Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

693 results · page 2 of 14

Sep 10, 2026Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file iCVE-2026-88023 · Other software · MongoDB · reported by cna@mongodb.comMedium 6.1
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
Product
MongoDB PHP Library
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.mongodb.org
Sep 8, 2026A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary JavascrCVE-2026-78838 · Other software · reported by MITREMedium 6.5
A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filter[filters][0][field] parameter.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com packetstormsecurity.com
Sep 5, 2026Post Grid and Gutenberg Blocks – ComboBlocks: Unauthenticated Hook InjectionCVE-2024-11080 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
Product
Post Grid and Gutenberg Blocks – ComboBlocks
Affected
2.2.32 to 2.3.1
What to do
Affects 2.2.32 to 2.3.1. Update Post Grid and Gutenberg Blocks – ComboBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 3, 2026MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fCVE-2026-85452 · Other software · themoos · reported by VulnCheckHigh 8.7
MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the buffers when an operator selects process list entries or pokes variables, enabling code execution.
Product
ui-moos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 1, 2026Incorrect boundary conditions in the Layout: Grid component.CVE-2026-84126 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 28, 2026StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulneraCVE-2026-22056 · Other software · NetApp · reported by security-alert@netapp.comLow 2.3
StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service.
Product
StorageGRID
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com
Aug 22, 2026Image Photo Gallery Final Tiles Grid: Stored Cross-Site ScriptingCVE-2026-4559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Image Photo Gallery Final Tiles Grid
Affected
up to 3.6.12
What to do
Affects up to 3.6.12. Update Image Photo Gallery Final Tiles Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 22, 2026Post Grid, Slider & Carousel Ultimate: Does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screenCVE-2026-16260 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in the session of any administrator who opens the affected item.
Product
Post Grid, Slider & Carousel Ultimate
Fixed in
1.8.1
What to do
Update Post Grid, Slider & Carousel Ultimate to 1.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2026The Grid: Incorrect Privilege AssignmentCVE-2026-28191 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0.
Product
The Grid
Affected
up to 2.8.0
What to do
Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 6, 2026Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX: Stored Cross-Site ScriptingCVE-2026-5158 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX
Affected
up to 5.0.13
What to do
Affects up to 5.0.13. Update Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 6, 2026ProfileGrid: Does not perform authorization checks before returning a group's member listCVE-2026-16290 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.
Product
ProfileGrid
Fixed in
6.0.0.0
What to do
Update ProfileGrid to 6.0.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider: Stored Cross-Site ScriptingCVE-2026-16636 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered via an attacker-controlled recipient display name (to.name) in a wp_mail() call and does not fire in the log list view — only in the detail view when an administrator uses the Prev/Next navigation controls, as that path bypasses the escapeHtml pipeline used by the list view.
Product
FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider
Affected
up to 2.2.95
What to do
Affects up to 2.2.95. Update FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2026Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_arCVE-2026-71292 · Other software · intelliants · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.2
Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.
Product
subrion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 3, 2026Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitraryCVE-2026-41453 · Other software · krayin · reported by VulnCheckHigh 8.7
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.
Product
laravel-crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 3, 2026ProfileGrid: Does not perform authorization checksCVE-2026-16289 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.
Product
ProfileGrid
Fixed in
6.0.0.0
What to do
Update ProfileGrid to 6.0.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026ProfileGrid: Does not verify that a notification belongs to the requesting user before deleting itCVE-2026-16291 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers.
Product
ProfileGrid
Fixed in
5.9.9.8
What to do
Update ProfileGrid to 5.9.9.8 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026King Addons for Elementor: Does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX responseCVE-2026-14841 · WordPress plugins & themes · reported by WPScanMedium 6.1
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.
Product
King Addons for Elementor
Fixed in
51.1.76
What to do
Update King Addons for Elementor to 51.1.76 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026ProfileGrid: Does not restrictCVE-2026-12687 · WordPress plugins & themes · reported by WPScanHigh 7.5
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.
Product
ProfileGrid
Fixed in
5.9.9.8
What to do
Update ProfileGrid to 5.9.9.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2CVE-2026-65947 · Websites & servers · reported by security@joomla.orgHigh 7.3
Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the tarCVE-2026-65888 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user passworCVE-2026-65887 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary fCVE-2026-65886 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2CVE-2026-66490 · Websites & servers · reported by security@joomla.orgMedium 6.1
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2CVE-2026-66489 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2CVE-2026-66488 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queriesCVE-2026-65890 · Websites & servers · reported by security@joomla.orgCritical 9.2
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrarCVE-2026-65885 · Websites & servers · reported by security@joomla.orgCritical 9.4
Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 29, 2026Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticateCVE-2026-65884 · Websites & servers · reported by security@joomla.orgCritical 10
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 28, 2026In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized.CVE-2026-16462 · Other software · Weidmueller Interface · reported by info@cert.vde.comCritical 9.3
In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.
Product
PROCON-WEB SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record certvde.com
Jul 27, 2026Smart Manager: Does not properly encode a post field before rendering it into an HTML attribute in its management gridCVE-2026-14203 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.
