Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

40,720 results · page 177 of 815

Mar 21, 2026UiPress lite | Effortless custom dashboards, admin themes and pages: Unauthorized modification of dataCVE-2026-2294 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uip_save_global_settings' function in all versions up to, and including, 3.5.09. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings.
Product
UiPress lite | Effortless custom dashboards, admin themes and pages
Affected
up to 3.5.09
What to do
Affects up to 3.5.09. Update UiPress lite | Effortless custom dashboards, admin themes and pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2026Post Affiliate Pro: Server-Side Request ForgeryCVE-2026-2290 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to initiate arbitrary outbound requests from the application and read the returned response content. Successful exploitation was confirmed by receiving and observing response data from an external Collaborator endpoint.
Product
Post Affiliate Pro
Affected
up to 1.28.0
What to do
Affects up to 1.28.0. Update Post Affiliate Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026myLinksDump: SQL InjectionCVE-2026-2279 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
myLinksDump
Affected
up to 1.6
What to do
Affects up to 1.6. Update myLinksDump to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026rexCrawler: Reflected Cross-Site ScriptingCVE-2026-2277 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
rexCrawler
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update rexCrawler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Weaver Show Posts: Stored Cross-Site ScriptingCVE-2026-2121 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to, and including, 1.8.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multisite installations where Administrators do not have the unfiltered_html capability.
Product
Weaver Show Posts
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Weaver Show Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Company Posts for LinkedIn: Missing AuthorizationCVE-2026-1935 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Company Posts for LinkedIn plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.0. This is due to a missing capability check on the `linkedin_company_post_reset_handler()` function hooked to `admin_post_reset_linkedin_company_post`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete LinkedIn post data stored in the site's options table.
Product
Company Posts for LinkedIn
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Company Posts for LinkedIn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026FuseDesk: Stored Cross-Site ScriptingCVE-2026-1914 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusedesk_newcase shortcode in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping on the 'emailtext' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FuseDesk
Affected
up to 6.8
What to do
Affects up to 6.8. Update FuseDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Twitter Feeds: Stored Cross-Site ScriptingCVE-2026-1911 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tweet_title' parameter in the 'TwitterFeeds' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Twitter Feeds
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Twitter Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Integration with Hubspot Forms: Stored Cross-Site ScriptingCVE-2026-1908 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Integration with Hubspot Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hubspotform' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Integration with Hubspot Forms
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Integration with Hubspot Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Any Post Slider: Stored Cross-Site ScriptingCVE-2026-1899 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Any Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aps_slider shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on the 'post_type' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Any Post Slider
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Any Post Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Simple Football Scoreboard: Stored Cross-Site ScriptingCVE-2026-1891 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Football Scoreboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ytmr_fb_scoreboard' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Football Scoreboard
Affected
up to 1.0
What to do
Affects up to 1.0. Update Simple Football Scoreboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Outgrow: Stored Cross-Site ScriptingCVE-2026-1889 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Outgrow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the 'outgrow' shortcode in all versions up to, and including, 2.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Outgrow
Affected
up to 2.1
What to do
Affects up to 2.1. Update Outgrow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Go Night Pro | WordPress Dark Mode: Stored Cross-Site ScriptingCVE-2026-1886 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Go Night Pro | WordPress Dark Mode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'go-night-pro-shortcode' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on the user-supplied 'margin' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Go Night Pro | WordPress Dark Mode
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Go Night Pro | WordPress Dark Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Post Flagger: Stored Cross-Site ScriptingCVE-2026-1854 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Flagger
Affected
up to 1.1
What to do
Affects up to 1.1. Update Post Flagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026iVysilani Shortcode: Stored Cross-Site ScriptingCVE-2026-1851 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
iVysilani Shortcode
Affected
up to 3.0
What to do
Affects up to 3.0. Update iVysilani Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026WP NG Weather: Stored Cross-Site ScriptingCVE-2026-1822 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP NG Weather plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ng-weather' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP NG Weather
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WP NG Weather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Tour & Activity Operator Plugin for TourCMS: Stored Cross-Site ScriptingCVE-2026-1806 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcms_doc_link shortcode in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tour & Activity Operator Plugin for TourCMS
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Tour & Activity Operator Plugin for TourCMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Fonts Manager | Custom Fonts: Time-based SQL InjectionCVE-2026-1800 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Fonts Manager | Custom Fonts
Affected
up to 1.2
What to do
Affects up to 1.2. Update Fonts Manager | Custom Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Performance Monitor: Server-Side Request ForgeryCVE-2026-1648 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.6. This is due to insufficient validation of the 'url' parameter in the '/wp-json/performance-monitor/v1/curl_data' REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations, including internal services, via the Gopher protocol and other dangerous protocols. This can be exploited to achieve Remote Code Execution by chaining with services like Redis.
