Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,720 results · page 174 of 815
Mar 25, 2026Education Zone: Missing AuthorizationCVE-2026-25009 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in raratheme Education Zone education-zone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Zone: from n/a through <= 1.3.8.
- Product
- Education Zone
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Education Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026ElementInvader Addons for Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25007 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Blind SQL Injection.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.4.2.
- Product
- ElementInvader Addons for Elementor
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update ElementInvader Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026LearnPress – Sepay Payment: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25002 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in ThimPress LearnPress – Sepay Payment learnpress-sepay-payment allows Authentication Abuse.This issue affects LearnPress – Sepay Payment: from n/a through <= 4.0.0.
- Product
- LearnPress – Sepay Payment
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update LearnPress – Sepay Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Post Snippets: Improper Control of Generation of Code ('Code Injection')CVE-2026-25001 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through <= 4.0.12.
- Product
- Post Snippets
- Affected
- up to 4.0.12
- What to do
- Affects up to 4.0.12. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Advanced WooCommerce Product Sales Reporting: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24993 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.3.
- Product
- Advanced WooCommerce Product Sales Reporting
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Advanced WooCommerce Product Sales Reporting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026SUMO Affiliates Pro: Deserialization of Untrusted DataCVE-2026-24989 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
- Product
- SUMO Affiliates Pro
- What to do
- Update SUMO Affiliates Pro to the newest version.
Mar 25, 2026WP System Log: Missing AuthorizationCVE-2026-24987 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in activity-log.com WP System Log winterlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP System Log: from n/a through <= 1.2.7.
- Product
- WP System Log
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WP System Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026UpSolution Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24983 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through <= 8.41.
- Product
- UpSolution Core
- Affected
- up to 8.41
- What to do
- Affects up to 8.41. Update UpSolution Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Visionary Core: Deserialization of Untrusted DataCVE-2026-24981 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
- Product
- Visionary Core
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Visionary Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Visionary Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24980 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Visionary Core noo-visionary-core allows Reflected XSS.This issue affects Visionary Core: from n/a through <= 1.4.9.
- Product
- Visionary Core
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update Visionary Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Jobica Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24979 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobica Core jobica-core allows Reflected XSS.This issue affects Jobica Core: from n/a through <= 1.4.1.
- Product
- Jobica Core
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Jobica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Jobica Core: Deserialization of Untrusted DataCVE-2026-24978 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.
- Product
- Jobica Core
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Jobica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Organici Library: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24977 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Blind SQL Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
- Product
- Organici Library
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Organici Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Organici Library: Deserialization of Untrusted DataCVE-2026-24976 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
- Product
- Organici Library
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Organici Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Organici Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24975 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Organici Library noo-organici-library allows Reflected XSS.This issue affects Organici Library: from n/a through <= 2.1.2.
- Product
- Organici Library
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Organici Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026CitiLights: Deserialization of Untrusted DataCVE-2026-24974 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.
- Product
- CitiLights
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update CitiLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026CitiLights: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24973 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme CitiLights noo-citilights allows Reflected XSS.This issue affects CitiLights: from n/a through <= 3.7.1.
- Product
- CitiLights
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update CitiLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Elated Listing: Missing AuthorizationCVE-2026-24972 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Elated-Themes Elated Listing eltd-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elated Listing: from n/a through <= 1.4.
- Product
- Elated Listing
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Elated Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Search & Go: Incorrect Privilege AssignmentCVE-2026-24971 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search & Go: from n/a through <= 2.8.
- Product
- Search & Go
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Search & Go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Energox: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-24970 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Energox energox allows Path Traversal.This issue affects Energox: from n/a through <= 1.2.
- Product
- Energox
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Energox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Instant VA: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-24969 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Instant VA instantva allows Path Traversal.This issue affects Instant VA: from n/a through <= 1.0.1.
- Product
- Instant VA
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Instant VA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Xagio SEO: Incorrect Privilege AssignmentCVE-2026-24968 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1.0.30.
- Product
- Xagio SEO
- Affected
- up to 7.1.0.30
- What to do
- Affects up to 7.1.0.30. Update Xagio SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Contest Gallery: Server-Side Request Forgery (SSRF)CVE-2026-24964 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.1.2.1.
- Product
- Contest Gallery
- Affected
- up to 28.1.2.1
- What to do
- Affects up to 28.1.2.1. Update Contest Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Car Dealer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24391 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeMakers Car Dealer cardealer allows Reflected XSS.This issue affects Car Dealer: from n/a through <= 1.6.7.
- Product
- Car Dealer
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Car Dealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026News Magazine X: Missing AuthorizationCVE-2026-24382 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in wproyal News Magazine X news-magazine-x allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Magazine X: from n/a through <= 1.2.50.
- Product
- News Magazine X
- Affected
- up to 1.2.50
- What to do
- Affects up to 1.2.50. Update News Magazine X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026EventPrime: Deserialization of Untrusted DataCVE-2026-24378 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
- Product
- EventPrime
- Affected
- up to 4.2.8.0
- What to do
- Affects up to 4.2.8.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WPVulnerability: Missing AuthorizationCVE-2026-24376 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Javier Casares WPVulnerability wpvulnerability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPVulnerability: from n/a through <= 4.2.1.
