Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,041 results · page 17 of 21
Apr 1, 2026Order Notification for WooCommerce: Overrides WooCommerce's permission checks to grant full access to all unauthenticated requestsCVE-2025-15484 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
- Product
- Order Notification for WooCommerce
- Fixed in
- 3.6.3
- What to do
- Update Order Notification for WooCommerce to 3.6.3 or newer.
Mar 30, 2026Everest Forms Pro: Remote Code ExecutionCVE-2026-3300 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.
- Product
- Everest Forms Pro
- Affected
- up to 1.9.12
- What to do
- Affects up to 1.9.12. Update Everest Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 30, 2026Contact Form by Supsystic: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE)CVE-2026-4257 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's `registerUndefinedFilterCallback()` method to register arbitrary PHP callbacks.
- Product
- Contact Form by Supsystic
- Affected
- up to 1.7.36
- What to do
- Affects up to 1.7.36. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026Nelio Software Nelio AB Testing nelio-ab-testing: Improper Control of Generation of Code ('Code Injection')CVE-2026-32573 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.7.
- Product
- Nelio Software Nelio AB Testing nelio-ab-testing
- What to do
- Update Nelio Software Nelio AB Testing nelio-ab-testing to the newest version.
Mar 25, 2026PublishPress PublishPress Revisions revisionary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32539 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through <= 3.7.23.
- Product
- PublishPress PublishPress Revisions revisionary
- What to do
- Update PublishPress PublishPress Revisions revisionary to the newest version.
Mar 25, 2026halfdata Green Downloads halfdata-paypal-green-downloads: Unrestricted Upload of File with Dangerous TypeCVE-2026-32536 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through <= 2.08.
- Product
- halfdata Green Downloads halfdata-paypal-green-downloads
- What to do
- Update halfdata Green Downloads halfdata-paypal-green-downloads to the newest version.
Mar 25, 2026jetmonsters JetFormBuilder jetformbuilder: Improper Control of Generation of Code ('Code Injection')CVE-2026-32525 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1.
- Product
- jetmonsters JetFormBuilder jetformbuilder
- What to do
- Update jetmonsters JetFormBuilder jetformbuilder to the newest version.
Mar 25, 2026Jordy Meow Photo Engine wplr-sync: Unrestricted Upload of File with Dangerous TypeCVE-2026-32524 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through <= 6.4.9.
- Product
- Jordy Meow Photo Engine wplr-sync
- What to do
- Update Jordy Meow Photo Engine wplr-sync to the newest version.
Mar 25, 2026denishua WPJAM Basic wpjam-basic: Unrestricted Upload of File with Dangerous TypeCVE-2026-32523 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows Using Malicious Files.This issue affects WPJAM Basic: from n/a through <= 6.9.2.
- Product
- denishua WPJAM Basic wpjam-basic
- What to do
- Update denishua WPJAM Basic wpjam-basic to the newest version.
Mar 25, 2026Andrew Munro / AffiliateWP RewardsWP rewardswp: Incorrect Privilege AssignmentCVE-2026-32520 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n/a through <= 1.0.4.
- Product
- Andrew Munro / AffiliateWP RewardsWP rewardswp
- What to do
- Update Andrew Munro / AffiliateWP RewardsWP rewardswp to the newest version.
Mar 25, 2026Bit Apps Bit SMTP bit-smtp: Incorrect Privilege AssignmentCVE-2026-32519 · WordPress plugins & themes · reported by PatchstackCritical 9
Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2.
- Product
- Bit Apps Bit SMTP bit-smtp
- What to do
- Update Bit Apps Bit SMTP bit-smtp to the newest version.
Mar 25, 2026Edge-Themes Pelicula pelicula-video-production-and-movie-theme: Deserialization of Untrusted DataCVE-2026-32512 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.
- Product
- Edge-Themes Pelicula pelicula-video-production-and-movie-theme
- What to do
- Update Edge-Themes Pelicula pelicula-video-production-and-movie-theme to the newest version.
Mar 25, 2026Select-Themes Borgholm borgholm-marketing-agency-theme: Deserialization of Untrusted DataCVE-2026-32502 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.
- Product
- Select-Themes Borgholm borgholm-marketing-agency-theme
- What to do
- Update Select-Themes Borgholm borgholm-marketing-agency-theme to the newest version.
Mar 25, 2026QuantumCloud ChatBot chatbot: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32499 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.This issue affects ChatBot: from n/a through <= 7.7.9.
- Product
- QuantumCloud ChatBot chatbot
- What to do
- Update QuantumCloud ChatBot chatbot to the newest version.
Mar 25, 2026deothemes Ona ona: Unrestricted Upload of File with Dangerous TypeCVE-2026-32482 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in deothemes Ona ona allows Upload a Web Shell to a Web Server.This issue affects Ona: from n/a through < 1.24.
- Product
- deothemes Ona ona
- What to do
- Update deothemes Ona ona to the newest version.
