Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,720 results · page 181 of 815
Mar 13, 2026Envo Extra: Missing AuthorizationCVE-2026-32386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.13.
- Product
- Envo Extra
- Affected
- up to 1.9.13
- What to do
- Affects up to 1.9.13. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026RegistrationMagic: Missing AuthorizationCVE-2026-32385 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.6
- What to do
- Affects up to 6.0.7.6. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WpBookingly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32384 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magepeopleteam WpBookingly service-booking-manager allows PHP Local File Inclusion.This issue affects WpBookingly: from n/a through <= 1.2.9.
- Product
- WpBookingly
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update WpBookingly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Ridhi: Missing AuthorizationCVE-2026-32383 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Ridhi ridhi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ridhi: from n/a through <= 1.1.2.
- Product
- Ridhi
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ridhi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Digital Download: Missing AuthorizationCVE-2026-32382 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Digital Download digital-download allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Digital Download: from n/a through <= 1.1.4.
- Product
- Digital Download
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Digital Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026App Landing Page: Missing AuthorizationCVE-2026-32381 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through <= 1.2.2.
- Product
- App Landing Page
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update App Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Numinous: Missing AuthorizationCVE-2026-32380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Numinous numinous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Numinous: from n/a through <= 1.3.0.
- Product
- Numinous
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Numinous to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Rara Academic: Missing AuthorizationCVE-2026-32379 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Rara Academic rara-academic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rara Academic: from n/a through <= 1.2.2.
- Product
- Rara Academic
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Rara Academic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Book Landing Page: Missing AuthorizationCVE-2026-32378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Book Landing Page book-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Landing Page: from n/a through <= 1.2.7.
- Product
- Book Landing Page
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Book Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Pranayama Yoga: Missing AuthorizationCVE-2026-32377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Pranayama Yoga pranayama-yoga allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pranayama Yoga: from n/a through <= 1.2.2.
- Product
- Pranayama Yoga
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Pranayama Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Kalon: Missing AuthorizationCVE-2026-32376 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Kalon kalon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalon: from n/a through <= 1.2.9.
- Product
- Kalon
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Kalon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Travel Diaries: Missing AuthorizationCVE-2026-32375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Travel Diaries travel-diaries allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Diaries: from n/a through <= 1.2.4.
- Product
- Travel Diaries
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Travel Diaries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026The Minimal: Missing AuthorizationCVE-2026-32374 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme The Minimal the-minimal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Minimal: from n/a through <= 1.2.9.
- Product
- The Minimal
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update The Minimal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026SMS Alert Order Notifications: Missing AuthorizationCVE-2026-32373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.9.0.
- Product
- SMS Alert Order Notifications
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-32372 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Retrieve Embedded Sensitive Data.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 3.2.4.
- Product
- ShopBuilder – Elementor WooCommerce Builder Addons
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Elegant Pink: Missing AuthorizationCVE-2026-32371 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Elegant Pink elegant-pink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elegant Pink: from n/a through <= 1.3.3.
- Product
- Elegant Pink
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Elegant Pink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Influencer: Missing AuthorizationCVE-2026-32370 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Influencer influencer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Influencer: from n/a through <= 1.1.7.
- Product
- Influencer
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Influencer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Medilink-Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32369 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Medilink-Core medilink-core allows PHP Local File Inclusion.This issue affects Medilink-Core: from n/a through < 2.0.7.
- Product
- Medilink-Core
- What to do
- Update Medilink-Core to the newest version.
Mar 13, 2026Geo to Lat: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32368 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through <= 1.0.19.
- Product
- Geo to Lat
- Affected
- up to 1.0.19
- What to do
- Affects up to 1.0.19. Update Geo to Lat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Modal Dialog: Improper Control of Generation of Code ('Code Injection')CVE-2026-32367 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue affects Modal Dialog: from n/a through <= 3.5.16.
- Product
- Modal Dialog
- Affected
- up to 3.5.16
- What to do
- Affects up to 3.5.16. Update Modal Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Collapsing Categories: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32366 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through <= 3.0.9.
- Product
- Collapsing Categories
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update Collapsing Categories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Collapsing Archives: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32365 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through <= 3.0.7.
- Product
- Collapsing Archives
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Collapsing Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Turbo Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32364 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in redqteam Turbo Manager turbo-manager allows PHP Local File Inclusion.This issue affects Turbo Manager: from n/a through < 4.0.8.
- Product
- Turbo Manager
- What to do
- Update Turbo Manager to the newest version.
Mar 13, 2026WPLifeCycle: Missing AuthorizationCVE-2026-32363 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Funlus Oy WPLifeCycle free-php-version-info allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLifeCycle: from n/a through <= 3.3.1.
- Product
- WPLifeCycle
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update WPLifeCycle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WP Sessions Time Monitoring Full Automatic: Missing AuthorizationCVE-2026-32362 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through <= 1.1.3.
- Product
- WP Sessions Time Monitoring Full Automatic
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update WP Sessions Time Monitoring Full Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Editorial Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows DOM-Based XSS.This issue affects Editorial Calendar: from n/a through <= 3.9.0.
- Product
- Editorial Calendar
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Rich Showcase for Google Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32360 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richplugins Rich Showcase for Google Reviews widget-google-reviews allows Stored XSS.This issue affects Rich Showcase for Google Reviews: from n/a through <= 6.9.4.3.
- Product
- Rich Showcase for Google Reviews
- Affected
- up to 6.9.4.3
- What to do
- Affects up to 6.9.4.3. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Icon List Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32359 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.2.3.
