Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,567 results · page 17 of 232
Aug 13, 2026Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-66430 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
- Affected
- up to 11.10
- What to do
- Affects up to 11.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-66429 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
- Affected
- up to 11.10
- What to do
- Affects up to 11.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.CVE-2026-28175 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
- Affected
- up to 8.11
- What to do
- Affects up to 8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-28002 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.
- Product
- Booktics
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update Booktics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.CVE-2026-27536 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026Tablesome Table: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-66659 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.
- Product
- Tablesome Table
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Tablesome Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026Import WP: Does not perform any authorization check on one of its export-file download handlersCVE-2026-14925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
- Product
- Import WP
- Fixed in
- 2.14.23
- What to do
- Update Import WP to 2.14.23 or newer.
Aug 11, 2026AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Authorization bypassCVE-2026-15426 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.
- Product
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
- Affected
- up to 10.11.1
- What to do
- Affects up to 10.11.1. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 10, 2026RSS Aggregator by Feedzy: Does not verify that the requesting user owns or is allowed to edit the import job named in the requestCVE-2026-18934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its deduplication and scheduling state, disable it, or clear its error log. One of the affected actions performs no object-type check either, so arbitrary posts and pages can also be unpublished regardless of who owns them.
- Product
- RSS Aggregator by Feedzy
- Fixed in
- 5.2.6
- What to do
- Update RSS Aggregator by Feedzy to 5.2.6 or newer.
Aug 10, 2026Login & Register Forms: Does not enforce its password reset attempt limit against a server-derived valueCVE-2026-18469 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
- Product
- Login & Register Forms
- Fixed in
- 4.0.2
- What to do
- Update Login & Register Forms to 4.0.2 or newer.
Aug 10, 2026Squeeze: Does not validate the file type or extension of the per-size image data written by one of its attachment-update actionsCVE-2026-16985 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.
- Product
- Squeeze
- Fixed in
- 1.7.12
- What to do
- Update Squeeze to 1.7.12 or newer.
Aug 9, 2026Slim SEO: Does not restrict a post-meta preview feature to posts the user is allowed to editCVE-2026-16957 · WordPress plugins & themes · reported by WPScanLow 2.7
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types.
- Product
- Slim SEO
- Fixed in
- 4.9.11
- What to do
- Update Slim SEO to 4.9.11 or newer.
Aug 9, 2026LWS Optimize: Does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboardCVE-2026-16032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
- Product
- LWS Optimize
- Fixed in
- 4.1.2
- What to do
- Update LWS Optimize to 4.1.2 or newer.
Aug 8, 2026Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection: Does not perform any capability check on one of its REST API endpointsCVE-2026-16578 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
- Product
- Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection
- Fixed in
- 1.4.0
- What to do
- Update Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection to 1.4.0 or newer.
Aug 7, 2026Simple CAPTCHA with Cloudflare Turnstile: Does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integrationCVE-2026-15239 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
- Product
- Simple CAPTCHA with Cloudflare Turnstile
- Fixed in
- 1.42.0
- What to do
- Update Simple CAPTCHA with Cloudflare Turnstile to 1.42.0 or newer.
Aug 7, 2026BNE Testimonials: Does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline scriptCVE-2026-15245 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing the affected content.
- Product
- BNE Testimonials
- Fixed in
- 2.0.8.2
- What to do
- Update BNE Testimonials to 2.0.8.2 or newer.
Aug 6, 2026miniOrange 2FA: Does not correctly limit the number of second-factor verification attemptsCVE-2026-16619 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
- Product
- miniOrange 2FA
- Fixed in
- 6.2.8
- What to do
- Update miniOrange 2FA to 6.2.8 or newer.
Aug 6, 2026Simple Membership: Does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membershipCVE-2026-14936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.
- Product
- Simple Membership
- Fixed in
- 4.7.7
- What to do
- Update Simple Membership to 4.7.7 or newer.
Aug 6, 2026Easy Booking: Does not re-enforce a bookable product's configured minimum booking duration on the server sideCVE-2026-14831 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.
- Product
- Easy Booking
- Fixed in
- 3.5.0
- What to do
- Update Easy Booking to 3.5.0 or newer.
Aug 6, 2026The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing thCVE-2026-13342 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.
- What to do
- Update the plugin to the newest version.
Aug 6, 2026Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.CVE-2026-66712 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
- Affected
- up to 4.7.8
- What to do
- Affects up to 4.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.CVE-2026-66692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.CVE-2026-66688 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
- Affected
- up to 1.45.2
- What to do
- Affects up to 1.45.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.CVE-2026-66684 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66457 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
- Product
- Events Manager
- Affected
- up to 7.4.2
- What to do
- Affects up to 7.4.2. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.CVE-2026-65543 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
- Affected
- up to 1.6.12.10
- What to do
- Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65508 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
- Affected
- up to 1.6.12.10
- What to do
- Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Popup Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28177 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.
- Product
- Popup Maker
- Affected
- up to 1.23.0
- What to do
- Affects up to 1.23.0. Update Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.CVE-2026-28146 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.
- Affected
- up to 2.0.14
- What to do
- Affects up to 2.0.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.CVE-2026-25403 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider: Stored Cross-Site ScriptingCVE-2026-18400 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, allowing Author-level users to set the malicious delay value via XML-RPC custom_fields when creating an ml-slider post.
- Product
- Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
- Affected
- up to 3.111.0
- What to do
- Affects up to 3.111.0. Update Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 6, 2026Welcart e-Commerce: Does not properly sanitise a value taken from an imported CSV file before using it in a SQL statementCVE-2026-16065 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above (including its custom shop-management roles) to perform SQL injection attacks.
