Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

253 results · page 2 of 6

Aug 1, 2026GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Stored Cross-Site ScriptingCVE-2026-16090 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in 'gamipress_achievement' in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress save-time wp_kses_post does not neutralize this payload because the injected value is stored inside a shortcode attribute rather than as a raw HTML tag, and is only emitted into HTML at render time without escaping.
Product
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.9.9.1
What to do
Affects up to 7.9.9.1. Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 1, 2026MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: Stored Cross-Site ScriptingCVE-2026-15052 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
Affected
up to 4.3.3
What to do
Affects up to 4.3.3. Update MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2026Demi: Stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protectionCVE-2026-14333 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.
Product
Demi
Fixed in
0.0.7
What to do
Update Demi to 0.0.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Customer Switching: Does not securely bind an active user-switching session to the operator who initiated itCVE-2026-15240 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.
Product
Customer Switching
Fixed in
2.1.3
What to do
Update Customer Switching to 2.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Stored Cross-Site ScriptingCVE-2026-15730 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied at post save does not neutralize this payload because only the inert shortcode text is stored in post_content; the dangerous HTML is synthesized at render time by the shortcode handler, entirely bypassing save-time sanitization.
Product
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.9.9.1
What to do
Affects up to 7.9.9.1. Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2026MainWP Child: Does not verify the requester's identity in its site-registration request handlerCVE-2026-12255 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Product
MainWP Child
Fixed in
6.1.2
What to do
Update MainWP Child to 6.1.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Printcart Web to Print Product Designer for WooCommerce: Does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization checkCVE-2025-15662 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources.
Product
Printcart Web to Print Product Designer for WooCommerce
Fixed in
2.5.3
What to do
Update Printcart Web to Print Product Designer for WooCommerce to 2.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.CVE-2026-57397 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.
Affected
up to 3.9.2
What to do
Affects up to 3.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 21, 2026Bit Form: Does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification emailCVE-2026-13693 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.
Product
Bit Form
Fixed in
3.1.0
What to do
Update Bit Form to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 9, 2026Connect Contact Form 7 and Mailchimp: Stored Cross-Site ScriptingCVE-2026-15000 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up to, and including, 0.9.78.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is only triggered when a privileged user (Administrator) performs a Contact Lookup for the email address submitted via the CF7 form, meaning execution is deferred until an administrator interacts with the affected entry.
Product
Connect Contact Form 7 and Mailchimp
Affected
up to 0.9.78.06
What to do
Affects up to 0.9.78.06. Update Connect Contact Form 7 and Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Insecure Direct Object ReferenceCVE-2026-13450 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view private GamiPress activity log entries belonging to any user, including badge earnings, points balance changes, and event records from integrated plugins such as WooCommerce, LearnDash, and BuddyPress. This is exploitable by any unauthenticated visitor because the required 'gamipress' nonce is broadcast to all front-end users via wp_localize_script on the wp_enqueue_scripts hook, making the sole authentication barrier trivially bypassable.
Product
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.9.4
What to do
Affects up to 7.9.4. Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 9, 2026Fediverse Embeds: Does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching itCVE-2026-12517 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.
Product
Fediverse Embeds
Fixed in
1.5.8
What to do
Update Fediverse Embeds to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 7, 2026DoLeads Integrator WordPress plugin through 0.65, wp2epub: Have been seen to be used to achieve RCECVE-2026-4375 · WordPress plugins & themes · reported by WPScanCritical 9
The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users.
Product
DoLeads Integrator WordPress plugin through 0.65, wp2epub
Affected
up to 0.65
What to do
Affects up to 0.65. Update DoLeads Integrator WordPress plugin through 0.65, wp2epub to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.CVE-2026-27402 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.CVE-2025-69156 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.
Affected
up to 5.4
What to do
Affects up to 5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.CVE-2026-57655 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-56063 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.CVE-2026-27366 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.CVE-2026-49765 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026BBS e-Franchise 1.1.1: SQL injectionCVE-2016-20072 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.
Product
BBS e-Franchise 1.1.1
What to do
Update BBS e-Franchise 1.1.1 to the newest version.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
May 27, 2026Single Mailchimp: Stored Cross-Site ScriptingCVE-2026-8868 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Single Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'single-mailchimp' shortcode in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (autocomplete, label, placeholder, btn_text, success_msg, error_msg) which are concatenated directly into HTML output by the single_mailchimp() function in shortcodes.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Single Mailchimp
Affected
up to 1.4
What to do
Affects up to 1.4. Update Single Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 19, 2026Child Height Predictor by Ostheimer: Cross-Site Request ForgeryCVE-2026-6400 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Child Height Predictor by Ostheimer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.3. This is due to missing nonce verification in the options() function, which handles plugin settings updates. The form template does not include a wp_nonce_field() call, and the handler never calls check_admin_referer() or wp_verify_nonce(). This makes it possible for unauthenticated attackers to trick a site administrator into clicking a link or visiting a malicious page that submits a forged POST request, causing unauthorized changes to the plugin settings such as unit preferences to be persisted to the database via update_option().
Product
Child Height Predictor by Ostheimer
Affected
up to 1.3
What to do
Affects up to 1.3. Update Child Height Predictor by Ostheimer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2026CC Child Pages: Stored Cross-Site ScriptingCVE-2026-6174 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CC Child Pages
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update CC Child Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 22, 2026Sendmachine for: Authorization bypassCVE-2026-6235 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).
Product
Sendmachine for
Affected
up to 1.0.20
What to do
Affects up to 1.0.20. Update Sendmachine for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 15, 2026Coachific Shortcode: Stored Cross-Site ScriptingCVE-2026-4005 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() on the 'userhash' parameter, which strips HTML tags but does not escape characters significant in a JavaScript string context (such as double quotes, semicolons, and parentheses). The sanitized value is then directly interpolated into a JavaScript string within a <script> tag on line 29 without any JavaScript-specific escaping (e.g., wp_json_encode() or esc_js()). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Coachific Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Coachific Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026MainWP Child Reports: Missing AuthorizationCVE-2026-4299 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.
