Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

40,720 results · page 182 of 815

Mar 13, 2026Rara Business: Missing AuthorizationCVE-2026-32336 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Rara Business rara-business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rara Business: from n/a through <= 1.3.0.
Product
Rara Business
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Rara Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026The Conference: Missing AuthorizationCVE-2026-32335 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme The Conference the-conference allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Conference: from n/a through <= 1.2.5.
Product
The Conference
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update The Conference to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026JobScout: Missing AuthorizationCVE-2026-32334 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme JobScout jobscout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobScout: from n/a through <= 1.1.7.
Product
JobScout
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update JobScout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Easy Form: Missing AuthorizationCVE-2026-32332 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form: from n/a through <= 2.7.9.
Product
Easy Form
Affected
up to 2.7.9
What to do
Affects up to 2.7.9. Update Easy Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Textmetrics: Missing AuthorizationCVE-2026-32331 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Textmetrics: from n/a through <= 3.6.4.
Product
Textmetrics
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update Textmetrics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Photo Gallery by 10Web: Cross-Site Request Forgery (CSRF)CVE-2026-32330 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Cross Site Request Forgery.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.37.
Product
Photo Gallery by 10Web
Affected
up to 1.8.37
What to do
Affects up to 1.8.37. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Advanced Related Posts: Missing AuthorizationCVE-2026-32329 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Advanced Related Posts advanced-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Related Posts: from n/a through <= 1.9.1.
Product
Advanced Related Posts
Affected
up to 1.9.1
What to do
Affects up to 1.9.1. Update Advanced Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Lemmony: Cross-Site Request Forgery (CSRF)CVE-2026-32328 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in shufflehound Lemmony lemmony allows Cross Site Request Forgery.This issue affects Lemmony: from n/a through < 1.7.1.
Product
Lemmony
What to do
Update Lemmony to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Fox LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-31922 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This issue affects Fox LMS: from n/a through <= 1.0.6.3.
Product
Fox LMS
Affected
up to 1.0.6.3
What to do
Affects up to 1.0.6.3. Update Fox LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Advanced Coupons for WooCommerce Coupons: Missing AuthorizationCVE-2026-31919 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.
Product
Advanced Coupons for WooCommerce Coupons
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update Advanced Coupons for WooCommerce Coupons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026immonex Kickstart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-31918 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in immonex immonex Kickstart immonex-kickstart allows Stored XSS.This issue affects immonex Kickstart: from n/a through <= 1.13.0.
Product
immonex Kickstart
Affected
up to 1.13.0
What to do
Affects up to 1.13.0. Update immonex Kickstart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026WP ERP: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-31917 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through <= 1.16.10.
Product
WP ERP
Affected
up to 1.16.10
What to do
Affects up to 1.16.10. Update WP ERP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Latest Post Shortcode: Missing AuthorizationCVE-2026-31916 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through <= 14.2.1.
Product
Latest Post Shortcode
Affected
up to 14.2.1
What to do
Affects up to 14.2.1. Update Latest Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Flatsome: Missing AuthorizationCVE-2026-31915 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.19.6.
Product
Flatsome
Affected
up to 3.19.6
What to do
Affects up to 3.19.6. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Formidable Forms: A payment integrity bypassCVE-2026-2890 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `verify_intent()` function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services.
Product
Formidable Forms
Affected
up to 6.28
What to do
Affects up to 6.28. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026Formidable Forms: An authorization bypass through user-controlled keyCVE-2026-2888 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.
Product
Formidable Forms
Affected
up to 6.28
What to do
Affects up to 6.28. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026GetGenie: Insecure Direct Object ReferenceCVE-2026-2879 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the `id` parameter in the `create()` method of the `GetGenieChat` REST API endpoint. The method accepts a user-controlled post ID and, when a post with that ID exists, calls `wp_update_post()` without verifying that the current user owns the post or that the post is of the expected `getgenie_chat` type. This makes it possible for authenticated attackers, with Author-level access and above, to overwrite arbitrary posts owned by any user — including Administrators — effectively destroying the original content by changing its `post_type` to `getgenie_chat` and reassigning `post_author` to the attacker.
