Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

4,273 results · page 17 of 86

Apr 8, 2026WP Blockade: Missing AuthorizationCVE-2026-3480 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14. The plugin registers an admin_post action hook 'wp-blockade-shortcode-render' that maps to the render_shortcode_preview() function. This function lacks any capability check (current_user_can()) and nonce verification, allowing any authenticated user to execute arbitrary WordPress shortcodes. The function takes a user-supplied 'shortcode' parameter from $_GET, passes it through stripslashes(), and directly executes it via do_shortcode(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes, which could lead to information disclosure, privilege escalation, or other impacts depending on what shortcodes are registered on the site (e.g., shortcodes from other plugins that display sensitive data, perform actions, or include files).
Product
WP Blockade
Affected
up to 0.9.14
What to do
Affects up to 0.9.14. Update WP Blockade to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026PZ Frontend Manager: Missing AuthorizationCVE-2026-3477 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PZ Frontend Manager plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.6. The pzfm_user_request_action_callback() function, registered via the wp_ajax_pzfm_user_request_action action hook, lacks both capability checks and nonce verification. This function handles user activation, deactivation, and deletion operations. When the 'dataType' parameter is set to 'delete', the function calls wp_delete_user() on all provided user IDs without verifying that the current user has the appropriate permissions. Notably, the similar pzfm_remove_item_callback() function does check pzfm_can_delete_user() before performing deletions, indicating this was an oversight. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary WordPress users (including administrators) by sending a crafted request to the AJAX endpoint.
Product
PZ Frontend Manager
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update PZ Frontend Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026Pinterest Site Verification plugin using Meta Tag: Stored Cross-Site ScriptingCVE-2026-3142 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Pinterest Site Verification plugin using Meta Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_var' parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pinterest Site Verification plugin using Meta Tag
Affected
up to 1.8
What to do
Affects up to 1.8. Update Pinterest Site Verification plugin using Meta Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026MainWP Child Reports: Missing AuthorizationCVE-2026-4299 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.
Product
MainWP Child Reports
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update MainWP Child Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026LTL Freight Quotes – R+L Carriers Edition: Missing AuthorizationCVE-2026-3646 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up to, and including, 3.3.13. This is due to missing authentication, authorization, and nonce verification on a standalone PHP file that directly processes GET parameters and updates WordPress options. This makes it possible for unauthenticated attackers to modify the plugin's subscription plan settings, effectively downgrading the store from a paid plan to the Trial Plan, changing the store type, and manipulating subscription expiration dates, potentially disabling premium features such as Dropship and Hazardous Material handling.
Product
LTL Freight Quotes – R+L Carriers Edition
Affected
up to 3.3.13
What to do
Affects up to 3.3.13. Update LTL Freight Quotes – R+L Carriers Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Backup Migration: Missing AuthorizationCVE-2025-14944 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.
Product
Backup Migration
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Backup Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Ocean Extra: Missing AuthorizationCVE-2026-34903 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3.
Product
Ocean Extra
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Ocean Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 7, 2026LTL Freight Quotes – Worldwide Express Edition: Missing AuthorizationCVE-2026-34899 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Eniture technology LTL Freight Quotes – Worldwide Express Edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.2.1.
Product
LTL Freight Quotes – Worldwide Express Edition
Affected
up to 5.2.1
What to do
Affects up to 5.2.1. Update LTL Freight Quotes – Worldwide Express Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 7, 2026Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: Insufficient Verification of Data AuthenticityCVE-2026-3177 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incoming Stripe webhook events. This makes it possible for unauthenticated attackers to forge payment_intent.succeeded webhook payloads and mark pending donations as completed without a real payment.
Product
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Affected
up to 1.8.9.7
What to do
Affects up to 1.8.9.7. Update Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 1, 2026Export All URLs: Generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit numberCVE-2026-2696 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Export All URLs WordPress plugin before 5.1 generates CSV filenames containing posts URLS (including private posts) in a predictable pattern using a random 6-digit number. These files are stored in the publicly accessible wp-content/uploads/ directory. As a result, any unauthenticated user can brute-force the filenames to gain access to sensitive data contained within the exported files.
