (SSRF) vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.18.0.

  Product

  GlobalPayments WooCommerce

  Affected

  up to 1.18.0

  What to do

  Affects up to 1.18.0. Update GlobalPayments WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Wp Ultimate Review: Missing AuthorizationCVE-2026-39644 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.

  Product

  Wp Ultimate Review

  Affected

  up to 2.3.8

  What to do

  Affects up to 2.3.8. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Payment Plugins for PayPal WooCommerce: Missing AuthorizationCVE-2026-39643 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.

  Product

  Payment Plugins for PayPal WooCommerce

  Affected

  up to 2.0.13

  What to do

  Affects up to 2.0.13. Update Payment Plugins for PayPal WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Blackfyre: Cross-Site Request Forgery (CSRF)CVE-2026-39641 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a through <= 2.5.4.

  Product

  Blackfyre

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update Blackfyre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026Theme Editor: Cross-Site Request Forgery (CSRF)CVE-2026-39640 · WordPress plugins & themes · reported by PatchstackCritical 9.6

  Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.

  Product

  Theme Editor

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Theme Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Apr 8, 2026RPS Include Content: Missing AuthorizationCVE-2026-39639 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RPS Include Content: from n/a through <= 1.2.2.

  Product

  RPS Include Content

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update RPS Include Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.