Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,725 results · page 187 of 815
Mar 5, 2026Quanzo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27989 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Quanzo quanzo allows PHP Local File Inclusion.This issue affects Quanzo: from n/a through <= 1.0.10.
- Product
- Quanzo
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Quanzo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Equadio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27988 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Equadio equadio allows PHP Local File Inclusion.This issue affects Equadio: from n/a through <= 1.1.3.
- Product
- Equadio
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Equadio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026The Qlean: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27987 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX The Qlean the-qlean allows PHP Local File Inclusion.This issue affects The Qlean: from n/a through <= 2.12.
- Product
- The Qlean
- Affected
- up to 2.12
- What to do
- Affects up to 2.12. Update The Qlean to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026OsTende: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27986 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX OsTende ostende allows PHP Local File Inclusion.This issue affects OsTende: from n/a through <= 1.4.3.
- Product
- OsTende
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update OsTende to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Humanum: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27985 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Humanum humanum allows PHP Local File Inclusion.This issue affects Humanum: from n/a through <= 1.1.4.
- Product
- Humanum
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Humanum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Widget Options: Improper Control of Generation of Code ('Code Injection')CVE-2026-27984 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Marketing Fire Widget Options widget-options allows Code Injection.This issue affects Widget Options: from n/a through <= 4.1.3.
- Product
- Widget Options
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update Widget Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026LMS Elementor Pro: Incorrect Privilege AssignmentCVE-2026-27983 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.
- Product
- LMS Elementor Pro
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update LMS Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Wholesale Suite: Incorrect Privilege AssignmentCVE-2026-27541 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through <= 2.2.6.
- Product
- Wholesale Suite
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update Wholesale Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Dentario: Deserialization of Untrusted DataCVE-2026-27439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.
- Product
- Dentario
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Dentario to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Kingler: Deserialization of Untrusted DataCVE-2026-27438 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.
- Product
- Kingler
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Kingler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Tennis Club: Deserialization of Untrusted DataCVE-2026-27437 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.
- Product
- Tennis Club
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Tennis Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Eagle Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27428 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eagle-Themes Eagle Booking eagle-booking allows SQL Injection.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.
- Product
- Eagle Booking
- Affected
- up to 1.3.4.3
- What to do
- Affects up to 1.3.4.3. Update Eagle Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Sweet Date: Deserialization of Untrusted DataCVE-2026-27417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.
- Product
- Sweet Date
- What to do
- Update Sweet Date to the newest version.
Mar 5, 2026SiteGuard WP: Guessable CAPTCHACVE-2026-27411 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Plugin siteguard allows Functionality Bypass.This issue affects SiteGuard WP Plugin: from n/a through <= 1.7.9.
- Product
- SiteGuard WP
- Affected
- up to 1.7.9
- What to do
- Affects up to 1.7.9. Update SiteGuard WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026My Tickets: Insertion of Sensitive Information Into Sent DataCVE-2026-27406 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.This issue affects My Tickets: from n/a through <= 2.1.0.
- Product
- My Tickets
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update My Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Directory Pro: Missing AuthorizationCVE-2026-27396 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.
- Product
- Directory Pro
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026WeDesignTech Ultimate Booking Addon: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27390 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
- Product
- WeDesignTech Ultimate Booking Addon
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WeDesignTech Ultimate Booking Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026WeDesignTech Ultimate Booking Addon: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27389 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
- Product
- WeDesignTech Ultimate Booking Addon
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WeDesignTech Ultimate Booking Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026DesignThemes Booking Manager: Missing AuthorizationCVE-2026-27388 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through <= 2.0.
- Product
- DesignThemes Booking Manager
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update DesignThemes Booking Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026DesignThemes Directory Addon: Missing AuthorizationCVE-2026-27386 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through <= 1.8.
- Product
- DesignThemes Directory Addon
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update DesignThemes Directory Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026DesignThemes Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27385 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through <= 1.3.
- Product
- DesignThemes Portfolio
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update DesignThemes Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026W3 Total Cache: Improper Validation of Specified Quantity in InputCVE-2026-27384 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a through <= 2.9.1.
- Product
- W3 Total Cache
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update W3 Total Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Metro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27383 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through <= 2.13.
- Product
- Metro
- Affected
- up to 2.13
- What to do
- Affects up to 2.13. Update Metro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Metro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27382 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through <= 2.13.
- Product
- Metro
- Affected
- up to 2.13
- What to do
- Affects up to 2.13. Update Metro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Aora: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27381 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.15.
- Product
- Aora
- Affected
- up to 1.3.15
- What to do
- Affects up to 1.3.15. Update Aora to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026NextScripts: Deserialization of Untrusted DataCVE-2026-27379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.
- Product
- NextScripts
- Affected
- up to 4.4.7
- What to do
- Affects up to 4.4.7. Update NextScripts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Claue - Clean, Minimal Elementor WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Claue - Clean, Minimal Elementor WooCommerce Theme claue allows Reflected XSS.This issue affects Claue - Clean, Minimal Elementor WooCommerce Theme: from n/a through <= 2.2.7.
- Product
- Claue - Clean, Minimal Elementor WooCommerce
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Claue - Clean, Minimal Elementor WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Gecko: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27375 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Gecko gecko allows Reflected XSS.This issue affects Gecko: from n/a through <= 1.9.8.