Product
GetGenie
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update GetGenie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026GetGenie: Insecure Direct Object ReferenceCVE-2026-2257 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key in the `action` function. This makes it possible for authenticated attackers, with Author-level access and above, to update post metadata for arbitrary posts. Combined with a lack of input sanitization, this leads to Stored Cross-Site Scripting when a higher-privileged user (such as an Administrator) views the affected post's "Competitor" tab in the GetGenie sidebar.
Product
GetGenie
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update GetGenie to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifCVE-2026-22216 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sending POST requests to the wpdAddSubscription handler in class.WpdiscuzHelperAjax.php. Attackers can exploit LIKE wildcard characters in the subscription query to match multiple email addresses and generate unwanted notification emails to victim accounts.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026the getFollowsPage() function that: WpDiscuz before 7.6.47 contains a cross-site request forgeryCVE-2026-22215 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by exploiting the missing CSRF protection in the follows page handler.
Product
the getFollowsPage() function that
Fixed in
7.6.47
What to do
Update the getFollowsPage() function that to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML ouCVE-2026-22210 · WordPress plugins & themes · reported by VulnCheckLow 2.1
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026the customCss field that: WpDiscuz before 7.6.47 contains a cross-site scriptingCVE-2026-22209 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like </style><script>alert(1)</script> in the custom CSS setting to execute arbitrary JavaScript in user browsers.
Product
the customCss field that
Fixed in
7.6.47
What to do
Update the customCss field that to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into theCVE-2026-22204 · WordPress plugins & themes · reported by VulnCheckMedium 6.3
wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed through urldecode() and passed to wp_mail() functions, enables header injection to alter email recipients or inject additional headers.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin optCVE-2026-22203 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafCVE-2026-22202 · WordPress plugins & themes · reported by VulnCheckMedium 6.1
wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action URL in image tags or other resources to trigger permanent deletion of comments without user confirmation or POST-based CSRF protection.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026the getIP() function that: WpDiscuz before 7.6.47 contains an IP spoofingCVE-2026-22201 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumvent security controls.
Product
the getIP() function that
Fixed in
7.6.47
What to do
Update the getIP() function that to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries: WpDiscuz before 7.6.47 contains an SQL injectionCVE-2026-22193 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.
Product
the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries
Fixed in
7.6.47
What to do
Update the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026the inline comment preview functionality that: WpDiscuz before 7.6.47 contains a stored cross-site scriptingCVE-2026-22183 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered_html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class.WpdiscuzHelperAjax.php without proper HTML escaping.
Product
the inline comment preview functionality that
Fixed in
7.6.47
What to do
Update the inline comment preview functionality that to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploitingCVE-2026-22182 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and comment_id parameters to flood subscribers with notifications, as the handler lacks nonce verification, authentication checks, and rate limiting.
Fixed in
7.6.47
What to do
Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 13, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Insecure Direct Object ReferenceCVE-2026-1704 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users with the `ssa_manage_appointments` capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.9.29
What to do
Affects up to 1.6.9.29. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 12, 2026Simple Ajax Chat: Stored Cross-Site ScriptingCVE-2026-2987 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Ajax Chat
Affected
up to 20260217
What to do
Affects up to 20260217. Update Simple Ajax Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 12, 2026Reading progressbar: Does not sanitise and escape some of its settingsCVE-2026-2687 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Reading progressbar
Fixed in
1.3.1
What to do
Update Reading progressbar to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Mar 12, 2026Timetics: Does not have authorization in a REST endpointCVE-2025-15473 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.
Product
Timetics
Fixed in
1.0.52
What to do
Update Timetics to 1.0.52 or newer.
Full record and what to do →NVD record wpscan.com
Mar 11, 2026My Sticky Bar: SQL injectionCVE-2026-3657 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database.
