Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,754exploited flaws on CISA’s list

33added in the last 30 days

298new WordPress flaws this week

13,899entries in the database

1,161 results · page 19 of 24

Apr 8, 2026ProSolution WP Client: Arbitrary file uploadsCVE-2026-2942 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'proSol_fileUploadProcess' function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
ProSolution WP Client
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update ProSolution WP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026mndpsingh287 Theme Editor theme-editor: Cross-Site Request Forgery (CSRF)CVE-2026-39640 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.
Product
mndpsingh287 Theme Editor theme-editor
What to do
Update mndpsingh287 Theme Editor theme-editor to the newest version.
NVD record patchstack.com
Apr 8, 2026priyanshumittal Appointment appointment: Cross-Site Request Forgery (CSRF)CVE-2026-39620 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through <= 3.5.5.
Product
priyanshumittal Appointment appointment
What to do
Update priyanshumittal Appointment appointment to the newest version.
NVD record patchstack.com
Apr 8, 2026priyanshumittal Busiprof busiprof: Cross-Site Request Forgery (CSRF)CVE-2026-39619 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: from n/a through <= 2.5.2.
Product
priyanshumittal Busiprof busiprof
What to do
Update priyanshumittal Busiprof busiprof to the newest version.
NVD record patchstack.com
Apr 8, 2026priyanshumittal Bluestreet bluestreet: Cross-Site Request Forgery (CSRF)CVE-2026-39617 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from n/a through <= 1.7.3.
Product
priyanshumittal Bluestreet bluestreet
What to do
Update priyanshumittal Bluestreet bluestreet to the newest version.
NVD record patchstack.com
Apr 8, 2026DSGVO Google Web Fonts GDPR: Arbitrary file uploadCVE-2026-3535 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, and including, 1.1. The function is exposed via a `wp_ajax_nopriv_` hook, requiring no authentication. It fetches a user-supplied URL as a CSS file, extracts URLs from its content, and downloads those files to a publicly accessible directory without validating the file type. This makes it possible for unauthenticated attackers to upload arbitrary files including PHP webshells, leading to remote code execution. The exploit requires the site to use one of a handful of specific themes (twentyfifteen, twentyseventeen, twentysixteen, storefront, salient, or shapely).
Product
DSGVO Google Web Fonts GDPR
Affected
up to 1.1
What to do
Affects up to 1.1. Update DSGVO Google Web Fonts GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026Users manager – PN: Privilege EscalationCVE-2026-4003 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. This is due to a flawed authorization logic check in the userspn_ajax_nopriv_server() function within the 'userspn_form_save' case. The conditional only blocks unauthenticated users when the user_id is empty, but when a non-empty user_id is supplied, execution bypasses this check entirely and proceeds to update arbitrary user meta via update_user_meta() without any authentication or authorization verification. Additionally, the nonce required for this AJAX endpoint ('userspn-nonce') is exposed to all visitors via wp_localize_script on the public wp_enqueue_scripts hook, rendering the nonce check ineffective as a security control. This makes it possible for unauthenticated attackers to update arbitrary user metadata for any user account, including the userspn_secret_token field.
Product
Users manager – PN
Affected
up to 1.1.15
What to do
Affects up to 1.1.15. Update Users manager – PN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Everest Forms: PHP Object InjectionCVE-2026-3296 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.
Product
Everest Forms
Affected
up to 3.4.3
What to do
Affects up to 3.4.3. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2026Ninja Forms - File Uploads: Arbitrary file uploadsCVE-2026-0740 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
Product
Ninja Forms - File Uploads
Affected
up to 3.3.26
What to do
Affects up to 3.3.26. Update Ninja Forms - File Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record ninjaforms.com wordfence.com
Apr 1, 2026Order Notification for WooCommerce: Overrides WooCommerce's permission checks to grant full access to all unauthenticated requestsCVE-2025-15484 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, and customers.
Product
Order Notification for WooCommerce
Fixed in
3.6.3
What to do
Update Order Notification for WooCommerce to 3.6.3 or newer.
