Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
342 results · page 2 of 7
Sep 10, 2026miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA: Does not require a validated transaction before deleting site options whose names come from unauthenticated request inputCVE-2026-77770 · WordPress plugins & themes · reported by WPScanCritical 10
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
- Product
- miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA
- Fixed in
- 6.3.1
- What to do
- Update miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA to 6.3.1 or newer.
Sep 5, 2026EmbedPress: Does not correctly restrict access to one of its Google Reviews REST routes to administratorsCVE-2026-84926 · WordPress plugins & themes · reported by WPScanLow 2.7
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
- Product
- EmbedPress
- Fixed in
- 4.6.4
- What to do
- Update EmbedPress to 4.6.4 or newer.
Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · WordPress plugins & themes · reported by WPScanLow 2.7
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
- Product
- JCH Optimize
- Fixed in
- 5.0.1
- What to do
- Update JCH Optimize to 5.0.1 or newer.
Sep 5, 2026Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN: Remote Code ExecutionCVE-2026-83627 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be crea
- Product
- Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN
- Affected
- up to 3.21.0
- What to do
- Affects up to 3.21.0. Update Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2026Ninja Forms: Does not restrict its REST abilities to administratorsCVE-2026-80438 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
- Product
- Ninja Forms
- Fixed in
- 3.15.2
- What to do
- Update Ninja Forms to 3.15.2 or newer.
Sep 4, 2026Hummingbird Performance: Does not restrict a network-wide setting to network administratorsCVE-2026-19224 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Hummingbird Performance
- Fixed in
- 3.21.2
- What to do
- Update Hummingbird Performance to 3.21.2 or newer.
Sep 2, 2026CatalogX: Does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administratorCVE-2026-79621 · WordPress plugins & themes · reported by WPScanMedium 4.3
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry.
- Product
- CatalogX
- Fixed in
- 6.1.3
- What to do
- Update CatalogX to 6.1.3 or newer.
Sep 2, 2026RegistrationMagic: Does not escape a registration form field value before outputting it in an HTML attribute on an administrative pageCVE-2026-77792 · WordPress plugins & themes · reported by WPScanHigh 7.5
The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
- Product
- RegistrationMagic
- Fixed in
- 6.0.9.9
- What to do
- Update RegistrationMagic to 6.0.9.9 or newer.
Sep 2, 2026JetBackup: Does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privilegesCVE-2026-19453 · WordPress plugins & themes · reported by WPScanHigh 7.1
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
- Product
- JetBackup
- Fixed in
- 3.1.23.5
- What to do
- Update JetBackup to 3.1.23.5 or newer.
Sep 1, 2026Simple Membership: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-77194 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1.
- Product
- Simple Membership
- Affected
- up to 4.8.0
- What to do
- Affects up to 4.8.0. Update Simple Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 1, 2026Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-19806 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `wp_rand(10, 99)` values and a Unix timestamp via `md5()` — yielding approximately 19.5 bits of entropy — combined with a deterministic IV derived from the password, no authentication tag on the ciphertext, and no capability check, nonce, or session validation on the publicly reachable `/sgnix/?p=<token>` endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, who can obtain a single legitimate guest ticket token as a known-plaintext oracle and bound the plugin activation timestamp, to exhaust the ~729,000-candidate keyspace entirely offline, recover the site-wide encryption key, and forge a self-consistent `{ticket_id, ticket_user}` token targeting any administrator-owned ticket. Submitting the forged token to the unprotected endpoint causes `w
- Product
- Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System
- Affected
- up to 1.4.52
- What to do
- Affects up to 1.4.52. Update Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2026Groundhogg — CRM, Newsletters, and Marketing Automation: Does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative areaCVE-2026-81660 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.
- Product
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Fixed in
- 4.5.13
- What to do
- Update Groundhogg — CRM, Newsletters, and Marketing Automation to 4.5.13 or newer.
Aug 27, 2026Defender Security: Does not restrict a network-wide setting to network administratorsCVE-2026-19225 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Defender Security
- Fixed in
- 6.2.0
- What to do
- Update Defender Security to 6.2.0 or newer.
