Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,719 results · page 167 of 815
Apr 8, 2026Client Invoicing by Sprout Invoices: Missing AuthorizationCVE-2026-39562 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.10.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.10
- What to do
- Affects up to 20.8.10. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Revive.so: Missing AuthorizationCVE-2026-39561 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.7.
- Product
- Revive.so
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Revive.so to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026LabtechCO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39544 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows PHP Local File Inclusion.This issue affects LabtechCO: from n/a through <= 8.3.
- Product
- LabtechCO
- Affected
- up to 8.3
- What to do
- Affects up to 8.3. Update LabtechCO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Tourfic: Missing AuthorizationCVE-2026-39543 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4.
- Product
- Tourfic
- Affected
- up to 2.21.4
- What to do
- Affects up to 2.21.4. Update Tourfic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Doofinder for WooCommerce: Insertion of Sensitive Information Into Sent DataCVE-2026-39542 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through <= 2.10.13.
- Product
- Doofinder for WooCommerce
- Affected
- up to 2.10.13
- What to do
- Affects up to 2.10.13. Update Doofinder for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Hydra Booking: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39541 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.This issue affects Hydra Booking: from n/a through <= 1.1.38.
- Product
- Hydra Booking
- Affected
- up to 1.1.38
- What to do
- Affects up to 1.1.38. Update Hydra Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Mikado Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-39538 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Core: from n/a through <= 1.6.
- Product
- Mikado Core
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Mikado Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026RSVP and Event Management: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.
- Product
- RSVP and Event Management
- Affected
- up to 2.7.16
- What to do
- Affects up to 2.7.16. Update RSVP and Event Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Display Eventbrite Events: Missing AuthorizationCVE-2026-39535 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display Eventbrite Events: from n/a through <= 6.5.6.
- Product
- Display Eventbrite Events
- Affected
- up to 6.5.6
- What to do
- Affects up to 6.5.6. Update Display Eventbrite Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WP Delicious: Missing AuthorizationCVE-2026-39528 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.5.
- Product
- WP Delicious
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update WP Delicious to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WpStream: Authorization Bypass Through User-Controlled KeyCVE-2026-39526 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through < 4.11.2.
- Product
- WpStream
- What to do
- Update WpStream to the newest version.
Apr 8, 2026Nelio Content: Server-Side Request Forgery (SSRF)CVE-2026-39521 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Request Forgery.This issue affects Nelio Content: from n/a through <= 4.3.1.
- Product
- Nelio Content
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update Nelio Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026weDocs: Missing AuthorizationCVE-2026-39520 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through <= 2.1.18.
- Product
- weDocs
- Affected
- up to 2.1.18
- What to do
- Affects up to 2.1.18. Update weDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Blog Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39517 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.6.
- Product
- Blog Filter
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update Blog Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Nexter Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39516 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.7.0.
- Product
- Nexter Blocks
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Image Photo Gallery Final Tiles Grid: Authorization Bypass Through User-Controlled KeyCVE-2026-39510 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.11.
- Product
- Image Photo Gallery Final Tiles Grid
- Affected
- up to 3.6.11
- What to do
- Affects up to 3.6.11. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Directorist: Missing AuthorizationCVE-2026-39509 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.
- Product
- Directorist
- Affected
- up to 8.5.10
- What to do
- Affects up to 8.5.10. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Advanced Coupons for WooCommerce Coupons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39508 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows DOM-Based XSS.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.1.
- Product
- Advanced Coupons for WooCommerce Coupons
- Affected
- up to 4.7.1.1
- What to do
- Affects up to 4.7.1.1. Update Advanced Coupons for WooCommerce Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026AI Engine (Pro): Missing AuthorizationCVE-2026-39506 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine (Pro): from n/a through < 3.4.2.
- Product
- AI Engine (Pro)
- What to do
- Update AI Engine (Pro) to the newest version.
Apr 8, 2026Seriously Simple Podcasting: Missing AuthorizationCVE-2026-39505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.2.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.14.2
- What to do
- Affects up to 3.14.2. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026InstaWP Connect: Missing AuthorizationCVE-2026-39504 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.2.5.
- Product
- InstaWP Connect
- Affected
- up to 0.1.2.5
- What to do
- Affects up to 0.1.2.5. Update InstaWP Connect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026FOX: Missing AuthorizationCVE-2026-39501 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.
- Product
- FOX
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update FOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026themesflat-addons-for-elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39500 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.2.
- Product
- themesflat-addons-for-elementor
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update themesflat-addons-for-elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026FOX: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39497 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5.
- Product
- FOX
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update FOX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026YayMail: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39496 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.This issue affects YayMail: from n/a through <= 4.3.3.
- Product
- YayMail
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update YayMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Simply Schedule Appointments: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39495 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.27.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.9.27
- What to do
- Affects up to 1.6.9.27. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026SureCart: Missing AuthorizationCVE-2026-39488 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureCart: from n/a through <= 4.0.2.
- Product
- SureCart
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update SureCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39487 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.1.1.
- Product
- Amelia
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Download Monitor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39486 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.
- Product
- Download Monitor
- Affected
- up to 5.1.8
- What to do
- Affects up to 5.1.8. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Youtube Embed Plus: Missing AuthorizationCVE-2026-39485 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Embed Plus: from n/a through <= 14.2.4.
- Product
- Youtube Embed Plus
- Affected
- up to 14.2.4
- What to do
- Affects up to 14.2.4. Update Youtube Embed Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Hide My WP Ghost: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-39484 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.
- Product
- Hide My WP Ghost
- What to do
- Update Hide My WP Ghost to the newest version.
