Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

351 results · page 2 of 8

Jul 2, 2026ProfileGrid: Cross-Site Request Forgery (CSRF)CVE-2026-57759 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.
Product
ProfileGrid
Affected
up to 6.0.0.2
What to do
Affects up to 6.0.0.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 30, 2026ProfileGrid – User Profiles, Groups and Communities: Privilege escalationCVE-2026-12073 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.9.5
What to do
Affects up to 5.9.9.5. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 23, 2026ProfileGrid – User Profiles, Groups and Communities: Stored Cross-Site ScriptingCVE-2026-4610 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.9.2
What to do
Affects up to 5.9.9.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2026Services Section Block – Showcase Service Details in Grid or Columns: Stored Cross-Site ScriptingCVE-2026-11402 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists inside HTML comments in post_content, bypassing wp_kses_post sanitization at save time, and executes via both the primary service link anchor and a secondary title-wrapped anchor when the linkIn option is set to 'title'.
Product
Services Section Block – Showcase Service Details in Grid or Columns
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Services Section Block – Showcase Service Details in Grid or Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2026Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.CVE-2026-34894 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.CVE-2024-52488 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Arbitrary File Upload in Grip <= 1.0.9 versions.
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026The Post Grid: Missing AuthorizationCVE-2026-49054 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Post Grid: from n/a through 7.9.2.
Product
The Post Grid
Affected
up to 7.9.2
What to do
Affects up to 7.9.2. Update The Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 20, 2026Image Photo Gallery Final Tiles Grid: Missing AuthorizationCVE-2026-27424 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.11
What to do
Affects up to 3.6.11. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 13, 2026ProfileGrid – User Profiles, Groups and Communities: Unauthorized accessCVE-2026-4609 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_user function in all versions up to, and including, 5.9.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add themselves or any registered user to any ProfileGrid group, including closed and paid groups, bypassing all authorization and payment gates.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.8.4
What to do
Affects up to 5.9.8.4. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026ProfileGrid – User Profiles, Groups and Communities: Blind SQL InjectionCVE-2026-4608 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to, and including, 5.9.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.8.4
What to do
Affects up to 5.9.8.4. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 13, 2026ProfileGrid – User Profiles, Groups and Communities: Authorization bypassCVE-2026-4607 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action via the pm_set_group_order, pm_set_group_items, and pm_set_field_order AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify site-wide ProfileGrid group settings including group menu order, group list order, group icon display, and field ordering.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.8.4
What to do
Affects up to 5.9.8.4. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 10, 2026WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scriptsCVE-2022-50946 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious scripts by failing to sanitize the post_title parameter. Attackers with editor privileges can inject script payloads through the testimonial title field that execute in the browsers of other users viewing the draft post, enabling cookie theft and session hijacking.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record downloads.wordpress.org exploit-db.com
May 1, 2026Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Unauthorized modification of dataCVE-2026-3143 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, 1.17.1. This makes it possible for unauthenticated attackers to cancel a pending rollback, potentially preventing a WordPress installation from automatically reverting a failed update.
Product
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Affected
up to 1.17.1
What to do
Affects up to 1.17.1. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 16, 2026Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX: Unauthorized modification of dataCVE-2026-0718 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp_shareCount_callback() function in all versions up to, and including, 5.0.5. This makes it possible for unauthenticated attackers to modify the share_count post meta for any post, including private or draft posts.
Product
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 15, 2026ThemeGrill Demo Importer: Missing AuthorizationCVE-2026-40730 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.
Product
ThemeGrill Demo Importer
Affected
up to 2.0.0.6
What to do
Affects up to 2.0.0.6. Update ThemeGrill Demo Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 14, 2026Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts: PHP Object InjectionCVE-2026-3017 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the import_shortcodes() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts
Affected
up to 3.0.12
What to do
Affects up to 3.0.12. Update Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 8, 2026Image Photo Gallery Final Tiles Grid: Authorization Bypass Through User-Controlled KeyCVE-2026-39510 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.11.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.11
What to do
Affects up to 3.6.11. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Visual Portfolio, Photo Gallery & Post Grid: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-32537 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through <= 3.5.1.