NVD record wpscan.com
Mar 30, 2026Everest Forms Pro: Remote Code ExecutionCVE-2026-3300 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not escape single quotes or other PHP code context characters. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code on the server by submitting a crafted value in any string-type form field (text, email, URL, select, radio) when a form uses the "Complex Calculation" feature.
Product
Everest Forms Pro
Affected
up to 1.9.12
What to do
Affects up to 1.9.12. Update Everest Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record everestforms.net plugins.trac.wordpress.org
Mar 30, 2026Contact Form by Supsystic: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE)CVE-2026-4257 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_String` template engine without sandboxing, combined with the `cfsPreFill` prefill functionality that allows unauthenticated users to inject arbitrary Twig expressions into form field values via GET parameters. This makes it possible for unauthenticated attackers to execute arbitrary PHP functions and OS commands on the server by leveraging Twig's `registerUndefinedFilterCallback()` method to register arbitrary PHP callbacks.
Product
Contact Form by Supsystic
Affected
up to 1.7.36
What to do
Affects up to 1.7.36. Update Contact Form by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2026Nelio Software Nelio AB Testing nelio-ab-testing: Improper Control of Generation of Code ('Code Injection')CVE-2026-32573 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.7.
Product
Nelio Software Nelio AB Testing nelio-ab-testing
What to do
Update Nelio Software Nelio AB Testing nelio-ab-testing to the newest version.
NVD record patchstack.com
Mar 25, 2026PublishPress PublishPress Revisions revisionary: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32539 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through <= 3.7.23.
Product
PublishPress PublishPress Revisions revisionary
What to do
Update PublishPress PublishPress Revisions revisionary to the newest version.
NVD record patchstack.com
Mar 25, 2026halfdata Green Downloads halfdata-paypal-green-downloads: Unrestricted Upload of File with Dangerous TypeCVE-2026-32536 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through <= 2.08.
Product
halfdata Green Downloads halfdata-paypal-green-downloads
What to do
Update halfdata Green Downloads halfdata-paypal-green-downloads to the newest version.
NVD record patchstack.com
Mar 25, 2026jetmonsters JetFormBuilder jetformbuilder: Improper Control of Generation of Code ('Code Injection')CVE-2026-32525 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1.
Product
jetmonsters JetFormBuilder jetformbuilder
What to do
Update jetmonsters JetFormBuilder jetformbuilder to the newest version.
NVD record patchstack.com
Mar 25, 2026Jordy Meow Photo Engine wplr-sync: Unrestricted Upload of File with Dangerous TypeCVE-2026-32524 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through <= 6.4.9.
Product
Jordy Meow Photo Engine wplr-sync
What to do
Update Jordy Meow Photo Engine wplr-sync to the newest version.
NVD record patchstack.com
Mar 25, 2026denishua WPJAM Basic wpjam-basic: Unrestricted Upload of File with Dangerous TypeCVE-2026-32523 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows Using Malicious Files.This issue affects WPJAM Basic: from n/a through <= 6.9.2.
Product
denishua WPJAM Basic wpjam-basic
What to do
Update denishua WPJAM Basic wpjam-basic to the newest version.
NVD record patchstack.com
Mar 25, 2026Andrew Munro / AffiliateWP RewardsWP rewardswp: Incorrect Privilege AssignmentCVE-2026-32520 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n/a through <= 1.0.4.
Product
Andrew Munro / AffiliateWP RewardsWP rewardswp
What to do
Update Andrew Munro / AffiliateWP RewardsWP rewardswp to the newest version.
NVD record patchstack.com
Mar 25, 2026Bit Apps Bit SMTP bit-smtp: Incorrect Privilege AssignmentCVE-2026-32519 · WordPress plugins & themes · reported by PatchstackCritical 9
Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2.
Product
Bit Apps Bit SMTP bit-smtp
What to do
Update Bit Apps Bit SMTP bit-smtp to the newest version.
NVD record patchstack.com
Mar 25, 2026Edge-Themes Pelicula pelicula-video-production-and-movie-theme: Deserialization of Untrusted DataCVE-2026-32512 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.
Product
Edge-Themes Pelicula pelicula-video-production-and-movie-theme
What to do
Update Edge-Themes Pelicula pelicula-video-production-and-movie-theme to the newest version.