Aug 27, 2026Smush: Does not restrict a network-wide setting to network administratorsCVE-2026-19223 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Smush
- Fixed in
- 4.3.2
- What to do
- Update Smush to 4.3.2 or newer.
Aug 26, 2026AI Engine: Does not perform an authorisation check on one of its administration-only featuresCVE-2026-75798 · WordPress plugins & themes · reported by WPScanMedium 5.3
The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account.
- Product
- AI Engine
- Fixed in
- 3.7.2
- What to do
- Update AI Engine to 3.7.2 or newer.
Aug 22, 2026Forminator Forms: Does not restrict a network-wide setting to network administratorsCVE-2026-19221 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Forminator Forms
- Fixed in
- 1.57.0.5
- What to do
- Update Forminator Forms to 1.57.0.5 or newer.
Aug 21, 2026LitExtension: Does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication tokenCVE-2026-15046 · WordPress plugins & themes · reported by WPScanMedium 4.2
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
- Product
- LitExtension
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update LitExtension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026ProSolution WP Client: Does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pagesCVE-2026-19056 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.11
- What to do
- Update ProSolution WP Client to 2.0.11 or newer.
Aug 16, 2026All-in-One WP Migration and Backup: Does not restrict its migration import functionality to network administrators on multisite installationsCVE-2026-17533 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.
- Product
- All-in-One WP Migration and Backup
- Fixed in
- 7.108
- What to do
- Update All-in-One WP Migration and Backup to 7.108 or newer.
Aug 13, 2026Samex - Clean, Minimal Shop WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-28154 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7.
- Product
- Samex - Clean, Minimal Shop WooCommerce
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Samex - Clean, Minimal Shop WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 13, 2026Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.CVE-2026-73346 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 13, 2026Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.CVE-2026-61967 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026ProSolution WP Client: Does not perform capability checks on two administrative AJAX actionsCVE-2026-19052 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation and to clear the ProSolution WP Client WordPress plugin before 2.0.9's activity records.
- Product
- ProSolution WP Client
- Fixed in
- 2.0.9
- What to do
- Update ProSolution WP Client to 2.0.9 or newer.
Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license keyCVE-2026-18046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.
- Product
- Cookie Consent
- Fixed in
- 0.0.10
- What to do
- Update Cookie Consent to 0.0.10 or newer.
Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on its consent-settings REST routesCVE-2026-15388 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
- Product
- Cookie Consent
- Fixed in
- 0.0.10
- What to do
- Update Cookie Consent to 0.0.10 or newer.
Aug 10, 2026AutoNetTV Relay: Does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization taskCVE-2026-13600 · WordPress plugins & themes · reported by WPScanHigh 8.1
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
- Product
- AutoNetTV Relay
- Fixed in
- 3.0.14
- What to do
- Update AutoNetTV Relay to 3.0.14 or newer.
Aug 9, 2026LWS Optimize: Does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboardCVE-2026-16032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
- Product
- LWS Optimize
- Fixed in
- 4.1.2
- What to do
- Update LWS Optimize to 4.1.2 or newer.
Aug 6, 2026miniOrange 2FA: Does not correctly limit the number of second-factor verification attemptsCVE-2026-16619 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
- Product
- miniOrange 2FA
- Fixed in
- 6.2.8
- What to do
- Update miniOrange 2FA to 6.2.8 or newer.
Aug 6, 2026Easy Booking: Does not re-enforce a bookable product's configured minimum booking duration on the server sideCVE-2026-14831 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.
- Product
- Easy Booking
- Fixed in
- 3.5.0
- What to do
- Update Easy Booking to 3.5.0 or newer.
Aug 6, 2026The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enableCVE-2026-14812 · WordPress plugins & themes · reported by WPScanCritical 10
The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.
- What to do
- Update the plugin to the newest version.
Aug 5, 2026miniOrange 2FA: Does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factorCVE-2026-16036 · WordPress plugins & themes · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.
- Product
- miniOrange 2FA
- Fixed in
- 6.2.7
- What to do
- Update miniOrange 2FA to 6.2.7 or newer.