Mar 25, 2026Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-31920 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Blind SQL Injection.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.
- Product
- Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce
- What to do
- Update Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce to the newest version.
Mar 25, 2026magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation: Deserialization of Untrusted DataCVE-2026-27095 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.
- Product
- magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation
- What to do
- Update magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation to the newest version.
Mar 25, 2026ThemeREX Buisson buisson: Deserialization of Untrusted DataCVE-2026-27084 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.
- Product
- ThemeREX Buisson buisson
- What to do
- Update ThemeREX Buisson buisson to the newest version.
Mar 25, 2026ThemeREX Work & Travel Company work-travel-company: Deserialization of Untrusted DataCVE-2026-27083 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
- Product
- ThemeREX Work & Travel Company work-travel-company
- What to do
- Update ThemeREX Work & Travel Company work-travel-company to the newest version.
Mar 25, 2026ThemeREX Love Story lovestory: Deserialization of Untrusted DataCVE-2026-27082 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
- Product
- ThemeREX Love Story lovestory
- What to do
- Update ThemeREX Love Story lovestory to the newest version.
Mar 25, 2026Arraytics WPCafe wp-cafe: Missing AuthorizationCVE-2026-27071 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.
- Product
- Arraytics WPCafe wp-cafe
- What to do
- Update Arraytics WPCafe wp-cafe to the newest version.
Mar 25, 2026uxper Golo golo: Incorrect Privilege AssignmentCVE-2026-27051 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0.
- Product
- uxper Golo golo
- What to do
- Update uxper Golo golo to the newest version.
Mar 25, 2026NooTheme Jobica Core jobica-core: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27049 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.
- Product
- NooTheme Jobica Core jobica-core
- What to do
- Update NooTheme Jobica Core jobica-core to the newest version.
Mar 25, 2026TotalSuite Total Poll Lite totalpoll-lite: Improper Control of Generation of Code ('Code Injection')CVE-2026-27044 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through <= 4.12.0.
- Product
- TotalSuite Total Poll Lite totalpoll-lite
- What to do
- Update TotalSuite Total Poll Lite totalpoll-lite to the newest version.
Mar 25, 2026Jonathan Daggerhart Widget Wrangler widget-wrangler: Improper Control of Generation of Code ('Code Injection')CVE-2026-25447 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through <= 2.3.9.
- Product
- Jonathan Daggerhart Widget Wrangler widget-wrangler
- What to do
- Update Jonathan Daggerhart Widget Wrangler widget-wrangler to the newest version.
Mar 25, 2026wpdive Nexa Blocks nexa-blocks: Deserialization of Untrusted DataCVE-2026-25429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
- Product
- wpdive Nexa Blocks nexa-blocks
- What to do
- Update wpdive Nexa Blocks nexa-blocks to the newest version.
Mar 25, 2026iqonicdesign WPBookit Pro wpbookit-pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-25413 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Using Malicious Files.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
- Product
- iqonicdesign WPBookit Pro wpbookit-pro
- What to do
- Update iqonicdesign WPBookit Pro wpbookit-pro to the newest version.
Mar 25, 2026eyecix Addon Jobsearch Chat addon-jobsearch-chat: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25377 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows SQL Injection.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.
- Product
- eyecix Addon Jobsearch Chat addon-jobsearch-chat
- What to do
- Update eyecix Addon Jobsearch Chat addon-jobsearch-chat to the newest version.
Mar 25, 2026King-Theme Lumise Product Designer lumise: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25371 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.
- Product
- King-Theme Lumise Product Designer lumise
- What to do
- Update King-Theme Lumise Product Designer lumise to the newest version.
Mar 25, 2026Themeisle Woody ad snippets insert-php: Improper Control of Generation of Code ('Code Injection')CVE-2026-25366 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.
- Product
- Themeisle Woody ad snippets insert-php
- What to do
- Update Themeisle Woody ad snippets insert-php to the newest version.
Mar 25, 2026GalleryCreator SimpLy Gallery simply-gallery-block: Improper Validation of Specified Quantity in InputCVE-2026-25345 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Validation of Specified Quantity in Input vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.
- Product
- GalleryCreator SimpLy Gallery simply-gallery-block
- What to do
- Update GalleryCreator SimpLy Gallery simply-gallery-block to the newest version.
Mar 25, 2026NooTheme Jobmonster noo-jobmonster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25340 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.
- Product
- NooTheme Jobmonster noo-jobmonster
- What to do
- Update NooTheme Jobmonster noo-jobmonster to the newest version.
Mar 25, 2026Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25035 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.
- Product
- Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery
- What to do
- Update Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery to the newest version.
Mar 25, 2026park_of_ideas Ricky ricky: Deserialization of Untrusted DataCVE-2026-25032 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
- Product
- park_of_ideas Ricky ricky
- What to do
- Update park_of_ideas Ricky ricky to the newest version.