Product
Visual Portfolio, Photo Gallery & Post Grid
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Visual Portfolio, Photo Gallery & Post Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026ProfileGrid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-25417 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.
Product
ProfileGrid
Affected
up to 5.9.8.1
What to do
Affects up to 5.9.8.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026The Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24370 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0.
Product
The Grid
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026The Grid: Missing AuthorizationCVE-2026-24369 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
Product
The Grid
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Filter & Grids: Missing AuthorizationCVE-2026-32397 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter & Grids: from n/a through <= 3.5.1.
Product
Filter & Grids
Affected
up to 3.5.1
What to do
Affects up to 3.5.1. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Formidable Forms: A payment integrity bypassCVE-2026-2890 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `verify_intent()` function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services.
Product
Formidable Forms
Affected
up to 6.28
What to do
Affects up to 6.28. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2026ProfileGrid – User Profiles, Groups and Communities: Cross-Site Request ForgeryCVE-2026-2494 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.8.2. This is due to missing nonce validation on the membership request management page (approve and decline actions). This makes it possible for unauthenticated attackers to approve or deny group membership requests via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.8.2
What to do
Affects up to 5.9.8.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 6, 2026ProfileGrid – User Profiles, Groups and Communities: Unauthorized message deletionCVE-2026-2488 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message deletion due to a missing capability check on the pg_delete_msg() function in all versions up to, and including, 5.9.8.1. This is due to the function not verifying that the requesting user has permission to delete the targeted message. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary messages belonging to any user by sending a direct request with a valid message ID (mid parameter).
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.8.1
What to do
Affects up to 5.9.8.1. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Grit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28041 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Grit grit allows PHP Local File Inclusion.This issue affects Grit: from n/a through <= 1.0.1.
Product
Grit
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Grit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Gridiron: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28012 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Gridiron gridiron allows PHP Local File Inclusion.This issue affects Gridiron: from n/a through <= 1.0.14.
Product
Gridiron
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Gridiron to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 3, 2026Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX: Server-Side Request ForgeryCVE-2026-1273 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the `/ultp/v3/starter_dummy_post/` and `/ultp/v3/starter_import_content/` REST API endpoints. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Image Photo Gallery Final Tiles Grid: Missing AuthorizationCVE-2026-25375 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through <= 3.6.10.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.10
What to do
Affects up to 3.6.10. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 14, 2026Modula Image Gallery – Photo Grid & Video Gallery: Authorization bypassCVE-2026-1254 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6. This is due to the plugin not properly verifying that a user is authorized to modify specific posts before updating them via the REST API. This makes it possible for authenticated attackers, with contributor level access and above, to update the title, excerpt, and content of arbitrary posts by passing post IDs in the modulaImages field when editing a gallery.
Product
Modula Image Gallery – Photo Grid & Video Gallery
Affected
up to 2.13.6
What to do
Affects up to 2.13.6. Update Modula Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2026Flexi Product Slider and Grid for WooCommerce: Local File InclusionCVE-2026-1988 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.
Product
Flexi Product Slider and Grid for WooCommerce
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Flexi Product Slider and Grid for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org cwe.mitre.org
Feb 5, 2026ProfileGrid – User Profiles, Groups and Communities: Insecure Direct Object ReferenceCVE-2026-1271 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the 'pm_upload_image' and 'pm_upload_cover_image' AJAX actions. This is due to the update_user_meta() function being called outside of the user authorization check in public/partials/crop.php and public/partials/coverimg_crop.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change any user's profile picture or cover image, including administrators.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.7.2
What to do
Affects up to 5.9.7.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2026ProfileGrid – User Profiles, Groups and Communities: Unauthorized user suspensionCVE-2025-13416 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing capability check on the pm_deactivate_user_from_group() function in all versions up to, and including, 5.9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to suspend arbitrary users from groups, including administrators, via the pm_deactivate_user_from_group AJAX action.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.7.2
What to do
Affects up to 5.9.7.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 22, 2026The Grid: Missing AuthorizationCVE-2026-24368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
Product
The Grid
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 19, 2026Image Photo Gallery Final Tiles Grid: Unauthorized access and modification of dataCVE-2025-15466 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to view, create, modify, clone, delete, and reassign ownership of galleries created by other users, including administrators.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 8, 2026Famous - Responsive Image And Video Grid Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-27004 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin famous_grid_image_and_video_gallery allows Reflected XSS.This issue affects Famous - Responsive Image And Video Grid Gallery WordPress Plugin: from n/a through <= 1.4.
