Vulnerability database

3,866 results · page 18 of 78

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.CVE-2026-65545 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

  Affected

  up to 3.6.8

  What to do

  Affects up to 3.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.CVE-2026-65544 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.

  Affected

  up to 7.14.5

  What to do

  Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.CVE-2026-65542 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.

  Affected

  up to 7.14.5

  What to do

  Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.CVE-2026-65541 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.CVE-2026-65523 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.CVE-2026-65520 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

  Affected

  up to 6.2.0

  What to do

  Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.CVE-2026-65517 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.CVE-2026-65515 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.

  Affected

  up to 2.35.0

  What to do

  Affects up to 2.35.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65513 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.

  Affected

  up to 1.6.12.10

  What to do

  Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.CVE-2026-65509 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

  Affected

  up to 7.5.1

  What to do

  Affects up to 7.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65508 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

  Affected

  up to 1.6.12.10

  What to do

  Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.CVE-2026-65507 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.

  Affected

  up to 1.5.6

  What to do

  Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.CVE-2026-65504 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

  Affected

  up to 3.3.0

  What to do

  Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.CVE-2026-65502 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.

  Affected

  up to 8.7.13

  What to do

  Affects up to 8.7.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.CVE-2026-61982 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.

  Affected

  up to 1.8.6

  What to do

  Affects up to 1.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.CVE-2026-61964 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

  Affected

  up to 5.2.9

  What to do

  Affects up to 5.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.CVE-2026-61963 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.

  Affected

  up to 3.38

  What to do

  Affects up to 3.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.CVE-2026-61961 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.

  Affected

  up to 4.5.6

  What to do

  Affects up to 4.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.CVE-2026-32548 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

  Affected

  up to 4.6.2

  What to do

  Affects up to 4.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.CVE-2026-32469 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.

  Affected

  up to 7.6.0

  What to do

  Affects up to 7.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.CVE-2026-28180 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.

  Affected

  up to 8.9.0

  What to do

  Affects up to 8.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.CVE-2026-28172 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.CVE-2026-28169 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.

  Affected

  up to 2.52.0

  What to do

  Affects up to 2.52.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.CVE-2026-28143 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

  Affected

  up to 1.56.0

  What to do

  Affects up to 1.56.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.CVE-2026-28141 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.

  Affected

  up to 4.2.3

  What to do

  Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.CVE-2026-28140 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

  Affected

  up to 3.6.4.1

  What to do

  Affects up to 3.6.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.CVE-2026-28139 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.

  Affected

  up to 4.14.4

  What to do

  Affects up to 4.14.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.CVE-2026-28082 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.

  Affected

  up to 3.8.13.1

  What to do

  Affects up to 3.8.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.CVE-2026-28005 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

  Affected

  up to 1.5.19

  What to do

  Affects up to 1.5.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.CVE-2026-25403 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

  Affected

  up to 3.0.5

  What to do

  Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Aug 6, 2026Accelerate: Unauthorized modification of dataCVE-2025-9266 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin.

  Product

  Accelerate

  Affected

  up to 1.5.3

  What to do

  Affects up to 1.5.3. Update Accelerate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordthemes.trac.wordpress.orgwordfence.com

• Aug 6, 2026Stripe Payment Forms by WP Full Pay: Does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actionsCVE-2026-16734 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation.

  Product

  Stripe Payment Forms by WP Full Pay

  Fixed in

  8.5.2

  What to do

  Update Stripe Payment Forms by WP Full Pay to 8.5.2 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 6, 2026Drag and Drop Multiple File Upload for WooCommerce: Does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routineCVE-2026-16054 · WordPress plugins & themes · reported by WPScanCritical 9.1

  The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

  Product

  Drag and Drop Multiple File Upload for WooCommerce

  Fixed in

  1.1.8

  What to do

  Update Drag and Drop Multiple File Upload for WooCommerce to 1.1.8 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 5, 2026wiseCampaign – WooCommerce Conversions Made Easy: Unauthorized modification and disclosure of dataCVE-2026-7529 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.

  Product

  wiseCampaign – WooCommerce Conversions Made Easy

  Affected

  up to 1.1.16

  What to do

  Affects up to 1.1.16. Update wiseCampaign – WooCommerce Conversions Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Udimi Tools: Unauthorized modification of dataCVE-2026-7456 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's six configuration options — including the API key, connected Udimi user email, and tracking-script payload — effectively disconnecting the site from the configured Udimi account. The companion `ajax_connect()` handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.

  Product

  Udimi Tools

  Affected

  up to 3.2

  What to do

  Affects up to 3.2. Update Udimi Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Layouts for WPBakery: Unauthorized actionsCVE-2026-7726 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync` in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (`https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`) and to write the JSON-decoded responses verbatim into the site's `wp_options` table via `set_transient()` — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.

  Product

  Layouts for WPBakery

  Affected

  up to 1.1.3

  What to do

  Affects up to 1.1.3. Update Layouts for WPBakery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026MailChimp Forms by MailMunch: Unauthorized modification of dataCVE-2026-7520 · WordPress plugins & themes · reported by WordfenceHigh 8.1

  The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMunch account by submitting attacker-supplied credentials. Once relinked, all subscriber data captured by the plugin's forms is delivered to the attacker, and the forms/landing pages rendered on the site are pulled from the attacker's MailMunch account.