- Product
- Icon List Block
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Icon List Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Booking Calendar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32358 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through <= 10.14.15.
- Product
- Booking Calendar
- Affected
- up to 10.14.15
- What to do
- Affects up to 10.14.15. Update Booking Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Simple Blog Card: Server-Side Request Forgery (SSRF)CVE-2026-32357 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37.
- Product
- Simple Blog Card
- Affected
- up to 2.37
- What to do
- Affects up to 2.37. Update Simple Blog Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Robo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32356 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Robo Gallery robo-gallery allows DOM-Based XSS.This issue affects Robo Gallery: from n/a through <= 5.1.2.
- Product
- Robo Gallery
- Affected
- up to 5.1.2
- What to do
- Affects up to 5.1.2. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026JetEngine: Deserialization of Untrusted DataCVE-2026-32355 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This issue affects JetEngine: from n/a through < 3.8.4.1.
- Product
- JetEngine
- What to do
- Update JetEngine to the newest version.
Mar 13, 2026WpEvently: Insertion of Sensitive Information Into Sent DataCVE-2026-32354 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through < 5.1.9.
- Product
- WpEvently
- What to do
- Update WpEvently to the newest version.
Mar 13, 2026MailerPress: Server-Side Request Forgery (SSRF)CVE-2026-32353 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in MailerPress Team MailerPress mailerpress allows Server Side Request Forgery.This issue affects MailerPress: from n/a through <= 1.4.2.
- Product
- MailerPress
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update MailerPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32352 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows DOM-Based XSS.This issue affects Elementor Website Builder: from n/a through <= 3.35.5.
- Product
- Elementor Website Builder
- Affected
- up to 3.35.5
- What to do
- Affects up to 3.35.5. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026PowerPress Podcasting: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32351 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blubrry PowerPress Podcasting powerpress allows Stored XSS.This issue affects PowerPress Podcasting: from n/a through <= 11.15.13.
- Product
- PowerPress Podcasting
- Affected
- up to 11.15.13
- What to do
- Affects up to 11.15.13. Update PowerPress Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Chocolate House: Missing AuthorizationCVE-2026-32350 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpradiant Chocolate House chocolate-house allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chocolate House: from n/a through <= 1.1.5.
- Product
- Chocolate House
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Chocolate House to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Embed PDF Viewer: Server-Side Request Forgery (SSRF)CVE-2026-32349 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer allows Server Side Request Forgery.This issue affects Embed PDF Viewer: from n/a through <= 2.4.7.
- Product
- Embed PDF Viewer
- Affected
- up to 2.4.7
- What to do
- Affects up to 2.4.7. Update Embed PDF Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026MAS Videos: Missing AuthorizationCVE-2026-32348 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in MadrasThemes MAS Videos masvideos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAS Videos: from n/a through <= 1.3.2.
- Product
- MAS Videos
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update MAS Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Restaurant and Cafe: Missing AuthorizationCVE-2026-32347 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Restaurant and Cafe restaurant-and-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant and Cafe: from n/a through <= 1.2.5.
- Product
- Restaurant and Cafe
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Restaurant and Cafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Travel Agency: Missing AuthorizationCVE-2026-32346 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Travel Agency travel-agency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Agency: from n/a through <= 1.5.5.
- Product
- Travel Agency
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Travel Agency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Perfect Portfolio: Missing AuthorizationCVE-2026-32345 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Perfect Portfolio: from n/a through <= 1.2.4.
- Product
- Perfect Portfolio
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Perfect Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Corpiva: Cross-Site Request Forgery (CSRF)CVE-2026-32344 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in desertthemes Corpiva corpiva allows Cross Site Request Forgery.This issue affects Corpiva: from n/a through <= 1.0.96.
- Product
- Corpiva
- Affected
- up to 1.0.96
- What to do
- Affects up to 1.0.96. Update Corpiva to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Easy Table of Contents: Cross-Site Request Forgery (CSRF)CVE-2026-32343 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Magazine3 Easy Table of Contents easy-table-of-contents allows Cross Site Request Forgery.This issue affects Easy Table of Contents: from n/a through <= 2.0.80.
- Product
- Easy Table of Contents
- Affected
- up to 2.0.80
- What to do
- Affects up to 2.0.80. Update Easy Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Quiz Maker: Cross-Site Request Forgery (CSRF)CVE-2026-32342 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.1.2.
- Product
- Quiz Maker
- Affected
- up to 6.7.1.2
- What to do
- Affects up to 6.7.1.2. Update Quiz Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Benevolent: Missing AuthorizationCVE-2026-32341 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Benevolent benevolent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Benevolent: from n/a through <= 1.3.9.
- Product
- Benevolent
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Benevolent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Business One Page: Missing AuthorizationCVE-2026-32340 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Business One Page business-one-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business One Page: from n/a through <= 1.3.2.
- Product
- Business One Page
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Business One Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Bakes And Cakes: Missing AuthorizationCVE-2026-32339 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Bakes And Cakes bakes-and-cakes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bakes And Cakes: from n/a through <= 1.2.9.
- Product
- Bakes And Cakes
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Bakes And Cakes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Construction Landing Page: Missing AuthorizationCVE-2026-32338 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Construction Landing Page construction-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Construction Landing Page: from n/a through <= 1.4.1.
- Product
- Construction Landing Page
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Construction Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Preschool and Kindergarten: Missing AuthorizationCVE-2026-32337 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Preschool and Kindergarten preschool-and-kindergarten allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Preschool and Kindergarten: from n/a through <= 1.2.5.
- Product
- Preschool and Kindergarten
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Preschool and Kindergarten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.