Product
Famous - Responsive Image And Video Grid Gallery
Affected
up to 1.4
What to do
Affects up to 1.4. Update Famous - Responsive Image And Video Grid Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026Post and Page Builder by BoldGrid: Missing AuthorizationCVE-2025-69345 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.
Product
Post and Page Builder by BoldGrid
Affected
up to 1.27.9
What to do
Affects up to 1.27.9. Update Post and Page Builder by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 29, 2025Content Grid Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68879 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in councilsoft Content Grid Slider content-grid-slider allows Reflected XSS.This issue affects Content Grid Slider: from n/a through <= 1.5.
Product
Content Grid Slider
Affected
up to 1.5
What to do
Affects up to 1.5. Update Content Grid Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 24, 2025Post Grid and Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68605 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Stored XSS.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.
Product
Post Grid and Gutenberg Blocks
Affected
up to 2.3.23
What to do
Affects up to 2.3.23. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 20, 2025Image Photo Gallery Final Tiles Grid: Stored Cross-Site ScriptingCVE-2025-13693 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.8
What to do
Affects up to 3.6.8. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 20, 2025Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX: Unauthorized access of dataCVE-2025-12980 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all versions up to, and including, 5.0.3. This makes it possible for unauthenticated attackers to retrieve sensitive user metadata, including password hashes.
Product
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
Affected
up to 5.0.3
What to do
Affects up to 5.0.3. Update Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 19, 2025Image Photo Gallery Final Tiles Grid: Authorization bypassCVE-2025-14455 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete, modify, or clone galleries created by any user, including administrators.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2025Post Grid and Gutenberg Blocks: Missing AuthorizationCVE-2025-66058 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.
Product
Post Grid and Gutenberg Blocks
Affected
up to 2.3.17
What to do
Affects up to 2.3.17. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Post Grid and Gutenberg Blocks: Authorization Bypass Through User-Controlled KeyCVE-2025-63043 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.
Product
Post Grid and Gutenberg Blocks
Affected
up to 2.3.23
What to do
Affects up to 2.3.23. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Agricola: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-58943 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Agricola agricola allows PHP Local File Inclusion.This issue affects Agricola: from n/a through <= 1.1.0.
Product
Agricola
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Agricola to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 18, 2025Farm Agrico: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52745 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Farm Agrico farmagrico allows PHP Local File Inclusion.This issue affects Farm Agrico: from n/a through <= 1.3.11.
Product
Farm Agrico
Affected
up to 1.3.11
What to do
Affects up to 1.3.11. Update Farm Agrico to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 16, 2025Grider for Elementor: Missing AuthorizationCVE-2025-66161 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grider for Elementor: from n/a through <= 1.0.8.
Product
Grider for Elementor
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Grider for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 15, 2025Image Gallery – Photo Grid & Video Gallery: Unauthorized modification of dataCVE-2025-14003 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with Author-level access and above, to add images to arbitrary Modula galleries owned by other users.
Product
Image Gallery – Photo Grid & Video Gallery
Affected
up to 2.13.3
What to do
Affects up to 2.13.3. Update Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2025Filter & Grids: SQL InjectionCVE-2025-10289 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only works on MariaDB as the query results in a syntax error on MySQL.
Product
Filter & Grids
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2025Image Gallery – Photo Grid & Video Gallery: Path TraversalCVE-2025-13891 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.
Product
Image Gallery – Photo Grid & Video Gallery
Affected
up to 2.13.3
What to do
Affects up to 2.13.3. Update Image Gallery – Photo Grid & Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.