Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

40,720 results · page 173 of 815

Mar 25, 2026IdealAuto: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25382 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes IdealAuto idealauto allows PHP Local File Inclusion.This issue affects IdealAuto: from n/a through < 3.8.6.
Product
IdealAuto
What to do
Update IdealAuto to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026LoveDate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25381 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes LoveDate lovedate allows PHP Local File Inclusion.This issue affects LoveDate: from n/a through < 3.8.6.
Product
LoveDate
What to do
Update LoveDate to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Feedy: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25380 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Feedy feedy allows PHP Local File Inclusion.This issue affects Feedy: from n/a through < 2.1.5.
Product
Feedy
What to do
Update Feedy to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026StreamVid: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25379 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes StreamVid streamvid allows PHP Local File Inclusion.This issue affects StreamVid: from n/a through < 6.8.6.
Product
StreamVid
What to do
Update StreamVid to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Addon Jobsearch Chat: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25377 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows SQL Injection.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.
Product
Addon Jobsearch Chat
Affected
up to 3.0
What to do
Affects up to 3.0. Update Addon Jobsearch Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Addon Jobsearch Chat: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows Reflected XSS.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.
Product
Addon Jobsearch Chat
Affected
up to 3.0
What to do
Affects up to 3.0. Update Addon Jobsearch Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Vayvo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25373 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProgressionStudios Vayvo vayvo-progression allows Reflected XSS.This issue affects Vayvo: from n/a through < 6.8.
Product
Vayvo
What to do
Update Vayvo to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Lumise Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25371 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.
Product
Lumise Product Designer
What to do
Update Lumise Product Designer to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Woody ad snippets: Improper Control of Generation of Code ('Code Injection')CVE-2026-25366 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.
Product
Woody ad snippets
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Kargo Takip: Missing AuthorizationCVE-2026-25365 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through < 0.2.4.
Product
Kargo Takip
What to do
Update Kargo Takip to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WpEvently: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25361 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress allows Reflected XSS.This issue affects WpEvently: from n/a through <= 5.1.4.
Product
WpEvently
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Vex: Deserialization of Untrusted DataCVE-2026-25360 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
Product
Vex
What to do
Update Vex to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Pendulum: Deserialization of Untrusted DataCVE-2026-25359 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.
Product
Pendulum
What to do
Update Pendulum to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Meloo: Deserialization of Untrusted DataCVE-2026-25358 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
Product
Meloo
What to do
Update Meloo to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Ultimate Membership Pro: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25357 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Authentication Bypass Using an Alternate Path or Channel vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro allows Authentication Abuse.This issue affects Ultimate Membership Pro: from n/a through <= 13.7.
Product
Ultimate Membership Pro
Affected
up to 13.7
What to do
Affects up to 13.7. Update Ultimate Membership Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Yobazar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25356 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through < 1.6.7.
Product
Yobazar
What to do
Update Yobazar to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Sanzo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25355 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through < 2.4.3.
Product
Sanzo
What to do
Update Sanzo to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Reebox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25354 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through < 1.4.8.
Product
Reebox
What to do
Update Reebox to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Nooni: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25353 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through < 1.5.1.
Product
Nooni
What to do
Update Nooni to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026MyDecor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through < 1.5.9.
Product
MyDecor
What to do
Update MyDecor to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026MyMedi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyMedi mymedi allows Reflected XSS.This issue affects MyMedi: from n/a through < 1.7.7.
Product
MyMedi
What to do
Update MyMedi to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Miti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25350 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through < 1.5.3.
Product
Miti
What to do
Update Miti to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Loobek: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25349 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Loobek loobek allows Reflected XSS.This issue affects Loobek: from n/a through < 1.5.2.
Product
Loobek
What to do
Update Loobek to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WP REST Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25347 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Acato WP REST Cache wp-rest-cache allows Stored XSS.This issue affects WP REST Cache: from n/a through <= 2026.1.0.
Product
WP REST Cache
Affected
up to 2026.1.0
What to do
Affects up to 2026.1.0. Update WP REST Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026FAQ Builder AYS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAQ Builder AYS: from n/a through <= 1.8.2.
Product
FAQ Builder AYS
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update FAQ Builder AYS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026SimpLy Gallery: Improper Validation of Specified Quantity in InputCVE-2026-25345 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Validation of Specified Quantity in Input vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.
Product
SimpLy Gallery
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update SimpLy Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Review Schema: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25344 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.
