Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,720 results · page 172 of 815
Mar 25, 2026Buisson: Deserialization of Untrusted DataCVE-2026-27084 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.
- Product
- Buisson
- Affected
- up to 1.1.11
- What to do
- Affects up to 1.1.11. Update Buisson to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Work & Travel Company: Deserialization of Untrusted DataCVE-2026-27083 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
- Product
- Work & Travel Company
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Work & Travel Company to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Love Story: Deserialization of Untrusted DataCVE-2026-27082 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
- Product
- Love Story
- Affected
- up to 1.3.12
- What to do
- Affects up to 1.3.12. Update Love Story to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Rosebud: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27081 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Rosebud rosebud allows PHP Local File Inclusion.This issue affects Rosebud: from n/a through <= 1.4.
- Product
- Rosebud
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Rosebud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Deston: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27080 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Deston deston allows PHP Local File Inclusion.This issue affects Deston: from n/a through <= 1.0.
- Product
- Deston
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Deston to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Amfissa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27079 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Amfissa amfissa allows PHP Local File Inclusion.This issue affects Amfissa: from n/a through <= 1.1.
- Product
- Amfissa
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Amfissa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Emaurri: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27078 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Emaurri emaurri allows PHP Local File Inclusion.This issue affects Emaurri: from n/a through <= 1.0.1.
- Product
- Emaurri
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Emaurri to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026MultiOffice: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27077 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes MultiOffice multioffice allows PHP Local File Inclusion.This issue affects MultiOffice: from n/a through <= 1.2.
- Product
- MultiOffice
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update MultiOffice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026LuxeDrive: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27076 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes LuxeDrive luxedrive allows PHP Local File Inclusion.This issue affects LuxeDrive: from n/a through <= 1.0.
- Product
- LuxeDrive
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update LuxeDrive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Belfort: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27075 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Belfort belfort allows PHP Local File Inclusion.This issue affects Belfort: from n/a through <= 1.0.
- Product
- Belfort
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Belfort to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Addi – Cuotas que se adaptan a ti: Use of Hard-coded CredentialsCVE-2026-27073 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Use of Hard-coded Credentials vulnerability in Addi Addi – Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi – Cuotas que se adaptan a ti: from n/a through <= 2.0.4.
- Product
- Addi – Cuotas que se adaptan a ti
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Addi – Cuotas que se adaptan a ti to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WPCafe: Missing AuthorizationCVE-2026-27071 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.
- Product
- WPCafe
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Penci Soledad Data Migrator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27054 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Soledad Data Migrator penci-data-migrator allows Reflected XSS.This issue affects Penci Soledad Data Migrator: from n/a through <= 1.3.1.
- Product
- Penci Soledad Data Migrator
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Penci Soledad Data Migrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Golo: Incorrect Privilege AssignmentCVE-2026-27051 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0.
- Product
- Golo
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Golo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Jobica Core: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27049 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.
- Product
- Jobica Core
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Jobica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026The Aisle Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27048 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle Core theaisle-core allows PHP Local File Inclusion.This issue affects The Aisle Core: from n/a through <= 2.0.5.
- Product
- The Aisle Core
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update The Aisle Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Curly Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27047 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly Core curly-core allows PHP Local File Inclusion.This issue affects Curly Core: from n/a through <= 2.1.6.
- Product
- Curly Core
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update Curly Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026StoreCustomizer: Missing AuthorizationCVE-2026-27046 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StoreCustomizer: from n/a through <= 2.6.3.
- Product
- StoreCustomizer
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update StoreCustomizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WooCommerce Infinite Scroll: Deserialization of Untrusted DataCVE-2026-27045 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2.
- Product
- WooCommerce Infinite Scroll
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update WooCommerce Infinite Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Total Poll Lite: Improper Control of Generation of Code ('Code Injection')CVE-2026-27044 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through <= 4.12.0.
- Product
- Total Poll Lite
- Affected
- up to 4.12.0
- What to do
- Affects up to 4.12.0. Update Total Poll Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WZone: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-27040 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AA-Team WZone woozone allows Path Traversal.This issue affects WZone: from n/a through <= 14.0.31.
- Product
- WZone
- Affected
- up to 14.0.31
- What to do
- Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WZone: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27039 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This issue affects WZone: from n/a through <= 14.0.31.
- Product
- WZone
- Affected
- up to 14.0.31
- What to do
- Affects up to 14.0.31. Update WZone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026ViaBill – WooCommerce: Missing AuthorizationCVE-2026-25469 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in ViaBill for WooCommerce ViaBill – WooCommerce viabill-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ViaBill – WooCommerce: from n/a through <= 1.1.53.
- Product
- ViaBill – WooCommerce
- Affected
- up to 1.1.53
- What to do
- Affects up to 1.1.53. Update ViaBill – WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026CP Multi View Event Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25465 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Stored XSS.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.36.
- Product
- CP Multi View Event Calendar
- Affected
- up to 1.4.36
- What to do
- Affects up to 1.4.36. Update CP Multi View Event Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Jannah: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25464 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.4.
