Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

572 results · page 2 of 12

Sep 25, 2026Customer Reviews for WooCommerce: Authorization bypassCVE-2026-89055 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product images, logos, and documents — by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session.
Product
Customer Reviews for WooCommerce
Affected
up to 5.120.0
What to do
Affects up to 5.120.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026WP Yelp Review Slider: Stored Cross-Site ScriptingCVE-2026-93778 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account; it is introduced into the database during the site administrator's ordinary use of the plugin's Download Reviews feature, making the effective attacker unauthenticated.
Product
WP Yelp Review Slider
Affected
up to 9.2
What to do
Affects up to 9.2. Update WP Yelp Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026The WP Ultimate Review: Arbitrary shortcode executionCVE-2026-92235 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Product
The WP Ultimate Review
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update The WP Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026WP Customer Reviews: Reflected Cross-Site ScriptingCVE-2026-11608 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Customer Reviews
Affected
up to 3.7.8
What to do
Affects up to 3.7.8. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents: Reflected Cross-Site ScriptingCVE-2026-89330 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is a regression: the esc_url() wrapper that remediated the equivalent CVE-2023-5749 in version 3.9.2 was removed in version 4.3.0 during a refactor that introduced the 'unique' parameter.
Product
EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
Affected
up to 4.6.5
What to do
Affects up to 4.6.5. Update EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 17, 2026Event Booking Manager for WooCommerce: Does not restrict who can view its stored payment gateway configurationCVE-2026-91019 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.
Product
Event Booking Manager for WooCommerce
Fixed in
5.6.0
What to do
Update Event Booking Manager for WooCommerce to 5.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 17, 2026Motors: Does not verify that a request is authorized to view a user's non-published listings before returning themCVE-2026-91016 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
Product
Motors
Fixed in
1.4.121
What to do
Update Motors to 1.4.121 or newer.
Full record and what to do →NVD record wpscan.com
Sep 15, 20263D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery: Sensitive Information ExposureCVE-2026-15758 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge to target specific flipbooks.
Product
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
Affected
up to 1.16.20
What to do
Affects up to 1.16.20. Update 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 10, 2026Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.CVE-2026-81800 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 10, 2026Site Reviews: Does not prevent request data from being deserializedCVE-2026-82925 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The Site Reviews WordPress plugin before 8.3.0's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.
Product
Site Reviews
Fixed in
8.3.0
What to do
Update Site Reviews to 8.3.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026EmbedPress: Does not have proper authorization on a public review-loading actionCVE-2026-84936 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of attacker-controlled rows in the database.
Product
EmbedPress
Fixed in
4.6.4
What to do
Update EmbedPress to 4.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026EmbedPress: Does not perform a sufficient authorization check on one of its Google Reviews REST API routesCVE-2026-84927 · WordPress plugins & themes · reported by WPScanLow 2.7
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.
Product
EmbedPress
Fixed in
4.6.4
What to do
Update EmbedPress to 4.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026EmbedPress: Does not correctly restrict access to one of its Google Reviews REST routes to administratorsCVE-2026-84926 · WordPress plugins & themes · reported by WPScanLow 2.7
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.
Product
EmbedPress
Fixed in
4.6.4
What to do
Update EmbedPress to 4.6.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 5, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-8625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (Custom HTML block inner HTML)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can insert a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML block, whose inner HTML is passed as the title argument to parseThumbs() at render time, enabling both innerHTML injection into a span element and attribute breakout via an onerror handler on a constructed img element.
Product
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
Affected
up to 2.4.30
What to do
Affects up to 2.4.30. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 5, 2026Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer: Stored Cross-Site ScriptingCVE-2026-8623 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (class attribute of .dvcss element)' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is embedded as a Base64-encoded JSON object in a CSS class name on a Custom HTML block; the frontend parseCSSElements() function decodes it client-side with atob() and JSON.parse() and renders the logo property as raw HTML, meaning no server-side or client-side sanitization intercepts the malicious script before DOM insertion.