Product
Performance Monitor
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Performance Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 21, 2026Comment Genius: Reflected Cross-Site ScriptingCVE-2026-1647 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Comment Genius plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Comment Genius
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Comment Genius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Schema Shortcode: Stored Cross-Site ScriptingCVE-2026-1575 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `itemscope` shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Schema Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2026login_register: Cross-Site Request Forgery to Stored Cross-Site ScriptingCVE-2026-1503 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The login_register plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.2.0. This is due to missing nonce validation on the settings page and insufficient input sanitization and output escaping on the 'login_register_login_post' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
login_register
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update login_register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026PQ Addons – Creative Elementor Widgets: Stored Cross-Site ScriptingCVE-2026-1397 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PQ Addons – Creative Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on the html_tag parameter in the PQ Section Title widget. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PQ Addons – Creative Elementor Widgets
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update PQ Addons – Creative Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Add Google Social Profiles to Knowledge Graph Box: Cross-Site Request ForgeryCVE-2026-1393 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Add Google Social Profiles to Knowledge Graph Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's Knowledge Graph settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Add Google Social Profiles to Knowledge Graph Box
Affected
up to 1.0
What to do
Affects up to 1.0. Update Add Google Social Profiles to Knowledge Graph Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026SR WP Minify HTML: Cross-Site Request ForgeryCVE-2026-1392 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SR WP Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing nonce validation on the sr_minify_html_theme() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
SR WP Minify HTML
Affected
up to 2.1
What to do
Affects up to 2.1. Update SR WP Minify HTML to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Redirect countdown: Cross-Site Request ForgeryCVE-2026-1390 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the `countdown_settings_content()` function. This makes it possible for unauthenticated attackers to update the plugin settings including the countdown timeout, redirect URL, and custom text, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Redirect countdown
Affected
up to 1.0
What to do
Affects up to 1.0. Update Redirect countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026WP Posts Re-order: Cross-Site Request ForgeryCVE-2026-1378 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the `cpt_plugin_options()` function. This makes it possible for unauthenticated attackers to update the plugin settings including capability, autosort, and adminsort settings, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Posts Re-order
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Posts Re-order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026MimeTypes Link Icons: Server-Side Request ForgeryCVE-2026-1313 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when the "Show file size" option is enabled. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via crafted links in post content.
Product
MimeTypes Link Icons
Affected
up to 3.2.20
What to do
Affects up to 3.2.20. Update MimeTypes Link Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Mandatory Field: Stored Cross-Site ScriptingCVE-2026-1278 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Mandatory Field
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Mandatory Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record downloads.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Multi Post Carousel by Category: Stored Cross-Site ScriptingCVE-2026-1275 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on the user-supplied 'slides' parameter in the post_slides_shortcode function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Multi Post Carousel by Category
Affected
up to 1.4
What to do
Affects up to 1.4. Update Multi Post Carousel by Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Group Chat & Video Chat by AtomChat: Unauthorized modification of dataCVE-2026-1253 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' functions in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options, including critical settings such as API keys, authentication keys, and layout configurations.