Mar 25, 2026park_of_ideas Tasty Daily tastydaily: Deserialization of Untrusted DataCVE-2026-25031 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.
- Product
- park_of_ideas Tasty Daily tastydaily
- What to do
- Update park_of_ideas Tasty Daily tastydaily to the newest version.
Mar 25, 2026park_of_ideas Goldish goldish: Deserialization of Untrusted DataCVE-2026-25030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.
- Product
- park_of_ideas Goldish goldish
- What to do
- Update park_of_ideas Goldish goldish to the newest version.
Mar 25, 2026park_of_ideas KIDZ kidz: Deserialization of Untrusted DataCVE-2026-25029 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
- Product
- park_of_ideas KIDZ kidz
- What to do
- Update park_of_ideas KIDZ kidz to the newest version.
Mar 25, 2026WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24993 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.3.
- Product
- WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics
- What to do
- Update WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics to the newest version.
Mar 25, 2026FantasticPlugins SUMO Affiliates Pro affs: Deserialization of Untrusted DataCVE-2026-24989 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
- Product
- FantasticPlugins SUMO Affiliates Pro affs
- What to do
- Update FantasticPlugins SUMO Affiliates Pro affs to the newest version.
Mar 25, 2026Elated-Themes Search & Go searchgo: Incorrect Privilege AssignmentCVE-2026-24971 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search & Go: from n/a through <= 2.8.
- Product
- Elated-Themes Search & Go searchgo
- What to do
- Update Elated-Themes Search & Go searchgo to the newest version.
Mar 25, 2026Xagio SEO Xagio SEO xagio-seo: Incorrect Privilege AssignmentCVE-2026-24968 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1.0.30.
- Product
- Xagio SEO Xagio SEO xagio-seo
- What to do
- Update Xagio SEO Xagio SEO xagio-seo to the newest version.
Mar 25, 2026Metagauss EventPrime eventprime-event-calendar-management: Deserialization of Untrusted DataCVE-2026-24378 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
- Product
- Metagauss EventPrime eventprime-event-calendar-management
- What to do
- Update Metagauss EventPrime eventprime-event-calendar-management to the newest version.
Mar 25, 2026AncoraThemes Beelove beelove: Deserialization of Untrusted DataCVE-2026-22507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6.
- Product
- AncoraThemes Beelove beelove
- What to do
- Update AncoraThemes Beelove beelove to the newest version.
Mar 25, 2026axiomthemes m2 | Construction and Tools Store m2-ce: Deserialization of Untrusted DataCVE-2026-22500 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.
- Product
- axiomthemes m2 | Construction and Tools Store m2-ce
- What to do
- Update axiomthemes m2 | Construction and Tools Store m2-ce to the newest version.
Mar 25, 2026pebas Lisfinity Core lisfinity-core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-22484 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pebas Lisfinity Core lisfinity-core allows SQL Injection.This issue affects Lisfinity Core: from n/a through <= 1.5.0.
- Product
- pebas Lisfinity Core lisfinity-core
- What to do
- Update pebas Lisfinity Core lisfinity-core to the newest version.
Mar 24, 2026WP DSGVO Tools (GDPR): Unauthorized account destructionCVE-2026-4283 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the `super-unsubscribe` AJAX action accepting a `process_now` parameter from unauthenticated users, which bypasses the intended email-confirmation flow and immediately triggers irreversible account anonymization. This makes it possible for unauthenticated attackers to permanently destroy any non-administrator user account (password randomized, username/email overwritten, roles stripped, comments anonymized, sensitive usermeta wiped) by submitting the victim's email address with `process_now=1`. The nonce required for the request is publicly available on any page containing the `[unsubscribe_form]` shortcode.
- Product
- WP DSGVO Tools (GDPR)
- Affected
- up to 3.1.38
- What to do
- Affects up to 3.1.38. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 23, 2026Woocommerce Custom Product Addons Pro: Remote Code ExecutionCVE-2026-4001 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).
- Product
- Woocommerce Custom Product Addons Pro
- Affected
- up to 5.4.1
- What to do
- Affects up to 5.4.1. Update Woocommerce Custom Product Addons Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2026Kali Forms: Remote Code ExecutionCVE-2026-3584 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.
- Product
- Kali Forms
- Affected
- up to 2.4.9
- What to do
- Affects up to 2.4.9. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2026Aimogen Pro: Arbitrary Function Call that can lead to privilege escalationCVE-2026-4038 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'aiomatic_call_ai_function_realtime' function in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions such as 'update_option' to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Aimogen Pro
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update Aimogen Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2026Syarif Mobile App Editor mobile-app-editor: Unrestricted Upload of File with Dangerous TypeCVE-2026-27067 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through <= 1.3.1.
- Product
- Syarif Mobile App Editor mobile-app-editor
- What to do
- Update Syarif Mobile App Editor mobile-app-editor to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.