Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
492 results · page 2 of 10
Sep 1, 2026Frontend Admin by DynamiApps: Stored Cross-Site ScriptingCVE-2026-12747 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.29.11
- What to do
- Affects up to 3.29.11. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2026Frontend Admin by DynamiApps: Does not perform a capability check on one of its AJAX actionsCVE-2026-81346 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.
- Product
- Frontend Admin by DynamiApps
- Fixed in
- 3.29.11
- What to do
- Update Frontend Admin by DynamiApps to 3.29.11 or newer.
Aug 28, 2026User Frontend: Does not restrict access to its user directory search endpointCVE-2026-14567 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
- Product
- User Frontend
- Fixed in
- 4.3.10
- What to do
- Update User Frontend to 4.3.10 or newer.
Aug 28, 2026User Frontend: Does not properly validate field type definitions and deserialises user-controlled post metadataCVE-2026-14558 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
- Product
- User Frontend
- Fixed in
- 4.3.10
- What to do
- Update User Frontend to 4.3.10 or newer.
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassableCVE-2026-12513 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
- Product
- Shared Files WordPress plugin before 1.7.67, shared-files-pro
- Fixed in
- 1.7.67
- What to do
- Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Aug 25, 2026The permission check for the frontend management update flow verified a different event than the one the request went on to modify.CVE-2026-77145 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.1
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.
- Product
- Extension "Events 2"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its ownCVE-2026-77144 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.1
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.
- Product
- Extension "Events 2"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified.CVE-2026-77143 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 8.8
The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership. Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration.
- Product
- Extension "Forum"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, bCVE-2026-77142 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 8.8
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.
- Product
- Extension "Industry Directory"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownersCVE-2026-77141 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 8.8
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.
- Product
- Extension "Club Directory"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change.CVE-2026-77140 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 8.7
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.
- Product
- Extension "Telephone Directory"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field cCVE-2026-77133 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 6
The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.
- Product
- Extension "femanager"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular searchCVE-2026-56093 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 6.3
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsewhere.
- Product
- Extension "Apache Solr for TYPO3 - Enterprise Search"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisteCVE-2026-56092 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.6
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.
- Product
- Extension "Apache Solr for TYPO3 - Enterprise Search"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fielCVE-2026-75948 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3CVE-2026-75951 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66638 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.
- Affected
- up to 3.29.10
- What to do
- Affects up to 3.29.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2026An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.apiCVE-2026-23934 · Other software · Zabbix · reported by security@zabbix.comMedium 5.1
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed.CVE-2026-23933 · Other software · Zabbix · reported by security@zabbix.comHigh 7.7
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiCVE-2026-23931 · Other software · Zabbix · reported by security@zabbix.comMedium 5.3
The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testCVE-2026-23930 · Other software · Zabbix · reported by security@zabbix.comMedium 5.3
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent CVE-2026-1199 · Other software · Zabbix · reported by security@zabbix.comMedium 6.9
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2026Frontend Admin by DynamiApps: Privilege EscalationCVE-2026-18432 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because `ActionUser::conditions_logic()` gates the `current_user_can('edit_user', $user_id)` authorization check behind an `is_numeric()` test, causing the check to be skipped entirely when `$user_id` is a non-numeric string — a condition that can be induced by passing a crafted value such as `1one` through the unvalidated `item_id` parameter of the unauthenticated `wp_ajax_nopriv_frontend_admin/forms/change_form` AJAX endpoint. This makes it possible for attackers to escalate privileges to administrator by obtaining a server-signed `_acf_objects` payload carrying the non-numeric user ID, which WordPress subsequently coerces to integer 1 (the default administrator), allowing the attacker to overwrite that account's password or email address. Exploitation by unauthenticated users requires a public-facing frontend user form to be configured; in all other cases a subscriber-level account is sufficient.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.29.9
- What to do
- Affects up to 3.29.9. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2026Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callCVE-2026-67366 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.CVE-2026-65937 · Other software · Progress Software Corporation · reported by security@progress.comHigh 8
In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content.
- Product
- WhatsUp Gold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.progress.comdocs.progress.com
Aug 11, 2026Frontend Admin by DynamiApps: Authorization bypassCVE-2026-15606 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrators, leading to full account takeover and complete site compromise. Exploitation requires the attacker to hold a valid encrypted Current-User token obtained by accessing any Edit User form they are legitimately authorized to submit, which they then use as a known-plaintext base for the CBC bit-flipping forgery.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.29.9
- What to do
- Affects up to 3.29.9. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 6, 2026PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton.CVE-2026-71555 · Other software · THM-Health · reported by GitHubMedium 4.1
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
- Product
- PILOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66662 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
- Affected
- up to 3.29.10
- What to do
- Affects up to 3.29.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66470 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.
- Affected
- up to 3.29.10
- What to do
- Affects up to 3.29.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2026Frontend File Manager: Does not perform nonce validation on one of its file-metadata update actionsCVE-2026-16292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 31, 2026Frontend Admin by DynamiApps: Decodes HTML entities in a submitted form field value after sanitizing itCVE-2026-13609 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.