Product
Smart Manager
Fixed in
8.92.0
What to do
Update Smart Manager to 8.92.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not perform a capability check on its license management actionsCVE-2026-12690 · WordPress plugins & themes · reported by WPScanLow 3.8
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not perform any authorization or ownership check on some of its private-message thread actionsCVE-2026-12689 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026ProfileGrid: Does not verify PayPal IPN notifications before granting paid group membershipCVE-2026-12688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
Product
ProfileGrid
Fixed in
5.9.9.7
What to do
Update ProfileGrid to 5.9.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 24, 2026Post Grid Gutenberg Blocks – PostX: Stored Cross-Site ScriptingCVE-2026-15100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post.
Product
Post Grid Gutenberg Blocks – PostX
Affected
up to 5.0.32
What to do
Affects up to 5.0.32. Update Post Grid Gutenberg Blocks – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Grid/List View for WooCommerce: Stored Cross-Site ScriptingCVE-2026-15794 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The shortcode's all_page="1" attribute can be used to force the widget to render on any page, expanding the attack surface beyond shop and category pages.
Product
Grid/List View for WooCommerce
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update Grid/List View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 20, 2026Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leadCVE-2026-61425 · Websites & servers · reported by security@joomla.orgCritical 9.4
Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mysites.guru balbooa.com
Jul 13, 2026ProfileGrid: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-57697 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6.
Product
ProfileGrid
Affected
up to 5.9.9.6
What to do
Affects up to 5.9.9.6. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 10, 2026WP Grid Builder: Privilege EscalationCVE-2026-13756 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by updating their own `wp_capabilities` user meta with a crafted nested array payload.
Product
WP Grid Builder
Affected
up to 2.3.3
What to do
Affects up to 2.3.3. Update WP Grid Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.wpgridbuilder.com wordfence.com
Jul 9, 2026Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration: Unauthorized plugin installation and activationCVE-2026-11359 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to, and including, 3.4. This is due to a missing capability check and missing nonce validation on the pg_install_profilegrid() AJAX handler registered via wp_ajax_pg_install_profilegrid. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ProfileGrid plugin from wordpress.
Product
Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration
Affected
up to 3.4
What to do
Affects up to 3.4. Update Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 6, 2026Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component.CVE-2026-48204 · Email & office · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_METADATA, GRIDFS_CHUNKSIZE, GRIDFS_FILE_ID_PRODUCED) were the plain strings gridfs.operation, gridfs.objectid, gridfs.metadata, gridfs.chunksize and gridfs.fileid. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a mongodb-gridfs: producer with no explicit operation, any HTTP client could therefore set the gridfs.operation header to override the route's intended operation - switching, for example, a file upload to remove (deleting a file identified by the attacker-supplied gridfs.objectid), listAll (enumerating every file in the bucket) or fi
Product
Apache Camel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record camel.apache.org openwall.com
Jul 2, 2026ProfileGrid: Cross-Site Request Forgery (CSRF)CVE-2026-57759 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.
Product
ProfileGrid
Affected
up to 6.0.0.2
What to do
Affects up to 6.0.0.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 30, 2026ProfileGrid – User Profiles, Groups and Communities: Privilege escalationCVE-2026-12073 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.9.5
What to do
Affects up to 5.9.9.5. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 23, 2026ProfileGrid – User Profiles, Groups and Communities: Stored Cross-Site ScriptingCVE-2026-4610 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.
Product
ProfileGrid – User Profiles, Groups and Communities
Affected
up to 5.9.9.2
What to do
Affects up to 5.9.9.2. Update ProfileGrid – User Profiles, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2026The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission.CVE-2026-12622 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5Medium 5.3
The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
Product
GridTime 3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record microchip.com
Jun 19, 2026Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS.CVE-2026-12621 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5Medium 5.3
Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridTime 3000: from 1.0r0.03 before 1.2r0.0.
Product
GridTime 3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record microchip.com
Jun 19, 2026The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints.CVE-2026-12620 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5Medium 4.6
The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
Product
GridTime 3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record microchip.com
Jun 19, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site ScriptingCVE-2026-12619 · Other software · Microchip · reported by dc3f6da9-85b5-4a73-84a2-2ec90b40fca5Medium 5.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scripting (XSS). This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
Product
GridTime 3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record microchip.com
Jun 19, 2026Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to escalCVE-2016-20086 · Other software · Vembu · reported by VulnCheckHigh 8.5
Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackup_webServer services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted path and restart the service to execute code with LocalSystem privileges.
Product
Vembu StoreGrid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com vulncheck.com
Jun 18, 2026Services Section Block – Showcase Service Details in Grid or Columns: Stored Cross-Site ScriptingCVE-2026-11402 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists inside HTML comments in post_content, bypassing wp_kses_post sanitization at save time, and executes via both the primary service link anchor and a secondary title-wrapped anchor when the linkIn option is set to 'title'.
Product
Services Section Block – Showcase Service Details in Grid or Columns
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Services Section Block – Showcase Service Details in Grid or Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 31, 2026OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through craftCVE-2026-49490 · Other software · OpenCATS · reported by VulnCheckHigh 8.6
OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through crafted filters targeting the non-filterable Tags column in the Candidates DataGrid. Attackers can bypass column filterable restrictions by manipulating filter requests to execute arbitrary SQL queries against the database.
Product
OpenCATS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.