Product
Group Chat & Video Chat by AtomChat
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Group Chat & Video Chat by AtomChat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Survey: Stored Cross-Site ScriptingCVE-2026-1247 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Survey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Survey
Affected
up to 1.1
What to do
Affects up to 1.1. Update Survey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026WPFAQBlock– FAQ & Accordion Plugin For Gutenberg: Stored Cross-Site ScriptingCVE-2026-1093 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPFAQBlock– FAQ & Accordion Plugin For Gutenberg
Affected
up to 1.1
What to do
Affects up to 1.1. Update WPFAQBlock– FAQ & Accordion Plugin For Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider: Stored Cross-Site ScriptingCVE-2026-0609 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt text in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping in the 'logo-slider' shortcode. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider
Affected
up to 4.9.0
What to do
Affects up to 4.9.0. Update Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026Invelity Product Feeds: Arbitrary file deletionCVE-2025-14037 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. This makes it possible for authenticated administrator-level attackers to delete arbitrary files on the server via specially crafted requests that include path traversal sequences, granted they can trick an admin into clicking a malicious link.
Product
Invelity Product Feeds
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Invelity Product Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2026WP-WebAuthn: Unauthenticated Stored Cross-Site ScriptingCVE-2025-13910 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes logged by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin's log page, provided that the logging option is enabled in the plugin settings.
Product
WP-WebAuthn
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update WP-WebAuthn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 21, 2026The Contact Form, Survey, Quiz & Popup Form Builder – ARForms: Arbitrary shortcode executionCVE-2024-13785 · WordPress plugins & themes · reported by WordfenceMedium 5.6
The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update The Contact Form, Survey, Quiz & Popup Form Builder – ARForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 20, 2026WowOptin: Next-Gen Popup Maker: Server-Side Request ForgeryCVE-2026-4302 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29. This is due to the plugin exposing a publicly accessible REST API endpoint (optn/v1/integration-action) with a permission_callback of __return_true that passes user-supplied URLs directly to wp_remote_get() and wp_remote_post() in the Webhook::add_subscriber() method without any URL validation or restriction. The plugin does not use wp_safe_remote_get/post which provide built-in SSRF protection. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.
Product
WowOptin: Next-Gen Popup Maker
Affected
up to 1.4.29
What to do
Affects up to 1.4.29. Update WowOptin: Next-Gen Popup Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Scoreboard for HTML5 Games Lite: Stored Cross-Site ScriptingCVE-2026-4083 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'scoreboard' shortcode in all versions up to, and including, 1.2. The shortcode function sfhg_shortcode() allows arbitrary HTML attributes to be added to the rendered <iframe> element, with only a small blacklist of four attribute names (same_height_as, onload, onpageshow, onclick) being blocked. While the attribute names are passed through esc_html() and values through esc_attr(), this does not prevent injection of JavaScript event handler attributes like onfocus, onmouseover, onmouseenter, etc., because these attribute names and simple JavaScript payloads contain no characters that would be modified by these escaping functions. The shortcode text is stored in post_content and is only expanded to HTML at render time, after WordPress's kses filtering has already been applied to the raw post content. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Scoreboard for HTML5 Games Lite
Affected
up to 1.2
What to do
Affects up to 1.2. Update Scoreboard for HTML5 Games Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Keep Backup Daily: Stored Cross-Site ScriptingCVE-2026-3577 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (`val` parameter) in the `update_kbd_bkup_alias` AJAX action in all versions up to, and including, 2.1.2. This is due to insufficient input sanitization and output escaping. While `sanitize_text_field()` strips HTML tags on save, it does not encode double quotes. The backup titles are output in HTML attribute contexts without `esc_attr()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via attribute injection that will execute whenever another administrator views the backup list page.