Aug 4, 2026miniOrange 2FA: Does not restrict who can trigger its second-factor configuration OTP sendCVE-2026-16035 · WordPress plugins & themes · reported by WPScanMedium 4.3
The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.
- Product
- miniOrange 2FA
- Fixed in
- 6.2.7
- What to do
- Update miniOrange 2FA to 6.2.7 or newer.
Aug 4, 2026Nested Pages: Does not properly escape post titles before outputting them into HTML attributes on an administrative listing screenCVE-2026-15233 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen.
- Product
- Nested Pages
- Fixed in
- 3.2.15
- What to do
- Update Nested Pages to 3.2.15 or newer.
Aug 3, 2026Simply Schedule Appointments: Does not perform a capability check on an administrative appointment-listing shortcodeCVE-2026-15254 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
- Product
- Simply Schedule Appointments
- Fixed in
- 1.6.12.11
- What to do
- Update Simply Schedule Appointments to 1.6.12.11 or newer.
Aug 1, 2026Podlove Podcast Publisher: Does not perform nonce validation on some of its administrative create and delete actionsCVE-2026-13729 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
- Product
- Podlove Podcast Publisher
- Fixed in
- 4.5.3
- What to do
- Update Podlove Podcast Publisher to 4.5.3 or newer.
Jul 31, 2026GiveWP: Does not restrict the set of available payment gateways to those enabled by the administratorCVE-2026-14317 · WordPress plugins & themes · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.
- Product
- GiveWP
- Fixed in
- 4.16.3
- What to do
- Update GiveWP to 4.16.3 or newer.
Jul 31, 2026ElementsKit Elementor Addons: Does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPCVE-2026-13392 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.
- Product
- ElementsKit Elementor Addons
- Fixed in
- 3.10.01
- What to do
- Update ElementsKit Elementor Addons to 3.10.01 or newer.
Jul 31, 2026miniOrange 2FA: Does not validate the submitted one-time password against the targeted user's stored secretCVE-2026-12695 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.
- Product
- miniOrange 2FA
- Fixed in
- 6.2.6
- What to do
- Update miniOrange 2FA to 6.2.6 or newer.
Jul 31, 2026Ultimate Member: Does not filter administrator-level capabilities from the roles it makes selectable on its registration formsCVE-2026-12251 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form.
- Product
- Ultimate Member
- Fixed in
- 2.12.1
- What to do
- Update Ultimate Member to 2.12.1 or newer.
Jul 30, 2026WP Hotel Booking: Does not sanitise and escape a search parameter on an administrative listing before using it in a SQL queryCVE-2026-15153 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
- Product
- WP Hotel Booking
- Fixed in
- 2.3.2
- What to do
- Update WP Hotel Booking to 2.3.2 or newer.
Jul 29, 2026miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn): Does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued forCVE-2026-14300 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
- Product
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Fixed in
- 7.8.0
- What to do
- Update miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) to 7.8.0 or newer.
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.CVE-2026-61957 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.CVE-2026-66476 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
- Affected
- up to 3.6.9
- What to do
- Affects up to 3.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.CVE-2026-66427 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
- Affected
- up to 18.4
- What to do
- Affects up to 18.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.CVE-2026-59537 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.
- Affected
- up to 2.10.22
- What to do
- Affects up to 2.10.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026WPBot: Does not validate administrator-configured field identifiers before using them in a SQL queryCVE-2026-14189 · WordPress plugins & themes · reported by WPScanLow 3.8
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
- Product
- WPBot
- Fixed in
- 8.5.2
- What to do
- Update WPBot to 8.5.2 or newer.
Jul 23, 2026Administrator PHP Object Injection in Complianz <= 7.5.0 versions.CVE-2026-65497 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Administrator PHP Object Injection in Complianz <= 7.5.0 versions.
- Affected
- up to 7.5.0
- What to do
- Affects up to 7.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.CVE-2026-65462 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
- Affected
- up to 7.3.2
- What to do
- Affects up to 7.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.CVE-2026-65461 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.CVE-2026-65455 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
- Affected
- up to 8.14.0
- What to do
- Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.