Product
My Sticky Bar
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update My Sticky Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026LearnPress – WordPress LMS: Unauthorized email notification triggeringCVE-2026-3226 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger arbitrary email notifications to admins, instructors, and users, enabling email flooding, social engineering, and impersonation of admin decisions regarding instructor requests.
Product
LearnPress – WordPress LMS
Affected
up to 4.3.2.8
What to do
Affects up to 4.3.2.8. Update LearnPress – WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026JetBooking: SQL InjectionCVE-2026-3496 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JetBooking plugin for WordPress is vulnerable to SQL Injection via the 'check_in_date' parameter in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
JetBooking
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update JetBooking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record crocoblock.com wordfence.com
Mar 11, 2026Name Directory: Stored Cross-Site ScriptingCVE-2026-3178 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.30.3 and 1.32.1.
Product
Name Directory
Affected
up to 1.32.1
What to do
Affects up to 1.32.1. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1.CVE-2026-3906 · WordPress plugins & themes · reported by WordfenceMedium 4.3
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.
Affected
up to 6.9.1
What to do
Affects up to 6.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record core.trac.wordpress.org core.trac.wordpress.org
Mar 11, 2026Gravity Forms: Stored Cross-Site ScriptingCVE-2026-3492 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is due to a compound failure involving missing authorization on the `create_from_template` AJAX endpoint (allowing any authenticated user to create forms), insufficient input sanitization (`sanitize_text_field()` preserves single quotes), and missing output escaping when the form title is rendered in the Form Switcher dropdown (`title` attribute constructed without `esc_attr()`, and JavaScript `saferHtml` utility only escapes `&`, `<`, `>` but not quotes). This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary JavaScript that executes when an Administrator searches in the Form Switcher dropdown in the Form Editor.
Product
Gravity Forms
Affected
up to 2.9.28.1
What to do
Affects up to 2.9.28.1. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.gravityforms.com wordfence.com
Mar 11, 2026Checkout Field Editor (Checkout Manager) for WooCommerce: Stored Cross-Site ScriptingCVE-2026-3231 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submitted through the WooCommerce Block Checkout Store API in all versions up to, and including, 2.1.7. This is due to the `prepare_single_field_data()` method in `class-thwcfd-block-order-data.php` first escaping values with `esc_html()` then immediately reversing the escaping with `html_entity_decode()` for radio and checkboxgroup field types, combined with a permissive `wp_kses()` allowlist in `get_allowed_html()` that explicitly permits the `<select>` element with the `onchange` event handler attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via the Store API checkout endpoint that execute when an administrator views the order details page.
Product
Checkout Field Editor (Checkout Manager) for WooCommerce
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Checkout Field Editor (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026ExactMetrics – Google Analytics Dashboard for: Improper Privilege ManagementCVE-2026-1993 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site.
Product
ExactMetrics – Google Analytics Dashboard for
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update ExactMetrics – Google Analytics Dashboard for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026ExactMetrics – Google Analytics Dashboard for: Insecure Direct Object ReferenceCVE-2026-1992 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` parameter that is used instead of the current user's ID to check permissions. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to bypass the `install_plugins` capability check by specifying an administrator's user ID in the `triggered_by` parameter, allowing them to install arbitrary plugins and achieve Remote Code Execution. This vulnerability only affects sites on which administrator has given other user types the permission to view reports and can only be exploited by users of that type.
Product
ExactMetrics – Google Analytics Dashboard for
Affected
up to 9.0.2
What to do
Affects up to 9.0.2. Update ExactMetrics – Google Analytics Dashboard for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026Responsive Contact Form Builder & Lead Generation: Stored Cross-Site ScriptingCVE-2026-1454 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard.
