Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
577 results · page 2 of 12
Sep 15, 2026WP Directory Kit: Does not sanitize and escape some widget settings before using them in a SQL statementCVE-2026-16593 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.
- Product
- WP Directory Kit
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 15, 2026WP Directory Kit: Does not check authorization or listing visibility in one of its shortcodesCVE-2026-16592 · WordPress plugins & themes · reported by WPScanLow 2.7
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
- Product
- WP Directory Kit
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2026Bookit — Booking & Appointment Calendar: Does not properly restrict the data returned by an availability-check requestCVE-2026-88995 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
- Product
- Bookit — Booking & Appointment Calendar
- Fixed in
- 2.6.0.1
- What to do
- Update Bookit — Booking & Appointment Calendar to 2.6.0.1 or newer.
Sep 12, 2026Royal Addons for Elementor – Addons and Templates Kit for Elementor: Sensitive Information ExposureCVE-2026-17585 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
- Product
- Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Affected
- up to 1.7.1066
- What to do
- Affects up to 1.7.1066. Update Royal Addons for Elementor – Addons and Templates Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.CVE-2026-62139 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.
- Affected
- up to 1.186.0
- What to do
- Affects up to 1.186.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.CVE-2026-62133 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.CVE-2026-81805 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026WP BackItUp Community Edition: Directory TraversalCVE-2026-18386 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup_file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The basename() normalization present in the handler only executes when the traversed target path does not exist, providing no protection against reads of existing files.
- Product
- WP BackItUp Community Edition
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP BackItUp Community Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 7, 2026Powerkit: Stored Cross-Site ScriptingCVE-2026-2390 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Powerkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2026Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.CVE-2026-84767 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
- Affected
- up to 2.6.0.3
- What to do
- Affects up to 2.6.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.CVE-2026-84763 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.CVE-2026-84752 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor: Stored Cross-Site ScriptingCVE-2026-2573 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 2, 2026GutenKit: Does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front endCVE-2026-19698 · WordPress plugins & themes · reported by WPScanLow 3.5
The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into pages served to other users and to anonymous visitors. JavaScript execution is not possible at that role, so the impact is limited to defacement, interface redressing and forcing external resources to load.
- Product
- GutenKit
- Fixed in
- 2.5.1
- What to do
- Update GutenKit to 2.5.1 or newer.
Sep 2, 2026DevKit Pro: Missing AuthorizationCVE-2026-14357 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary theme ZIP packages containing PHP files that are extracted into the web-accessible wp-content/themes/ directory, which may make remote code execution possible.
- Product
- DevKit Pro
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update DevKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddplugins.comwordfence.com
Sep 1, 2026The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerableCVE-2026-75921 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instead of the manage_options required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the edit_pages capability.
- Affected
- up to 3.1.9
- What to do
- Affects up to 3.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2026ElementsKit Pro: Stored Cross-Site ScriptingCVE-2026-4246 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at /wp-json/elementskit/v1/advanced-search uses permission_callback set to __return_true, allowing unauthenticated access. Search terms are stored in the ekit_advanced_search_popular_keyword WordPress option via update_option(). While sanitize_text_field() is applied, it does not encode double quotes, and the stored keywords are rendered in HTML attributes via sprintf without esc_attr(), allowing attribute injection. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user triggers the "no results" popular keywords view on pages using the Advanced Search widget.
- Product
- ElementsKit Pro
- Affected
- up to 4.10.1
- What to do
- Affects up to 4.10.1. Update ElementsKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 27, 2026Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.CVE-2026-32550 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.CVE-2026-27364 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.
- Affected
- up to 2.6.5
- What to do
- Affects up to 2.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026GutenKit: Does not have a sufficient capability check on some of its REST API endpointsCVE-2026-19699 · WordPress plugins & themes · reported by WPScanLow 2.7
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.
- Product
- GutenKit
- Fixed in
- 2.5.0
- What to do
- Update GutenKit to 2.5.0 or newer.
Aug 20, 2026GutenKit: Does not sanitise uploaded SVG files on all of the upload paths it enablesCVE-2026-19697 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
- Product
- GutenKit
- Fixed in
- 2.5.0
- What to do
- Update GutenKit to 2.5.0 or newer.
Aug 19, 2026WP Directory Kit: Does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rowsCVE-2026-18231 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.
- Product
- WP Directory Kit
- Fixed in
- 1.5.7
- What to do
- Update WP Directory Kit to 1.5.7 or newer.