Product
Export All URLs
Fixed in
5.1
What to do
Update Export All URLs to 5.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 26, 2026FormLift for Infusionsoft Web Forms: Missing AuthorizationCVE-2026-4281 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The FormLift for Infusionsoft Web Forms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 7.5.21. This is due to missing capability checks on the connect() and listen_for_tokens() methods of the FormLift_Infusionsoft_Manager class, both of which are hooked to 'plugins_loaded' and execute on every page load. The connect() function generates an OAuth connection password and leaks it in the redirect Location header without verifying the requesting user is authenticated or authorized. The listen_for_tokens() function only validates the temporary password but performs no user authentication before calling update_option() to save attacker-controlled OAuth tokens and app domain. This makes it possible for unauthenticated attackers to hijack the site's Infusionsoft connection by first triggering the OAuth flow to obtain the temporary password, then using that password to set arbitrary OAuth tokens and app domain via update_option(), effectively redirecting the plugin's API communication to an attacker-controlled server.
Product
FormLift for Infusionsoft Web Forms
Affected
up to 7.5.21
What to do
Affects up to 7.5.21. Update FormLift for Infusionsoft Web Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2026PPWP: Missing AuthorizationCVE-2026-32562 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WP Folio Team PPWP password-protect-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPWP: from n/a through <= 1.9.15.
Product
PPWP
Affected
up to 1.9.15
What to do
Affects up to 1.9.15. Update PPWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Restrict Content: Missing AuthorizationCVE-2026-32546 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through <= 3.2.22.
Product
Restrict Content
Affected
up to 3.2.22
What to do
Affects up to 3.2.22. Update Restrict Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Premmerce Redirect Manager: Missing AuthorizationCVE-2026-32541 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Premmerce Premmerce Redirect Manager premmerce-redirect-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Redirect Manager: from n/a through <= 1.0.12.
Product
Premmerce Redirect Manager
Affected
up to 1.0.12
What to do
Affects up to 1.0.12. Update Premmerce Redirect Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: Missing AuthorizationCVE-2026-32527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CRM Perks WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-insightly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.5.
Product
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Miraculous: Missing AuthorizationCVE-2026-32515 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous: from n/a through < 2.1.2.
Product
Miraculous
What to do
Update Miraculous to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Petitioner: Missing AuthorizationCVE-2026-32514 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Anton Voytenko Petitioner petitioner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Petitioner: from n/a through <= 0.7.3.
Product
Petitioner
Affected
up to 0.7.3
What to do
Affects up to 0.7.3. Update Petitioner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WP Configurator Pro: Missing AuthorizationCVE-2026-32501 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in wp-configurator WP Configurator Pro wp-configurator-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Configurator Pro: from n/a through <= 3.7.9.
Product
WP Configurator Pro
Affected
up to 3.7.9
What to do
Affects up to 3.7.9. Update WP Configurator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026RegistrationMagic: Missing AuthorizationCVE-2026-32498 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
Product
RegistrationMagic
Affected
up to 6.0.7.6
What to do
Affects up to 6.0.7.6. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WP Terms Popup: Missing AuthorizationCVE-2026-32495 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Link Software LLC WP Terms Popup wp-terms-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Terms Popup: from n/a through <= 2.10.0.
Product
WP Terms Popup
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update WP Terms Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026B Blocks: Missing AuthorizationCVE-2026-32489 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.
Product
B Blocks
What to do
Update B Blocks to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WP User Frontend: Missing AuthorizationCVE-2026-32485 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.8.
Product
WP User Frontend
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Contact Form Email: Missing AuthorizationCVE-2026-32483 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.63.
Product
Contact Form Email
Affected
up to 1.3.63
What to do
Affects up to 1.3.63. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Comments Import & Export: Missing AuthorizationCVE-2026-32441 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.
Product
Comments Import & Export
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Product Rearrange for WooCommerce: Missing AuthorizationCVE-2026-31921 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.
Product
Product Rearrange for WooCommerce
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Product Rearrange for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WPCafe: Missing AuthorizationCVE-2026-27071 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.
Product
WPCafe
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Jobica Core: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27049 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.