- Product
- Gecko
- Affected
- up to 1.9.8
- What to do
- Affects up to 1.9.8. Update Gecko to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026WooCommerce Order Details: Missing AuthorizationCVE-2026-27374 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in vanquish WooCommerce Order Details woocommerce-order-details allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Order Details: from n/a through <= 3.1.
- Product
- WooCommerce Order Details
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update WooCommerce Order Details to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Tablesome: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27373 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome tablesome allows Blind SQL Injection.This issue affects Tablesome: from n/a through <= 1.2.3.
- Product
- Tablesome
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Chaty: Insertion of Sensitive Information Into Sent DataCVE-2026-27370 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Premio Chaty chaty allows Retrieve Embedded Sensitive Data.This issue affects Chaty: from n/a through <= 3.5.1.
- Product
- Chaty
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Chaty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Celeste: Deserialization of Untrusted DataCVE-2026-27369 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.
- Product
- Celeste
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Celeste to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Musico: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27367 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.
- Product
- Musico
- What to do
- Update Musico to the newest version.
Mar 5, 2026WP Bakery Autoresponder Addon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27363 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Stored XSS.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6.
- Product
- WP Bakery Autoresponder Addon
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP Bakery Autoresponder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026WP Bakery Autoresponder Addon: Missing AuthorizationCVE-2026-27362 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in kamleshyadav WP Bakery Autoresponder Addon vc-autoresponder-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bakery Autoresponder Addon: from n/a through <= 1.0.6.
- Product
- WP Bakery Autoresponder Addon
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP Bakery Autoresponder Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Responsive Posts Carousel Pro: Missing AuthorizationCVE-2026-27361 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.
- Product
- Responsive Posts Carousel Pro
- Affected
- up to 15.1
- What to do
- Affects up to 15.1. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Awa: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27359 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Awa Plugins awa-plugins allows Reflected XSS.This issue affects Awa Plugins: from n/a through <= 1.4.4.
- Product
- Awa
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Awa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Architecturer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.
- Product
- Architecturer
- What to do
- Update Architecturer to the newest version.
Mar 5, 2026WooCommerce Coming Soon Product with Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.
- Product
- WooCommerce Coming Soon Product with Countdown
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update WooCommerce Coming Soon Product with Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Grand News: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27353 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through <= 3.4.3.
- Product
- Grand News
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Grand News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Starto: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through < 2.2.5.
- Product
- Starto
- What to do
- Update Starto to the newest version.
Mar 5, 2026Photography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27348 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through < 7.7.6.
- Product
- Photography
- What to do
- Update Photography to the newest version.
Mar 5, 2026inseri core: Missing AuthorizationCVE-2026-27344 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Missing Authorization vulnerability in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects inseri core: from n/a through <= 1.0.5.
- Product
- inseri core
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update inseri core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026TopFit - Fitness and Gym: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27342 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes TopFit - Fitness and Gym WordPress Theme topfit allows PHP Local File Inclusion.This issue affects TopFit - Fitness and Gym WordPress Theme: from n/a through <= 1.9.
- Product
- TopFit - Fitness and Gym
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update TopFit - Fitness and Gym to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026TopScorer - Sports: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27341 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes TopScorer - Sports WordPress Theme topscorer allows PHP Local File Inclusion.This issue affects TopScorer - Sports WordPress Theme: from n/a through <= 1.2.
- Product
- TopScorer - Sports
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update TopScorer - Sports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Apollo | Night Club, DJ Event: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27340 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Apollo | Night Club, DJ Event WordPress Theme apollo allows PHP Local File Inclusion.This issue affects Apollo | Night Club, DJ Event WordPress Theme: from n/a through <= 1.3.1.
- Product
- Apollo | Night Club, DJ Event
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Apollo | Night Club, DJ Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Buzz Stone | Magazine & Viral Blog: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27339 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Buzz Stone | Magazine & Viral Blog WordPress Theme buzzstone allows PHP Local File Inclusion.This issue affects Buzz Stone | Magazine & Viral Blog WordPress Theme: from n/a through <= 1.0.2.
- Product
- Buzz Stone | Magazine & Viral Blog
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Buzz Stone | Magazine & Viral Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Car Zone: Deserialization of Untrusted DataCVE-2026-27338 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
- Product
- Car Zone
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Car Zone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Chronicle - Lifestyle Magazine & Blog: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27337 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Chronicle - Lifestyle Magazine & Blog WordPress Theme chronicle allows PHP Local File Inclusion.This issue affects Chronicle - Lifestyle Magazine & Blog WordPress Theme: from n/a through <= 1.0.
- Product
- Chronicle - Lifestyle Magazine & Blog
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Chronicle - Lifestyle Magazine & Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Consultor | Consulting, Accounting & Legal Counsel: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27336 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Consultor | Consulting, Accounting & Legal Counsel WordPress Theme consultor allows PHP Local File Inclusion.This issue affects Consultor | Consulting, Accounting & Legal Counsel WordPress Theme: from n/a through <= 1.2.4.
- Product
- Consultor | Consulting, Accounting & Legal Counsel
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Consultor | Consulting, Accounting & Legal Counsel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.