- Product
- Welcart e-Commerce
- Fixed in
- 2.11.32
- What to do
- Update Welcart e-Commerce to 2.11.32 or newer.
Aug 6, 2026Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps: Does not properly restrict access to its license-management functionalityCVE-2026-14829 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated attackers to deactivate the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13's premium licensing state and erase the stored license key.
- Product
- Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 5, 2026Udimi Tools: Unauthorized modification of dataCVE-2026-7456 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's six configuration options — including the API key, connected Udimi user email, and tracking-script payload — effectively disconnecting the site from the configured Udimi account. The companion `ajax_connect()` handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.
- Product
- Udimi Tools
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Udimi Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026Content Egg – Affiliate Product Importer & Price Comparison: Arbitrary File DeletionCVE-2026-15979 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'img_file' field within the cegg_data post metadata: the value passes only through wp_strip_all_tags() (which does not strip path traversal sequences), is stored directly in post meta, and is later concatenated without normalization into a filesystem path in getFullImgPath() before being passed to PHP's unlink(). This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Content Egg – Affiliate Product Importer & Price Comparison
- Affected
- up to 11.3.0
- What to do
- Affects up to 11.3.0. Update Content Egg – Affiliate Product Importer & Price Comparison to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026MailChimp Forms by MailMunch: Unauthorized modification of dataCVE-2026-7520 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.
- Product
- MailChimp Forms by MailMunch
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026Simple Yearly Archive: Stored Cross-Site ScriptingCVE-2026-7441 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlyArchive` shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Yearly Archive
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Simple Yearly Archive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026JoomSport – for Sports: Team & League, Football, Hockey & more: Time-based SQL InjectionCVE-2026-11920 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The affected admin page lacks nonce or CSRF protection on the GET request, meaning an unauthenticated attacker could exploit this vulnerability by tricking an authenticated administrator into issuing a crafted request. Additionally, the vulnerability is only triggered when the 'orderby' parameter is also present and non-empty alongside the 'order' parameter.
- Product
- JoomSport – for Sports: Team & League, Football, Hockey & more
- Affected
- up to 5.7.9
- What to do
- Affects up to 5.7.9. Update JoomSport – for Sports: Team & League, Football, Hockey & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 5, 2026MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings: Does not have authorisation and CSRF checks in one of its AJAX actionsCVE-2026-17515 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4's import log file as well as import-related metadata belonging to arbitrary posts.
- Product
- MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings
- Fixed in
- 7.0.4
- What to do
- Update MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings to 7.0.4 or newer.
Aug 5, 2026Bit Form: Does not sanitize an uploaded signature image before storing itCVE-2026-16573 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting.
- Product
- Bit Form
- Fixed in
- 3.2.0
- What to do
- Update Bit Form to 3.2.0 or newer.
Aug 5, 2026OTP Login With Phone Number, OTP Verification: Does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guessCVE-2026-15210 · WordPress plugins & themes · reported by WPScanCritical 9.1
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's.
- Product
- OTP Login With Phone Number, OTP Verification
- Fixed in
- 1.8.71
- What to do
- Update OTP Login With Phone Number, OTP Verification to 1.8.71 or newer.
Aug 4, 2026Improve SEO: Does not properly validate uploaded filesCVE-2026-16618 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.
- Product
- Improve SEO
- Affected
- up to 2.0.11
- What to do
- Affects up to 2.0.11. Update Improve SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 4, 2026Wired Impact Volunteer Management: Does not have authorisation checks in one of its AJAX actionsCVE-2026-16546 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the RSVP being removed belongs to the requesting user, allowing users with a role as low as Subscriber to remove arbitrary users' RSVPs from any volunteer opportunity.
- Product
- Wired Impact Volunteer Management
- Fixed in
- 2.8.2
- What to do
- Update Wired Impact Volunteer Management to 2.8.2 or newer.
Aug 4, 2026Simple Google Calendar Outlook Events Widget: Does not validate a user-supplied URL before performing a server-side requestCVE-2026-16536 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.
- Product
- Simple Google Calendar Outlook Events Widget
- Fixed in
- 3.1.0
- What to do
- Update Simple Google Calendar Outlook Events Widget to 3.1.0 or newer.
Aug 4, 2026Brizy: Does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image metaCVE-2026-16069 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor role or above to inject arbitrary web scripts that execute in the session of a higher-privileged user who opens the post for review.
- Product
- Brizy
- Fixed in
- 2.8.19
- What to do
- Update Brizy to 2.8.19 or newer.
Aug 3, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Missing AuthorizationCVE-2026-28147 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.15.
- Product
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Affected
- up to 2.0.15
- What to do
- Affects up to 2.0.15. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2026Import and export users and customers: Does not enforce WordPress's role-assignment and per-user edit permissions during CSV importCVE-2026-16534 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.
- Product
- Import and export users and customers
- Fixed in
- 2.4.2
- What to do
- Update Import and export users and customers to 2.4.2 or newer.
Aug 3, 2026Simple Membership: Does not sanitise a subscriber name value received from an unauthenticated payment approval requestCVE-2026-15931 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.
- Product
- Simple Membership
- Fixed in
- 4.7.8
- What to do
- Update Simple Membership to 4.7.8 or newer.
Aug 3, 2026Simple Membership: Does not verify whether user creation failed during registration before using the returned valueCVE-2026-15930 · WordPress plugins & themes · reported by WPScanCritical 9.4
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.
- Product
- Simple Membership
- Fixed in
- 4.7.8
- What to do
- Update Simple Membership to 4.7.8 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.