Product
MainWP Child Reports
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update MainWP Child Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2026JS Archive List: Deserialization of Untrusted DataCVE-2026-32513 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.
Product
JS Archive List
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update JS Archive List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Archicon: Deserialization of Untrusted DataCVE-2026-32506 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.
Product
Archicon
What to do
Update Archicon to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: Missing AuthorizationCVE-2026-25430 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CRM Perks Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms cf7-mailchimp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through <= 1.2.2.
Product
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026PeproDev Ultimate Invoice: Has a bulk download invoices action that generates ZIP archives containing exported invoice PDFsCVE-2026-2343 · WordPress plugins & themes · reported by WPScanMedium 5.3
The PeproDev Ultimate Invoice WordPress plugin through 2.2.5 has a bulk download invoices action that generates ZIP archives containing exported invoice PDFs. The ZIP files are named predictably making it possible to brute force and retreive PII.
Product
PeproDev Ultimate Invoice
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update PeproDev Ultimate Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2026Pochipp: Missing AuthorizationCVE-2026-32417 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through < 1.18.9.
Product
Pochipp
What to do
Update Pochipp to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 13, 2026Collapsing Archives: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-32365 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through <= 3.0.7.
Product
Collapsing Archives
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Collapsing Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 10, 2026MC4WP: Mailchimp for: Missing AuthorizationCVE-2026-1781 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source).
Product
MC4WP: Mailchimp for
Affected
up to 4.11.1
What to do
Affects up to 4.11.1. Update MC4WP: Mailchimp for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org github.com
Mar 6, 2026MailArchiver: Stored Cross-Site ScriptingCVE-2026-2721 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
MailArchiver
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update MailArchiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Mar 6, 2026JS Archive List: PHP Object InjectionCVE-2026-2020 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The JS Archive List plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.1.7 via the 'included' shortcode attribute. This is due to the deserialization of untrusted input supplied via the 'included' parameter of the plugin's shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
JS Archive List
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update JS Archive List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Architecturer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.
Product
Architecturer
What to do
Update Architecturer to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 27, 2026MailArchiver: SQL InjectionCVE-2026-2831 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MailArchiver
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update MailArchiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 20, 2026PJ | Life & Business Coaching: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69409 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes PJ | Life & Business Coaching pj allows PHP Local File Inclusion.This issue affects PJ | Life & Business Coaching: from n/a through <= 3.0.0.
Product
PJ | Life & Business Coaching
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update PJ | Life & Business Coaching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Simple Archive Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
Product
Simple Archive Generator
Affected
up to 5.2
What to do
Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Coachify: Cross-Site Request Forgery (CSRF)CVE-2026-25337 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through <= 1.1.5.
Product
Coachify
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Coachify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Coachify: Missing AuthorizationCVE-2026-25336 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in wpcoachify Coachify coachify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coachify: from n/a through <= 1.1.5.
Product
Coachify
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Coachify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Mailchimp List Subscribe Form: Cross-Site Request ForgeryCVE-2025-12172 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mailchimp List Subscribe Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to missing or incorrect nonce validation on the mailchimp_sf_change_list_if_necessary() function. This makes it possible for unauthenticated attackers to change Mailchimp lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Mailchimp List Subscribe Form
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Mailchimp List Subscribe Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 14, 2026MailChimp Campaigns: Missing AuthorizationCVE-2026-1303 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The MailChimp Campaigns plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.2.4. This is due to missing capability checks on the `mailchimp_campaigns_manager_disconnect_app` function that is hooked to the AJAX action of the same name. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the site from its MailChimp synchronization app, disrupting automated email campaigns and marketing integrations.
Product
MailChimp Campaigns
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update MailChimp Campaigns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2026Orchid Store: Missing AuthorizationCVE-2026-24612 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orchid Store: from n/a through <= 1.5.15.
Product
Orchid Store
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update Orchid Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 6, 2026GamiPress – Gamification plugin to reward points, achievements, badges & ranks in: Unauthorized access of dataCVE-2025-13812 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate users, including their email addresses and to retrieve titles of private posts.
Product
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in
Affected
up to 7.6.1
What to do
Affects up to 7.6.1. Update GamiPress – Gamification plugin to reward points, achievements, badges & ranks in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 5, 2026Machic Core: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2023-49186 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This issue affects Machic Core: from n/a through 1.2.6.
Product
Machic Core
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Machic Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vdp.patchstack.com
Dec 31, 2025Varnish/Nginx Proxy Caching: Insertion of Sensitive Information Into Sent DataCVE-2025-62126 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.
Product
Varnish/Nginx Proxy Caching
Affected
up to 1.8.3
What to do
Affects up to 1.8.3. Update Varnish/Nginx Proxy Caching to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025WP-EasyArchives: Cross-Site Request Forgery (CSRF)CVE-2025-49345 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through <= 3.1.2.
Product
WP-EasyArchives
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update WP-EasyArchives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 31, 2025Simple Archive Generator: Cross-Site Request Forgery (CSRF)CVE-2025-49346 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
Product
Simple Archive Generator
Affected
up to 5.2
What to do
Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Dec 30, 2025contact-form-7-mailchimp-extension: Insertion of Sensitive Information Into Sent DataCVE-2025-68989 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-extension: from n/a through <= 0.9.68.
Product
contact-form-7-mailchimp-extension
Affected
up to 0.9.68
What to do
Affects up to 0.9.68. Update contact-form-7-mailchimp-extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.