Product
Keep Backup Daily
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026iTracker360: Cross-Site Request Forgery leading to Stored Cross-Site ScriptingCVE-2026-3572 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in all versions up to and including 2.2.0. This is due to missing nonce verification on the settings form submission and insufficient input sanitization combined with missing output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
iTracker360
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update iTracker360 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026RepairBuddy – Repair Shop CRM & Booking: Unauthorized accessCVE-2026-3567 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132. The plugin exposes two AJAX handlers that, when combined, allow any authenticated user to modify admin-level plugin settings. First, the wc_rb_get_fresh_nonce() function (registered via wp_ajax and wp_ajax_nopriv hooks) allows any user to generate a valid WordPress nonce for any arbitrary action name by simply providing the nonce_name parameter, with no capability checks. Second, the wc_rep_shop_settings_submission() function only verifies the nonce (wcrb_main_setting_nonce) but performs no current_user_can() capability check before updating 15+ plugin options via update_option(). This makes it possible for authenticated attackers, with subscriber-level access and above, to modify all plugin configuration settings including business name, email, logo, menu label, GDPR settings, and more by first minting a valid nonce via the wc_rb_get_fresh_nonce endpoint and then calling the settings submission handler.
Product
RepairBuddy – Repair Shop CRM & Booking
Affected
up to 4.1132
What to do
Affects up to 4.1132. Update RepairBuddy – Repair Shop CRM & Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Contact List: Stored Cross-Site ScriptingCVE-2026-3516 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to, and including, 3.0.18. This is due to insufficient input sanitization and output escaping when handling the Google Maps iframe custom field. The saveCustomFields() function in class-contact-list-custom-fields.php uses a regex to extract <iframe> tags from user input but does not validate or sanitize the iframe's attributes, allowing event handlers like 'onload' to be included. The extracted iframe HTML is stored via update_post_meta() and later rendered on the front-end in class-cl-public-card.php without any escaping or wp_kses filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact List
Affected
up to 3.0.18
What to do
Affects up to 3.0.18. Update Contact List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026EmailKit – Email Customizer for WooCommerce & WP: Arbitrary file readCVE-2026-3474 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 1.6.3. This is due to the action() function in the TemplateData class passing user-supplied input from the 'emailkit-editor-template' REST API parameter directly to file_get_contents() without any path validation, sanitization, or restriction to an allowed directory. This makes it possible for authenticated attackers, with Administrator-level access, to read arbitrary files on the server (such as /etc/passwd or wp-config.php) by supplying a traversal path. The file contents are stored as post meta and can subsequently be retrieved via the fetch-data REST API endpoint. Notably, the CheckForm class in the same plugin implements proper path validation using realpath() and directory restriction, demonstrating that the developer was aware of the risk but failed to apply the same protections to the TemplateData endpoint.
Product
EmailKit – Email Customizer for WooCommerce & WP
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update EmailKit – Email Customizer for WooCommerce & WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Injection Guard: Stored Cross-Site ScriptingCVE-2026-3368 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1.2.9. This is due to insufficient input sanitization in the sanitize_ig_data() function which only sanitizes array values but not array keys, combined with missing output escaping in the ig_settings.php template where stored parameter keys are echoed directly into HTML. When a request is made to the site, the plugin captures the query string via $_SERVER['QUERY_STRING'], applies esc_url_raw() (which preserves URL-encoded special characters like %22, %3E, %3C), then passes it to parse_str() which URL-decodes the string, resulting in decoded HTML/JavaScript in the array keys. These keys are stored via update_option('ig_requests_log') and later rendered without esc_html() or esc_attr() on the admin log page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin log page that execute whenever an administrator views the Injection Guard log interface.
Product
Injection Guard
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Injection Guard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Image Alt Text Manager: Stored Cross-Site ScriptingCVE-2026-3350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Alt Text Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.2. This is due to insufficient input sanitization and output escaping when dynamically generating image alt and title attributes using a DOM parser. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Alt Text Manager
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update Image Alt Text Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Keep Backup Daily: Limited Path TraversalCVE-2026-3339 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.
Product
Keep Backup Daily
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Autoptimize: Stored Cross-Site ScriptingCVE-2026-2430 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.
Product
Autoptimize
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 20, 2026Autoptimize: Stored Cross-Site ScriptingCVE-2026-2352 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.
Product
Autoptimize
Affected
up to 3.1.14
What to do
Affects up to 3.1.14. Update Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 20, 2026Kali Forms: Remote Code ExecutionCVE-2026-3584 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Kali Forms
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.