Apr 8, 2026VK All in One Expansion Unit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39483 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidekazu Ishikawa VK All in One Expansion Unit vk-all-in-one-expansion-unit allows Stored XSS.This issue affects VK All in One Expansion Unit: from n/a through <= 9.113.3.
- Product
- VK All in One Expansion Unit
- Affected
- up to 9.113.3
- What to do
- Affects up to 9.113.3. Update VK All in One Expansion Unit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Post Expirator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n/a through <= 4.9.4.
- Product
- Post Expirator
- Affected
- up to 4.9.4
- What to do
- Affects up to 4.9.4. Update Post Expirator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026OttoKit: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39479 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20.
- Product
- OttoKit
- Affected
- up to 1.1.20
- What to do
- Affects up to 1.1.20. Update OttoKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026CartFlows: Missing AuthorizationCVE-2026-39477 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.
- Product
- CartFlows
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update CartFlows to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026User Feedback: Missing AuthorizationCVE-2026-39476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.
- Product
- User Feedback
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026User Feedback: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39475 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.1.
- Product
- User Feedback
- Affected
- up to 1.10.1
- What to do
- Affects up to 1.10.1. Update User Feedback to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Simple History: Insertion of Sensitive Information Into Sent DataCVE-2026-39473 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Pär Thernström Simple History simple-history allows Retrieve Embedded Sensitive Data.This issue affects Simple History: from n/a through <= 5.24.0.
- Product
- Simple History
- Affected
- up to 5.24.0
- What to do
- Affects up to 5.24.0. Update Simple History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026PageLayer: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39469 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve Embedded Sensitive Data.This issue affects PageLayer: from n/a through <= 2.0.8.
- Product
- PageLayer
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update PageLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Broken Link Checker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-39466 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Broken Link Checker broken-link-checker allows Blind SQL Injection.This issue affects Broken Link Checker: from n/a through <= 2.4.7.
- Product
- Broken Link Checker
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Server-Side Request Forgery (SSRF)CVE-2026-39464 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Server Side Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.
- Product
- Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
- Affected
- up to 6.19.8
- What to do
- Affects up to 6.19.8. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Magic Conversation For Gravity Forms: Stored Cross-Site ScriptingCVE-2026-1396 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'magic-conversation' shortcode in all versions up to, and including, 3.0.97 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Magic Conversation For Gravity Forms
- Affected
- up to 3.0.97
- What to do
- Affects up to 3.0.97. Update Magic Conversation For Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Element Pack Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-4655 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget in versions up to and including 8.4.2. This is due to insufficient input sanitization and output escaping on SVG content fetched from remote URLs in the render_svg() function. The function fetches SVG content using wp_safe_remote_get() and then directly echoes it to the page without any sanitization, only applying a preg_replace() to add attributes to the SVG tag which does not remove malicious event handlers. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary JavaScript in SVG files that will execute whenever a user accesses a page containing the malicious widget.
- Product
- Element Pack Addons for Elementor
- Affected
- up to 8.4.2
- What to do
- Affects up to 8.4.2. Update Element Pack Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Awesome Support – WordPress HelpDesk & Support: Insecure Direct Object ReferenceCVE-2026-4654 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7. This is due to the wpas_get_ticket_replies_ajax() function failing to verify whether the authenticated user has permission to view the specific ticket being requested. This makes it possible for authenticated attackers, with subscriber-level access and above, to access sensitive information from all support tickets in the system by manipulating the ticket_id parameter.
- Product
- Awesome Support – WordPress HelpDesk & Support
- Affected
- up to 6.3.7
- What to do
- Affects up to 6.3.7. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Blog2Social: Social Media Auto Post & Scheduler: Authorization bypass through user-controlled keyCVE-2026-4330 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up to, and including, 8.8.3. This is due to the plugin's AJAX handlers failing to validate that the user-supplied 'b2s_id' parameter belongs to the current user before performing UPDATE and DELETE operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify, reschedule, or delete other users' scheduled social media posts.
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Affected
- up to 8.8.3
- What to do
- Affects up to 8.8.3. Update Blog2Social: Social Media Auto Post & Scheduler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026WowPress: Stored Cross-Site ScriptingCVE-2026-5508 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wowpress` shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WowPress
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WowPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Wavr: Stored Cross-Site ScriptingCVE-2026-5506 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wave` shortcode in all versions up to, and including, 0.2.6. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Wavr
- Affected
- up to 0.2.6
- What to do
- Affects up to 0.2.6. Update Wavr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Inquiry Form to Posts or Pages: Stored Cross-Site ScriptingCVE-2026-5169 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Form Header' field in versions up to and including 1.0. This is due to insufficient input sanitization when saving via update_option() and lack of output escaping when displaying the stored value. The vulnerability exists in two locations: (1) the plugin settings page at inq_form.php line 180 where the value is echoed into an HTML attribute without esc_attr(), and (2) the front-end shortcode output at inquery_form_to_posts_or_pages.php line 139 where the value is output in HTML content without esc_html(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that will execute whenever a user accesses the plugin settings page or views a page containing the [inquiry_form] shortcode.
- Product
- Inquiry Form to Posts or Pages
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Inquiry Form to Posts or Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Masteriyo LMS – Online Course Builder for eLearning, LMS & Education: Authorization Bypass Through User-Controlled KeyCVE-2026-5167 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content.
- Product
- Masteriyo LMS – Online Course Builder for eLearning, LMS & Education
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Masteriyo LMS – Online Course Builder for eLearning, LMS & Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 8, 2026Sports Club Management: Stored Cross-Site ScriptingCVE-2026-4871 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sports Club Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' attributes of the `scm_member_data` shortcode in all versions up to, and including, 1.12.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Sports Club Management
- Affected
- up to 1.12.9
- What to do
- Affects up to 1.12.9. Update Sports Club Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.