Aug 18, 2026Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.CVE-2026-32553 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.
- Affected
- up to 1.1.35
- What to do
- Affects up to 1.1.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18653 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.
- Product
- WP Directory Kit
- Fixed in
- 1.5.7
- What to do
- Update WP Directory Kit to 1.5.7 or newer.
Aug 14, 2026affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display: Time-based SQL InjectionCVE-2026-12743 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
- Affected
- up to 3.8.8
- What to do
- Affects up to 3.8.8. Update affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2026Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.CVE-2026-28186 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-28001 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2026Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.CVE-2026-27538 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2026-18474 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
- Product
- WP Directory Kit
- Fixed in
- 1.5.6
- What to do
- Update WP Directory Kit to 1.5.6 or newer.
Aug 12, 2026WP Directory Kit: Does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-18230 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
- Product
- WP Directory Kit
- Fixed in
- 1.5.6
- What to do
- Update WP Directory Kit to 1.5.6 or newer.
Aug 12, 2026Patterns Kit: Does not escape a link attribute before its client-side script inserts it into the pageCVE-2026-15249 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.
- Product
- Patterns Kit
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Patterns Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 9, 2026WP Directory Kit: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2026-18473 · WordPress plugins & themes · reported by WPScanCritical 9.1
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16595 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16594 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 8, 2026WP Directory Kit: Does not perform authorization or nonce checks on one of its authenticated AJAX actionsCVE-2026-16590 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 8, 2026WP Directory Kit: Does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actionsCVE-2026-16589 · WordPress plugins & themes · reported by WPScanHigh 7.7
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
- Product
- WP Directory Kit
- Fixed in
- 1.5.5
- What to do
- Update WP Directory Kit to 1.5.5 or newer.
Aug 6, 2026Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.CVE-2026-65549 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
- Affected
- up to 3.2.10
- What to do
- Affects up to 3.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.CVE-2026-28178 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.CVE-2026-25403 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2026-18435 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Block Attribute in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Kadence Blocks — Page Builder Toolkit for Gutenberg Editor: Stored Cross-Site ScriptingCVE-2026-18062 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only triggerable when the block's urlTransparent attribute is set to a non-empty value, as this is a required precondition for the vulnerable code path in build_html() to be reached.
- Product
- Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Affected
- up to 3.7.8.1
- What to do
- Affects up to 3.7.8.1. Update Kadence Blocks — Page Builder Toolkit for Gutenberg Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Powerkit – Supercharge your WordPress Site: Stored Cross-Site ScriptingCVE-2026-15649 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit – Supercharge your WordPress Site
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Powerkit – Supercharge your WordPress Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Powerkit – Supercharge your WordPress Site: Stored Cross-Site ScriptingCVE-2026-15645 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit – Supercharge your WordPress Site
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Powerkit – Supercharge your WordPress Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Powerkit – Supercharge your WordPress Site: Stored Cross-Site ScriptingCVE-2026-15644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Powerkit – Supercharge your WordPress Site
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Powerkit – Supercharge your WordPress Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026Jeg Kit for Elementor: Sensitive Information ExposureCVE-2026-2916 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys.
- Product
- Jeg Kit for Elementor
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Jeg Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2026DynamicKit for Elementor: Does not validate the host of a user-supplied URL usedCVE-2026-14596 · WordPress plugins & themes · reported by WPScanHigh 8.8
The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it.
- Product
- DynamicKit for Elementor
- Fixed in
- 1.0.3
- What to do
- Update DynamicKit for Elementor to 1.0.3 or newer.
Aug 1, 2026Everest Toolkit: Does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled)CVE-2026-13158 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.
- Product
- Everest Toolkit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Everest Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 31, 2026ElementsKit Elementor Addons: Does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front endCVE-2026-13393 · WordPress plugins & themes · reported by WPScanLow 3.5
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious JavaScript; on a multisite network this lets a non-super subsite Administrator, who is denied unfiltered_html, plant a stored Cross-Site Scripting payload that executes in the sessions of the network Super Admin and site visitors.
- Product
- ElementsKit Elementor Addons
- Fixed in
- 3.10.01
- What to do
- Update ElementsKit Elementor Addons to 3.10.01 or newer.
Jul 31, 2026ElementsKit Elementor Addons: Does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPCVE-2026-13392 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.
- Product
- ElementsKit Elementor Addons
- Fixed in
- 3.10.01
- What to do
- Update ElementsKit Elementor Addons to 3.10.01 or newer.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.CVE-2026-65505 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.