Product
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
Affected
up to 2.4.30
What to do
Affects up to 2.4.30. Update Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 4, 2026Content Views: Does not check whether the user requesting a view is allowed to read the posts it returnsCVE-2026-17517 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
Product
Content Views
Fixed in
4.5.1.2
What to do
Update Content Views to 4.5.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 2, 2026Rank Math SEO: Does not verify that the post whose schema it renders on the front end is publicly viewableCVE-2026-77783 · WordPress plugins & themes · reported by WPScanLow 3.7
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.
Product
Rank Math SEO
Fixed in
1.0.277
What to do
Update Rank Math SEO to 1.0.277 or newer.
Full record and what to do →NVD record wpscan.com
Aug 30, 2026Customer Reviews for WooCommerce: Does not sanitise and escape the content of customer reviews received via one of its endpointsCVE-2026-76585 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
Product
Customer Reviews for WooCommerce
Fixed in
5.118.0
What to do
Update Customer Reviews for WooCommerce to 5.118.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 28, 2026Customer Reviews for WooCommerce: Stored Cross-Site ScriptingCVE-2026-6176 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr_local_forms_submit' AJAX action without sanitizing HTML content before storing it via wp_insert_comment(), and later renders this stored content on product pages through comment_text() without proper escaping. This makes it possible for unauthenticated attackers with a valid review form URL (obtainable through review reminder emails sent to customers who placed orders) to inject arbitrary web scripts in pages that will execute whenever a user accesses the affected product page.
Product
Customer Reviews for WooCommerce
Affected
up to 5.106.0
What to do
Affects up to 5.106.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2026Reviews and Rating – Google Reviews: Stored Cross-Site ScriptingCVE-2026-2388 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wp_display() shortcode handler, used by multiple shortcodes, allowing attacker-controlled html_tags values to define raw HTML tags and then embedding untrusted vicinity content inside those tags. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Reviews and Rating – Google Reviews
Affected
up to 5.10
What to do
Affects up to 5.10. Update Reviews and Rating – Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 24, 2026PPWP – Password Protect WordPress | #1 Most-Reviewed Password: Stored Cross-Site ScriptingCVE-2025-9878 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
PPWP – Password Protect WordPress | #1 Most-Reviewed Password
Affected
up to 1.9.21
What to do
Affects up to 1.9.21. Update PPWP – Password Protect WordPress | #1 Most-Reviewed Password to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 19, 2026Easy Media Replace: Does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list viewCVE-2026-15253 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.
Product
Easy Media Replace
Affected
up to 0.2.0
What to do
Affects up to 0.2.0. Update Easy Media Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 19, 2026WCFM Marketplace: Does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deletedCVE-2026-14196 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.
Product
WCFM Marketplace
Fixed in
3.8.1
What to do
Update WCFM Marketplace to 3.8.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 18, 2026Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.CVE-2026-74007 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.
Affected
up to 1.16.20
What to do
Affects up to 1.16.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Site Reviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-73382 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.
Product
Site Reviews
Affected
up to 8.2.0
What to do
Affects up to 8.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2026Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.CVE-2026-32473 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 16, 2026PPWP – Password Protect WordPress | #1 Most-Reviewed Password: Insecure Direct Object ReferenceCVE-2025-10005 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppw_free_set_password AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the password on any password protected post and subsequently access the content.
Product
PPWP – Password Protect WordPress | #1 Most-Reviewed Password
Affected
up to 1.9.20
What to do
Affects up to 1.9.20. Update PPWP – Password Protect WordPress | #1 Most-Reviewed Password to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Aug 13, 2026Subscriber SQL Injection in Reviewer <= 3.14.2 versions.CVE-2026-66658 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Reviewer <= 3.14.2 versions.
Affected
up to 3.14.2
What to do
Affects up to 3.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2026Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versiCVE-2026-66466 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 10, 2026CheckView: Does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin beforeCVE-2026-18786 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.