Product
Review Schema
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update Review Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Boutique: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25342 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kutethemes Boutique kute-boutique allows Reflected XSS.This issue affects Boutique: from n/a through < 2.4.6.
Product
Boutique
What to do
Update Boutique to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026RSFirewall!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25341 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through <= 1.1.45.
Product
RSFirewall!
Affected
up to 1.1.45
What to do
Affects up to 1.1.45. Update RSFirewall! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Jobmonster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25340 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.
Product
Jobmonster
What to do
Update Jobmonster to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Contact Form by WPForms: Insertion of Sensitive Information Into Sent DataCVE-2026-25339 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by WPForms: from n/a through <= 1.9.8.7.
Product
Contact Form by WPForms
Affected
up to 1.9.8.7
What to do
Affects up to 1.9.8.7. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Salon Booking System Pro: Incorrect Privilege AssignmentCVE-2026-25334 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in wordpresschef Salon Booking System Pro salon-booking-plugin-pro allows Privilege Escalation.This issue affects Salon Booking System Pro: from n/a through < 10.30.12.
Product
Salon Booking System Pro
What to do
Update Salon Booking System Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Product File Upload for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-25328 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Product File Upload for WooCommerce products-file-upload-for-woocommerce allows Path Traversal.This issue affects Product File Upload for WooCommerce: from n/a through <= 2.2.4.
Product
Product File Upload for WooCommerce
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Product File Upload for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Five Star Restaurant Reservations: Missing AuthorizationCVE-2026-25327 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.9.
Product
Five Star Restaurant Reservations
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update Five Star Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-25317 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.9.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026PublishPress Authors: Missing AuthorizationCVE-2026-25309 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in PublishPress PublishPress Authors publishpress-authors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Authors: from n/a through <= 4.10.1.
Product
PublishPress Authors
Affected
up to 4.10.1
What to do
Affects up to 4.10.1. Update PublishPress Authors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25306 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4.
Product
XStore Core
Affected
up to 5.6.4
What to do
Affects up to 5.6.4. Update XStore Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Jaroti: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25304 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Jaroti jaroti allows Reflected XSS.This issue affects Jaroti: from n/a through < 1.4.8.
Product
Jaroti
What to do
Update Jaroti to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Contest Gallery: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25035 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.
Product
Contest Gallery
Affected
up to 28.1.2.2
What to do
Affects up to 28.1.2.2. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026KiviCare: Missing AuthorizationCVE-2026-25034 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.16.
Product
KiviCare
Affected
up to 3.6.16
What to do
Affects up to 3.6.16. Update KiviCare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Motta Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25033 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uixthemes Motta Addons motta-addons allows Reflected XSS.This issue affects Motta Addons: from n/a through < 1.6.1.
Product
Motta Addons
What to do
Update Motta Addons to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Ricky: Deserialization of Untrusted DataCVE-2026-25032 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
Product
Ricky
What to do
Update Ricky to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Tasty Daily: Deserialization of Untrusted DataCVE-2026-25031 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.
Product
Tasty Daily
What to do
Update Tasty Daily to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Goldish: Deserialization of Untrusted DataCVE-2026-25030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.
Product
Goldish
What to do
Update Goldish to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026KIDZ: Deserialization of Untrusted DataCVE-2026-25029 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
Product
KIDZ
Affected
up to 5.24
What to do
Affects up to 5.24. Update KIDZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Team: Missing AuthorizationCVE-2026-25026 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.11.
Product
Team
Affected
up to 5.0.11
What to do
Affects up to 5.0.11. Update Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026VikRestaurants: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25025 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Reflected XSS.This issue affects VikRestaurants: from n/a through <= 1.5.2.
Product
VikRestaurants
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update VikRestaurants to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026NaturaLife Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25018 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan NaturaLife Extensions naturalife-extensions allows Reflected XSS.This issue affects NaturaLife Extensions: from n/a through <= 2.1.
Product
NaturaLife Extensions
Affected
up to 2.1
What to do
Affects up to 2.1. Update NaturaLife Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026NaturaLife Extensions: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25017 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan NaturaLife Extensions naturalife-extensions allows PHP Local File Inclusion.This issue affects NaturaLife Extensions: from n/a through <= 2.1.
Product
NaturaLife Extensions
Affected
up to 2.1
What to do
Affects up to 2.1. Update NaturaLife Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Phox Hosting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25013 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WHMCSdes Phox Hosting phox-host allows Reflected XSS.This issue affects Phox Hosting: from n/a through <= 2.0.8.
Product
Phox Hosting
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update Phox Hosting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.