Product
Responsive Contact Form Builder & Lead Generation
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026Modular DS: Monitor, update, and backup multiple websites: Cross-Site Request ForgeryCVE-2026-3903 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth() function. This makes it possible for unauthenticated attackers to disconnect the plugin's OAuth/SSO connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Modular DS: Monitor, update, and backup multiple websites
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Modular DS: Monitor, update, and backup multiple websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 11, 2026Happy Addons for Elementor: Insecure Direct Object ReferenceCVE-2026-2918 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the `ha_condition_update` AJAX action. This is due to the `validate_reqeust()` method using `current_user_can('edit_posts', $template_id)` instead of `current_user_can('edit_post', $template_id)` — failing to perform object-level authorization. Additionally, the `ha_get_current_condition` AJAX action lacks a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to modify the display conditions of any published `ha_library` template. Because the `cond_to_html()` renderer outputs condition values into HTML attributes without proper escaping (using string concatenation instead of `esc_attr()`), an attacker can inject event handler attributes (e.g., `onmouseover`) that execute JavaScript when an administrator views the Template Conditions panel, resulting in Stored Cross-Site Scripting.
Product
Happy Addons for Elementor
Affected
up to 3.21.0
What to do
Affects up to 3.21.0. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026Happy Addons for Elementor: Insecure Direct Object ReferenceCVE-2026-2917 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the `ha_duplicate_thing` admin action handler. This is due to the `can_clone()` method only checking `current_user_can('edit_posts')` (a general capability) without performing object-level authorization such as `current_user_can('edit_post', $post_id)`, and the nonce being tied to the generic action name `ha_duplicate_thing` rather than to a specific post ID. This makes it possible for authenticated attackers, with Contributor-level access and above, to clone any published post, page, or custom post type by obtaining a valid clone nonce from their own posts and changing the `post_id` parameter to target other users' content. The clone operation copies the full post content, all post metadata (including potentially sensitive widget configurations and API tokens), and taxonomies into a new draft owned by the attacker.
Product
Happy Addons for Elementor
Affected
up to 3.21.0
What to do
Affects up to 3.21.0. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Blind SQL InjectionCVE-2026-1708 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the `db_where_conditions` method in the `TD_DB_Model` class failing to prevent the `append_where_sql` parameter from being passed through JSON request bodies, while only checking for its presence in the `$_REQUEST` superglobal. This makes it possible for unauthenticated attackers to append arbitrary SQL commands to queries and extract sensitive information from the database via the `append_where_sql` parameter in JSON payloads granted they have obtained a valid `public_token` that is inadvertently exposed during the booking flow.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.9.27
What to do
Affects up to 1.6.9.27. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026Astra: Stored Cross-Site ScriptingCVE-2026-3534 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-meta` post meta fields in all versions up to, and including, 4.12.3. This is due to insufficient input sanitization on meta registration and missing output escaping in the `astra_get_responsive_background_obj()` function for four CSS-context sub-properties (`background-color`, `background-image`, `overlay-color`, `overlay-gradient`). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Astra
Affected
up to 4.12.3
What to do
Affects up to 4.12.3. Update Astra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Mar 11, 2026WP Maps: Time-based blind SQL InjectionCVE-2026-3222 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. This is due to the plugin's database abstraction layer (`FlipperCode_Model_Base::is_column()`) treating user input wrapped in backticks as column names, bypassing the `esc_sql()` escaping function. Additionally, the `wpgmp_ajax_call` AJAX handler (registered for unauthenticated users via `wp_ajax_nopriv`) allows calling arbitrary class methods including `wpgmp_return_final_capability`, which passes the unsanitized `location_id` GET parameter directly to a database query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Maps
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 11, 2026weForms: Stored Cross-Site ScriptingCVE-2026-2707 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method in `class-abstract-fields.php` receives the WP_REST_Request object as `$args`, bypassing the `weforms_clean()` fallback that sanitizes `$_POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into form entry hidden field values via the REST API that execute when an administrator views the form entries page, where data is rendered using a Vue.js `v-html` directive without escaping.
Product
weForms
Affected
up to 1.6.27
What to do
Affects up to 1.6.27. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.