  Product

  MailChimp Forms by MailMunch

  Affected

  up to 3.2.7

  What to do

  Affects up to 3.2.7. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Xpro Addons: Unauthorized creation of dataCVE-2026-7105 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published posts of the `xpro_content` custom post type with attacker-controlled titles. The created posts are publicly queryable on the front-end, enabling content injection, SEO spam, and database pollution.

  Product

  Xpro Addons

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Xpro Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026WPFormify – Stripe Payments with Form and Checkout: Unauthorized modification and deletion of Stripe payment credentialsCVE-2026-6627 · WordPress plugins & themes · reported by WordfenceHigh 8.2

  The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hook fires on `admin-post.php` which is accessible without authentication. This makes it possible for unauthenticated attackers to overwrite the site's Stripe API credentials with attacker-controlled values (redirecting payments to the attacker's Stripe account) or disconnect the Stripe integration entirely by deleting the stored credentials.

  Product

  WPFormify – Stripe Payments with Form and Checkout

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update WPFormify – Stripe Payments with Form and Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Material Dashboard: Unauthorized access and modification of dataCVE-2026-6079 · WordPress plugins & themes · reported by WordfenceHigh 7.3

  The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_target_task_manager() function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all scheduled tasks (potentially exposing PII), execute arbitrary tasks, and delete any task via the public_amd_ajax_handler AJAX action.

  Product

  Material Dashboard

  Affected

  up to 1.4.10

  What to do

  Affects up to 1.4.10. Update Material Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Multi Uploader for Gravity Forms: Unauthorized arbitrary media deletionCVE-2026-5581 · WordPress plugins & themes · reported by WordfenceCritical 9.1

  The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object. This makes it possible for unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction.

  Product

  Multi Uploader for Gravity Forms

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update Multi Uploader for Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Easy Post Submission: Unauthorized modification of dataCVE-2026-4431 · WordPress plugins & themes · reported by WordfenceCritical 9.1

  The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. This is due to the `rbsm_submit_post` AJAX action being registered for unauthenticated users via `wp_ajax_nopriv_rbsm_submit_post` without any authorization checks when a `postId` parameter is supplied. This makes it possible for unauthenticated attackers to modify the title, content, excerpt, categories, and tags of arbitrary posts, as well as change the post status to draft (effectively unpublishing them) via the 'postId' parameter.

  Product

  Easy Post Submission

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update Easy Post Submission to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026Passster: Does not perform a post-status check before returning post content from an unauthenticated REST endpointCVE-2026-16602 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.

  Product

  Passster

  Fixed in

  4.3.6

  What to do

  Update Passster to 4.3.6 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 5, 2026Cost Calculator Builder: Unauthorized access of sensitive dataCVE-2026-7753 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.

  Product

  Cost Calculator Builder

  Affected

  up to 3.6.17

  What to do

  Affects up to 3.6.17. Update Cost Calculator Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 5, 2026VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the publCVE-2026-15918 · WordPress plugins & themes · reported by WordfenceHigh 7.5

  VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query without proper validation or sanitization. Because this value is placed directly into the query, an attacker who is not logged in can inject arbitrary SQL through a normal booking page and read data from the site's database — including sensitive information such as WordPress user credentials. No authentication or special privileges are required

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 4, 2026Easy Integration for Dropbox: Does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated usersCVE-2026-15958 · WordPress plugins & themes · reported by WPScanCritical 9.3

  The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

  Product

  Easy Integration for Dropbox

  Fixed in

  2.2.0

  What to do

  Update Easy Integration for Dropbox to 2.2.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 4, 2026MonsterInsights: Does not correctly validate the signature on one of its unauthenticated AJAX actions:CVE-2026-11366 · WordPress plugins & themes · reported by WPScanLow 3.7

  The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers forge a valid signature and overwrite a MonsterInsights WordPress plugin before 11.1.0 configuration value, disrupting the MonsterInsights WordPress plugin before 11.1.0's server-side analytics in Manual GA4 mode.

  Product

  MonsterInsights

  Fixed in

  11.1.0

  What to do

  Update MonsterInsights to 11.1.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 4, 2026EmbedPress: Does not validate user-supplied URLs before making server-side requests through unauthenticated endpointsCVE-2026-10526 · WordPress plugins & themes · reported by WPScanMedium 5.8

  The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation does not cover (a blind Server-Side Request Forgery).

  Product

  EmbedPress

  Fixed in

  4.6.1

  What to do

  Update EmbedPress to 4.6.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Aug 3, 2026Personal QR Message: Does not restrict the file types that can be uploaded through an unauthenticated handlerCVE-2026-16250 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution.

  Product

  Personal QR Message

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Personal QR Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.com

• Aug 3, 2026Simple Membership: Does not sanitise a subscriber name value received from an unauthenticated payment approval requestCVE-2026-15931 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to store arbitrary JavaScript that executes in an administrator's session.

  Product

  Simple Membership

  Fixed in

  4.7.8

  What to do

  Update Simple Membership to 4.7.8 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.