NVD record patchstack.com
Mar 25, 2026Select-Themes Borgholm borgholm-marketing-agency-theme: Deserialization of Untrusted DataCVE-2026-32502 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.
Product
Select-Themes Borgholm borgholm-marketing-agency-theme
What to do
Update Select-Themes Borgholm borgholm-marketing-agency-theme to the newest version.
NVD record patchstack.com
Mar 25, 2026QuantumCloud ChatBot chatbot: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32499 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.This issue affects ChatBot: from n/a through <= 7.7.9.
Product
QuantumCloud ChatBot chatbot
What to do
Update QuantumCloud ChatBot chatbot to the newest version.
NVD record patchstack.com
Mar 25, 2026deothemes Ona ona: Unrestricted Upload of File with Dangerous TypeCVE-2026-32482 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in deothemes Ona ona allows Upload a Web Shell to a Web Server.This issue affects Ona: from n/a through < 1.24.
Product
deothemes Ona ona
What to do
Update deothemes Ona ona to the newest version.
NVD record patchstack.com
Mar 25, 2026Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-31920 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Blind SQL Injection.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.
Product
Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce
What to do
Update Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce to the newest version.
NVD record patchstack.com
Mar 25, 2026magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation: Deserialization of Untrusted DataCVE-2026-27095 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.
Product
magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation
What to do
Update magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation to the newest version.
NVD record patchstack.com
Mar 25, 2026ThemeREX Buisson buisson: Deserialization of Untrusted DataCVE-2026-27084 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.
Product
ThemeREX Buisson buisson
What to do
Update ThemeREX Buisson buisson to the newest version.
NVD record patchstack.com
Mar 25, 2026ThemeREX Work & Travel Company work-travel-company: Deserialization of Untrusted DataCVE-2026-27083 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
Product
ThemeREX Work & Travel Company work-travel-company
What to do
Update ThemeREX Work & Travel Company work-travel-company to the newest version.
NVD record patchstack.com
Mar 25, 2026ThemeREX Love Story lovestory: Deserialization of Untrusted DataCVE-2026-27082 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
Product
ThemeREX Love Story lovestory
What to do
Update ThemeREX Love Story lovestory to the newest version.
NVD record patchstack.com
Mar 25, 2026Arraytics WPCafe wp-cafe: Missing AuthorizationCVE-2026-27071 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.
Product
Arraytics WPCafe wp-cafe
What to do
Update Arraytics WPCafe wp-cafe to the newest version.
NVD record patchstack.com
Mar 25, 2026uxper Golo golo: Incorrect Privilege AssignmentCVE-2026-27051 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0.
Product
uxper Golo golo
What to do
Update uxper Golo golo to the newest version.
NVD record patchstack.com
Mar 25, 2026NooTheme Jobica Core jobica-core: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27049 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.
Product
NooTheme Jobica Core jobica-core
What to do
Update NooTheme Jobica Core jobica-core to the newest version.
NVD record patchstack.com
Mar 25, 2026TotalSuite Total Poll Lite totalpoll-lite: Improper Control of Generation of Code ('Code Injection')CVE-2026-27044 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through <= 4.12.0.
Product
TotalSuite Total Poll Lite totalpoll-lite
What to do
Update TotalSuite Total Poll Lite totalpoll-lite to the newest version.
NVD record patchstack.com
Mar 25, 2026Jonathan Daggerhart Widget Wrangler widget-wrangler: Improper Control of Generation of Code ('Code Injection')CVE-2026-25447 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through <= 2.3.9.
Product
Jonathan Daggerhart Widget Wrangler widget-wrangler
What to do
Update Jonathan Daggerhart Widget Wrangler widget-wrangler to the newest version.
NVD record patchstack.com
Mar 25, 2026wpdive Nexa Blocks nexa-blocks: Deserialization of Untrusted DataCVE-2026-25429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
Product
wpdive Nexa Blocks nexa-blocks
What to do
Update wpdive Nexa Blocks nexa-blocks to the newest version.
NVD record patchstack.com
Mar 25, 2026iqonicdesign WPBookit Pro wpbookit-pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-25413 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Using Malicious Files.This issue affects WPBookit Pro: from n/a through <= 1.6.18.