- Product
- WPVulnerability
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update WPVulnerability to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026RegistrationMagic: Incorrect Privilege AssignmentCVE-2026-24373 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Incorrect Privilege Assignment vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Privilege Escalation.This issue affects RegistrationMagic: from n/a through <= 6.0.7.1.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.1
- What to do
- Affects up to 6.0.7.1. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Subscriptions for WooCommerce: Authentication Bypass by SpoofingCVE-2026-24372 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass by Spoofing vulnerability in WP Swings Subscriptions for WooCommerce subscriptions-for-woocommerce allows Input Data Manipulation.This issue affects Subscriptions for WooCommerce: from n/a through <= 1.8.10.
- Product
- Subscriptions for WooCommerce
- Affected
- up to 1.8.10
- What to do
- Affects up to 1.8.10. Update Subscriptions for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026The Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24370 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0.
- Product
- The Grid
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026The Grid: Missing AuthorizationCVE-2026-24369 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
- Product
- The Grid
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WP User Frontend: Missing AuthorizationCVE-2026-24364 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.2.5.
- Product
- WP User Frontend
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update WP User Frontend to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WP Cost Estimation & Payment Forms Builder: Missing AuthorizationCVE-2026-24363 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0.
- Product
- WP Cost Estimation & Payment Forms Builder
- What to do
- Update WP Cost Estimation & Payment Forms Builder to the newest version.
Mar 25, 2026Ultimate Post Kit: Missing AuthorizationCVE-2026-24362 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Missing Authorization vulnerability in bdthemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through <= 4.0.21.
- Product
- Ultimate Post Kit
- Affected
- up to 4.0.21
- What to do
- Affects up to 4.0.21. Update Ultimate Post Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Dokan: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-24359 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Dokan, Inc. Dokan dokan-lite allows Authentication Abuse.This issue affects Dokan: from n/a through <= 4.2.4.
- Product
- Dokan
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Gyan Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-23979 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softwebmedia Gyan Elements gyan-elements allows Reflected XSS.This issue affects Gyan Elements: from n/a through <= 2.2.1.
- Product
- Gyan Elements
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Gyan Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Helpdesk Support Ticket System for WooCommerce: Missing AuthorizationCVE-2026-23977 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.2.
- Product
- Helpdesk Support Ticket System for WooCommerce
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Helpdesk Support Ticket System for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Golo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-23973 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects Golo: from n/a through < 1.7.5.
- Product
- Golo
- What to do
- Update Golo to the newest version.
Mar 25, 2026Booking and Rental Manager: Missing AuthorizationCVE-2026-23972 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.
- Product
- Booking and Rental Manager
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WoodMart: Deserialization of Untrusted DataCVE-2026-23971 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.
- Product
- WoodMart
- Affected
- up to 8.3.8
- What to do
- Affects up to 8.3.8. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026WP Telegram Widget and Join Link: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-23807 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Reflected XSS.This issue affects WP Telegram Widget and Join Link: from n/a through <= 2.2.13.
- Product
- WP Telegram Widget and Join Link
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update WP Telegram Widget and Join Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Jobs for: Missing AuthorizationCVE-2026-23806 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jobs for WordPress: from n/a through <= 2.8.
- Product
- Jobs for
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Jobs for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Legacy Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22524 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Legacy Admin legacy-admin allows Reflected XSS.This issue affects Legacy Admin: from n/a through <= 9.5.
- Product
- Legacy Admin
- Affected
- up to 9.5
- What to do
- Affects up to 9.5. Update Legacy Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Ultra WordPress Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22523 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra WordPress Admin ultra-admin allows Reflected XSS.This issue affects Ultra WordPress Admin: from n/a through <= 11.7.
- Product
- Ultra WordPress Admin
- Affected
- up to 11.7
- What to do
- Affects up to 11.7. Update Ultra WordPress Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Handmade Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22520 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-framework allows Reflected XSS.This issue affects Handmade Framework: from n/a through <= 3.9.
- Product
- Handmade Framework
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update Handmade Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Wizor's: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22516 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wizor's wizors-investments allows PHP Local File Inclusion.This issue affects Wizor's: from n/a through <= 2.12.
- Product
- Wizor's
- Affected
- up to 2.12
- What to do
- Affects up to 2.12. Update Wizor's to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026VegaDays: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22515 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes VegaDays vegadays allows PHP Local File Inclusion.This issue affects VegaDays: from n/a through <= 1.2.0.
- Product
- VegaDays
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update VegaDays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Unica: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22514 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Unica unica allows PHP Local File Inclusion.This issue affects Unica: from n/a through <= 1.4.1.
- Product
- Unica
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Unica to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Triompher: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22513 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Triompher triompher allows PHP Local File Inclusion.This issue affects Triompher: from n/a through <= 1.1.0.
- Product
- Triompher
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Triompher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Roisin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22512 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Roisin roisin allows PHP Local File Inclusion.This issue affects Roisin: from n/a through <= 1.2.1.
- Product
- Roisin
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Roisin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.