Product
Jobica Core
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Jobica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026StoreCustomizer: Missing AuthorizationCVE-2026-27046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StoreCustomizer: from n/a through <= 2.6.3.
Product
StoreCustomizer
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update StoreCustomizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026ViaBill – WooCommerce: Missing AuthorizationCVE-2026-25469 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ViaBill for WooCommerce ViaBill – WooCommerce viabill-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ViaBill – WooCommerce: from n/a through <= 1.1.53.
Product
ViaBill – WooCommerce
Affected
up to 1.1.53
What to do
Affects up to 1.1.53. Update ViaBill – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026avalex: Missing AuthorizationCVE-2026-25462 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in avalex avalex avalex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects avalex: from n/a through <= 3.1.3.
Product
avalex
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update avalex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Ave Core: Missing AuthorizationCVE-2026-25460 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ave Core: from n/a through <= 2.9.1.
Product
Ave Core
Affected
up to 2.9.1
What to do
Affects up to 2.9.1. Update Ave Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Automated FedEx live/manual rates with shipping labels: Missing AuthorizationCVE-2026-25456 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automated FedEx live/manual rates with shipping labels: from n/a through <= 5.1.9.
Product
Automated FedEx live/manual rates with shipping labels
Affected
up to 5.1.9
What to do
Affects up to 5.1.9. Update Automated FedEx live/manual rates with shipping labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Product Slider for WooCommerce: Missing AuthorizationCVE-2026-25455 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.61.
Product
Product Slider for WooCommerce
Affected
up to 1.13.61
What to do
Affects up to 1.13.61. Update Product Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026The League: Missing AuthorizationCVE-2026-25454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through <= 4.4.1.
Product
The League
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update The League to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026GZSEO: Missing AuthorizationCVE-2026-25437 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in سید محمدامین هاشمی GZSEO gzseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GZSEO: from n/a through <= 2.0.14.
Product
GZSEO
Affected
up to 2.0.14
What to do
Affects up to 2.0.14. Update GZSEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: Missing AuthorizationCVE-2026-25430 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.2.2.
Product
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Tutor LMS Pro: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25406 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.
Product
Tutor LMS Pro
Affected
up to 3.9.4
What to do
Affects up to 3.9.4. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WPCargo Track & Trace: Missing AuthorizationCVE-2026-25401 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
Product
WPCargo Track & Trace
Affected
up to 8.0.2
What to do
Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Vertex Addons for Elementor: Missing AuthorizationCVE-2026-25398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.
Product
Vertex Addons for Elementor
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Vertex Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Commerce Coinbase For WooCommerce: Missing AuthorizationCVE-2026-25396 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.
Product
Commerce Coinbase For WooCommerce
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Commerce Coinbase For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026New User Approve: Missing AuthorizationCVE-2026-25390 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.3.
Product
New User Approve
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Kargo Takip: Missing AuthorizationCVE-2026-25365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.
Product
Kargo Takip
What to do
Update Kargo Takip to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Ultimate Membership Pro: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25357 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro allows Authentication Abuse.This issue affects Ultimate Membership Pro: from n/a through <= 13.7.
Product
Ultimate Membership Pro
Affected
up to 13.7
What to do
Affects up to 13.7. Update Ultimate Membership Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Five Star Restaurant Reservations: Missing AuthorizationCVE-2026-25327 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.9.
Product
Five Star Restaurant Reservations
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-25317 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.9.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026PublishPress Authors: Missing AuthorizationCVE-2026-25309 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through <= 4.10.1.
Product
PublishPress Authors
Affected
up to 4.10.1
What to do
Affects up to 4.10.1. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Contest Gallery: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25035 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.
Product
Contest Gallery
Affected
up to 28.1.2.2
What to do
Affects up to 28.1.2.2. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026KiviCare: Missing AuthorizationCVE-2026-25034 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.16.
Product
KiviCare
Affected
up to 3.6.16
What to do
Affects up to 3.6.16. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Team: Missing AuthorizationCVE-2026-25026 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.11.
Product
Team
Affected
up to 5.0.11
What to do
Affects up to 5.0.11. Update Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Education Zone: Missing AuthorizationCVE-2026-25009 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8.
Product
Education Zone
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Education Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.