Product
iqonicdesign WPBookit Pro wpbookit-pro
What to do
Update iqonicdesign WPBookit Pro wpbookit-pro to the newest version.
NVD record patchstack.com
Mar 25, 2026eyecix Addon Jobsearch Chat addon-jobsearch-chat: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25377 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows SQL Injection.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.
Product
eyecix Addon Jobsearch Chat addon-jobsearch-chat
What to do
Update eyecix Addon Jobsearch Chat addon-jobsearch-chat to the newest version.
NVD record patchstack.com
Mar 25, 2026King-Theme Lumise Product Designer lumise: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25371 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.
Product
King-Theme Lumise Product Designer lumise
What to do
Update King-Theme Lumise Product Designer lumise to the newest version.
NVD record patchstack.com
Mar 25, 2026Themeisle Woody ad snippets insert-php: Improper Control of Generation of Code ('Code Injection')CVE-2026-25366 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.
Product
Themeisle Woody ad snippets insert-php
What to do
Update Themeisle Woody ad snippets insert-php to the newest version.
NVD record patchstack.com
Mar 25, 2026GalleryCreator SimpLy Gallery simply-gallery-block: Improper Validation of Specified Quantity in InputCVE-2026-25345 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Validation of Specified Quantity in Input vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.
Product
GalleryCreator SimpLy Gallery simply-gallery-block
What to do
Update GalleryCreator SimpLy Gallery simply-gallery-block to the newest version.
NVD record patchstack.com
Mar 25, 2026NooTheme Jobmonster noo-jobmonster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-25340 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.
Product
NooTheme Jobmonster noo-jobmonster
What to do
Update NooTheme Jobmonster noo-jobmonster to the newest version.
NVD record patchstack.com
Mar 25, 2026Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-25035 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.
Product
Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery
What to do
Update Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery to the newest version.
NVD record patchstack.com
Mar 25, 2026park_of_ideas Ricky ricky: Deserialization of Untrusted DataCVE-2026-25032 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
Product
park_of_ideas Ricky ricky
What to do
Update park_of_ideas Ricky ricky to the newest version.
NVD record patchstack.com
Mar 25, 2026park_of_ideas Tasty Daily tastydaily: Deserialization of Untrusted DataCVE-2026-25031 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.
Product
park_of_ideas Tasty Daily tastydaily
What to do
Update park_of_ideas Tasty Daily tastydaily to the newest version.
NVD record patchstack.com
Mar 25, 2026park_of_ideas Goldish goldish: Deserialization of Untrusted DataCVE-2026-25030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.
Product
park_of_ideas Goldish goldish
What to do
Update park_of_ideas Goldish goldish to the newest version.
NVD record patchstack.com
Mar 25, 2026park_of_ideas KIDZ kidz: Deserialization of Untrusted DataCVE-2026-25029 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
Product
park_of_ideas KIDZ kidz
What to do
Update park_of_ideas KIDZ kidz to the newest version.
NVD record patchstack.com
Mar 25, 2026WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24993 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.3.
Product
WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics
What to do
Update WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics to the newest version.
NVD record patchstack.com
Mar 25, 2026FantasticPlugins SUMO Affiliates Pro affs: Deserialization of Untrusted DataCVE-2026-24989 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
Product
FantasticPlugins SUMO Affiliates Pro affs
What to do
Update FantasticPlugins SUMO Affiliates Pro affs to the newest version.
NVD record patchstack.com
Mar 25, 2026Elated-Themes Search & Go searchgo: Incorrect Privilege AssignmentCVE-2026-24971 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search & Go: from n/a through <= 2.8.
Product
Elated-Themes Search & Go searchgo
What to do
Update Elated-Themes Search & Go searchgo to the newest version.
NVD record patchstack.com
Mar 25, 2026Xagio SEO Xagio SEO xagio-seo: Incorrect Privilege AssignmentCVE-2026-24968 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1.0.30.
Product
Xagio SEO Xagio SEO xagio-seo
What to do
Update Xagio SEO Xagio SEO xagio-seo to the newest version.
NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.