- Product
- Frontend Admin by DynamiApps
- Fixed in
- 3.29.9
- What to do
- Update Frontend Admin by DynamiApps to 3.29.9 or newer.
Jul 30, 2026Frontend Admin by DynamiApps: Does not perform capability checks on its taxonomy term creationCVE-2026-11867 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.
- Product
- Frontend Admin by DynamiApps
- Fixed in
- 3.29.7
- What to do
- Update Frontend Admin by DynamiApps to 3.29.7 or newer.
Jul 27, 2026User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration: Does not correctly verify ownership before deleting an attachmentCVE-2026-14568 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments such as guest uploads and User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8-installed placeholder media.
- Product
- User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration
- Fixed in
- 4.3.8
- What to do
- Update User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration to 4.3.8 or newer.
Jul 21, 2026BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources.CVE-2026-15793 · Other software · moby · reported by security@docker.comHigh 7.3
BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.CVE-2026-15792 · Other software · moby · reported by security@docker.comMedium 6
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.
- Product
- BuildKit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2026Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file CVE-2026-60025 · Websites & servers · reported by security@joomla.orgHigh 8.8
Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2026grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates andCVE-2026-62236 · Other software · getgrav · reported by VulnCheckLow 2.3
grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core dispatches the task from the GET 'task:' URI parameter and the default session cookie is SameSite=Lax, an attacker can lure a logged-in victim to an off-site page that performs a top-level GET navigation, rotating the victim's TOTP secret so their enrolled authenticator no longer matches the server, effectively forcing 2FA re-enrollment. Sites configured with session.samesite: Strict are not affected.
- Product
- grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jul 11, 2026WCFM – Frontend Manager for WooCommerce: Authorization bypassCVE-2026-12994 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to inject arbitrary reply content into any store inquiry, overwrite the main inquiry record in wp_wcfm_enquiries, and trigger unsolicited notification emails to customers and vendors. Unlike sibling controller branches (wcfm-enquiry and wcfm-enquiry-manage), the wcfm-my-account-enquiry-manage branch performs no is_user_logged_in() or current_user_can() check, and the nonce that serves as the sole barrier is embedded into every public page load without any login gate.
- Product
- WCFM – Frontend Manager for WooCommerce
- Affected
- up to 6.7.27
- What to do
- Affects up to 6.7.27. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2026WCFM – Frontend Manager for WooCommerce: Insecure Direct Object ReferenceCVE-2026-10041 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product_archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to archive arbitrary vendors' products, toggle the featured status on arbitrary listings, mark arbitrary WooCommerce orders as completed, and permanently delete arbitrary enquiries and bulk messages belonging to other vendors.
- Product
- WCFM – Frontend Manager for WooCommerce
- Affected
- up to 6.7.27
- What to do
- Affects up to 6.7.27. Update WCFM – Frontend Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Insecure Direct Object ReferenceCVE-2026-12418 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf_files_data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as the wpuf_submit_post AJAX action is gated only by a nonce with no capability check for the downstream post-edit operation.
- Product
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
- Affected
- up to 4.3.7
- What to do
- Affects up to 4.3.7. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Authorization bypassCVE-2026-12406 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered on a front-end page, as this causes the valid wpuf_nonce value to be localized into publicly accessible JavaScript objects (wpuf_upload and wpuf_frontend), satisfying the sole access control gate.
- Product
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
- Affected
- up to 4.3.7
- What to do
- Affects up to 4.3.7. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 8, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Insecure Direct Object ReferenceCVE-2026-5459 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the payment_page() function due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to activate a free subscription pack for any user on the site, overwriting their existing paid subscription and causing loss of paid features.
- Product
- User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 7, 2026An improper access check allows users to display a list of modules in the frontend.CVE-2026-48956 · Websites & servers · Joomla! Project · reported by security@joomla.orgMedium 6.4
An improper access check allows users to display a list of modules in the frontend.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Frontend File Manager: Does not validate a file path derived from user input before deleting the referenced fileCVE-2026-12277 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 29, 2026Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.CVE-2026-57334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 27, 2026Frontend File Manager: Authenticated Arbitrary File DeletionCVE-2026-8095 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path that is then passed directly to unlink() in delete_file_locally() without any directory containment validation. This makes it possible for authenticated attackers with Subscriber-level access to delete arbitrary files on the server, including sensitive files such as wp-config.php, potentially leading to full site takeover.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2026Shariff for WordPress Shariff for: Does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() functionCVE-2026-9677 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Shariff for WordPress Shariff for
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Shariff for WordPress Shariff for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Frontend File Manager: Does not properly verify ownership of every targeted post before permanent deletionCVE-2026-8380 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend File Manager Plugin WordPress plugin through 23.6's "Allow guest uploads" setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes them under tCVE-2026-48946 · Other software · getk2.org · reported by security@joomla.orgMedium 6.3
The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server's context.
- Product
- K2 extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`.CVE-2026-48944 · Other software · getk2.org · reported by security@joomla.orgMedium 6.5
The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.
- Product
- K2 extension for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.