- Product
- Jannah
- Affected
- up to 7.6.4
- What to do
- Affects up to 7.6.4. Update Jannah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026avalex: Missing AuthorizationCVE-2026-25462 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in avalex avalex avalex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects avalex: from n/a through <= 3.1.3.
- Product
- avalex
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update avalex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Listeo Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25461 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through <= 2.0.21.
- Product
- Listeo Core
- Affected
- up to 2.0.21
- What to do
- Affects up to 2.0.21. Update Listeo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Ave Core: Missing AuthorizationCVE-2026-25460 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Missing Authorization vulnerability in LiquidThemes Ave Core ave-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ave Core: from n/a through <= 2.9.1.
- Product
- Ave Core
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update Ave Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Moments: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25458 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Moments moments allows PHP Local File Inclusion.This issue affects Moments: from n/a through <= 2.2.
- Product
- Moments
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Moments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Mixtape: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25457 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Mixtape mixtape allows PHP Local File Inclusion.This issue affects Mixtape: from n/a through <= 2.1.
- Product
- Mixtape
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Mixtape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Automated FedEx live/manual rates with shipping labels: Missing AuthorizationCVE-2026-25456 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automated FedEx live/manual rates with shipping labels: from n/a through <= 5.1.9.
- Product
- Automated FedEx live/manual rates with shipping labels
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Automated FedEx live/manual rates with shipping labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Product Slider for WooCommerce: Missing AuthorizationCVE-2026-25455 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.61.
- Product
- Product Slider for WooCommerce
- Affected
- up to 1.13.61
- What to do
- Affects up to 1.13.61. Update Product Slider for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026The League: Missing AuthorizationCVE-2026-25454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through <= 4.4.1.
- Product
- The League
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update The League to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Remoji: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25452 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDO Remoji remoji allows Stored XSS.This issue affects Remoji: from n/a through <= 2.2.
- Product
- Remoji
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Remoji to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Widget Wrangler: Improper Control of Generation of Code ('Code Injection')CVE-2026-25447 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through <= 2.3.9.
- Product
- Widget Wrangler
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update Widget Wrangler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026GZSEO: Missing AuthorizationCVE-2026-25437 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in سید محمدامین هاشمی GZSEO gzseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GZSEO: from n/a through <= 2.0.14.
- Product
- GZSEO
- Affected
- up to 2.0.14
- What to do
- Affects up to 2.0.14. Update GZSEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Booking calendar, Appointment Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25435 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Stored XSS.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.36
- What to do
- Affects up to 3.2.36. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: Missing AuthorizationCVE-2026-25430 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.2.2.
- Product
- Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Nexa Blocks: Deserialization of Untrusted DataCVE-2026-25429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
- Product
- Nexa Blocks
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Nexa Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026ProfileGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25417 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.
- Product
- ProfileGrid
- Affected
- up to 5.9.8.1
- What to do
- Affects up to 5.9.8.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WPBookit Pro: Incorrect Privilege AssignmentCVE-2026-25414 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Privilege Escalation.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
- Product
- WPBookit Pro
- Affected
- up to 1.6.18
- What to do
- Affects up to 1.6.18. Update WPBookit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WPBookit Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-25413 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Using Malicious Files.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
- Product
- WPBookit Pro
- Affected
- up to 1.6.18
- What to do
- Affects up to 1.6.18. Update WPBookit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Tutor LMS Pro: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25406 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.
- Product
- Tutor LMS Pro
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WPCargo Track & Trace: Missing AuthorizationCVE-2026-25401 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
- Product
- WPCargo Track & Trace
- Affected
- up to 8.0.2
- What to do
- Affects up to 8.0.2. Update WPCargo Track & Trace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Apicona: Deserialization of Untrusted DataCVE-2026-25400 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
- Product
- Apicona
- Affected
- up to 24.1.0
- What to do
- Affects up to 24.1.0. Update Apicona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Vertex Addons for Elementor: Missing AuthorizationCVE-2026-25398 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.
- Product
- Vertex Addons for Elementor
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Vertex Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026File Uploader for WooCommerce: Path Traversal: '.../...//'CVE-2026-25397 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Snowray Software File Uploader for WooCommerce file-uploader-for-woocommerce allows Path Traversal.This issue affects File Uploader for WooCommerce: from n/a through <= 1.0.4.
- Product
- File Uploader for WooCommerce
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update File Uploader for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Commerce Coinbase For WooCommerce: Missing AuthorizationCVE-2026-25396 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in CoderPress Commerce Coinbase For WooCommerce commerce-coinbase-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Commerce Coinbase For WooCommerce: from n/a through <= 1.6.6.
- Product
- Commerce Coinbase For WooCommerce
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Commerce Coinbase For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026New User Approve: Missing AuthorizationCVE-2026-25390 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.3.
- Product
- New User Approve
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026KiviCare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25383 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Reflected XSS.This issue affects KiviCare: from n/a through <= 3.6.16.
- Product
- KiviCare
- Affected
- up to 3.6.16
- What to do
- Affects up to 3.6.16. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.