Product
CheckView
Fixed in
2.3.2
What to do
Update CheckView to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Customer Reviews for WooCommerce: Does not perform nonce or capability checks on several settings-related AJAX actionsCVE-2026-14941 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
Product
Customer Reviews for WooCommerce
Fixed in
5.116.0
What to do
Update Customer Reviews for WooCommerce to 5.116.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026Slim SEO: Does not restrict a post-meta preview feature to posts the user is allowed to editCVE-2026-16957 · WordPress plugins & themes · reported by WPScanLow 2.7
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types.
Product
Slim SEO
Fixed in
4.9.11
What to do
Update Slim SEO to 4.9.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026MStore API: Does not perform authorization or purchase-ownership checks on its REST product-review creation routeCVE-2026-16041 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Product
MStore API
Fixed in
4.21.0
What to do
Update MStore API to 4.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Content Views: Does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL queryCVE-2026-15361 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
Product
Content Views
Fixed in
4.5
What to do
Update Content Views to 4.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscriptions for WooCommerce: Does not verify that the requester owns the subscription being viewed before rendering its detailsCVE-2026-15214 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.
Product
Subscriptions for WooCommerce
Fixed in
2.0.1
What to do
Update Subscriptions for WooCommerce to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026DataPress (Dataverse Integration): Does not properly restrict access to its template rendering feature and exposes the viewing user's data to itCVE-2026-5336 · WordPress plugins & themes · reported by WPScanMedium 6.8
The DataPress (Dataverse Integration) WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher privileged users who view the affected content.
Product
DataPress (Dataverse Integration)
Fixed in
2.91
What to do
Update DataPress (Dataverse Integration) to 2.91 or newer.
Full record and what to do →NVD record wpscan.com
Aug 6, 2026Gutenberg Essential Blocks: Does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routesCVE-2026-13154 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.
Product
Gutenberg Essential Blocks
Fixed in
6.4.0
What to do
Update Gutenberg Essential Blocks to 6.4.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026WP TripAdvisor Review Slider: Generic SQL InjectionCVE-2026-11969 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs[]' Parameter in all versions up to, and including, 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP TripAdvisor Review Slider
Affected
up to 14.3
What to do
Affects up to 14.3. Update WP TripAdvisor Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPresCVE-2026-17580 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the register_rest_routes. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive admin-authored editor content — including template markup, CSS code, JavaScript code, and PHP controller variables — for any Layout or Post Selection post on the site.
Affected
up to 3.9.1
What to do
Affects up to 3.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart: Authorization bypassCVE-2026-15411 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary attacker-controlled data. The 'ajd_protected' nonce used as the sole gate is exposed to unauthenticated visitors on every frontend page through the BoGo module's wp_localize_script call, rendering it ineffective as an authorization barrier.
Product
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart: Stored Cross-Site ScriptingCVE-2026-13440 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message_popup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because the 'ajd_protected' nonce required by the create_popup handler is exposed to all unauthenticated frontend visitors via wp_localize_script under bogo_save_url.ajd_nonce, effectively bypassing the nonce-only access control.
Product
StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer: Unauthorized access of dataCVE-2026-12124 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
Product
PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.CVE-2026-66428 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
Affected
up to 18.4
What to do
Affects up to 18.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.CVE-2026-66427 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
Affected
up to 18.4
What to do
Affects up to 18.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 27, 2026Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.CVE-2026-59552 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 24, 2026Rich Showcase for Google Reviews: Stored Cross-Site ScriptingCVE-2026-15739 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rich Showcase for Google Reviews
Affected
up to 6.9.9
What to do
Affects up to 6.9.9. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.CVE-2026-65479 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
Affected
up to 3.14.2
What to do
Affects up to 3.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.CVE-2026-59543 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.
Affected
up to 3.8.11
What to do
Affects up to 3.8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Grid/List View for WooCommerce: Stored Cross-Site ScriptingCVE-2026-15794 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The shortcode's all_page="1" attribute can be used to force the widget to render on any page, expanding the attack surface beyond shop and category pages.
Product
Grid/List View for WooCommerce
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update Grid/List View for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 20, 2026Reviews Feed: Does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic blockCVE-2026-10724 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode in a review on the connected source.
Product
Reviews Feed
Fixed in
2.6.5
What to do
Update Reviews Feed to 2.6.5 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.