Vulnerability database

11,567 results · page 20 of 232

• Jul 13, 2026Dør: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57792 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.

  Product

  Dør

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Dør to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Brook: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57791 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

  Product

  Brook

  Affected

  up to 2.9.0

  What to do

  Affects up to 2.9.0. Update Brook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Billey: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57790 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.

  Product

  Billey

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update Billey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Aqua: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57789 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.

  Product

  Aqua

  Affected

  up to 5.1.2

  What to do

  Affects up to 5.1.2. Update Aqua to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Aalto: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57788 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.

  Product

  Aalto

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Aalto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026CWS SVGicons: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57787 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through <= 1.5.5.

  Product

  CWS SVGicons

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update CWS SVGicons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Speaker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57783 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue affects Speaker: from n/a through <= 4.1.13.

  Product

  Speaker

  Affected

  up to 4.1.13

  What to do

  Affects up to 4.1.13. Update Speaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Envision Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57780 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-builder allows DOM-Based XSS.This issue affects Envision Page Builder: from n/a through <= 0.22.

  Product

  Envision Page Builder

  Affected

  up to 0.22

  What to do

  Affects up to 0.22. Update Envision Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Advanced Shipment Tracking for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57773 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through <= 4.0.

  Product

  Advanced Shipment Tracking for WooCommerce

  Affected

  up to 4.0

  What to do

  Affects up to 4.0. Update Advanced Shipment Tracking for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026WP Inventory Manager: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57772 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through <= 2.4.0.

  Product

  WP Inventory Manager

  Affected

  up to 2.4.0

  What to do

  Affects up to 2.4.0. Update WP Inventory Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026GD Rating System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57771 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.

  Product

  GD Rating System

  Affected

  up to 3.7

  What to do

  Affects up to 3.7. Update GD Rating System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026RT-Theme 18 | Extensions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57745 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  Product

  RT-Theme 18 | Extensions

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update RT-Theme 18 | Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026RT-Theme 18 | Extensions: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-57743 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

  Product

  RT-Theme 18 | Extensions

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update RT-Theme 18 | Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026AcyMailing SMTP Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57741 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Stored XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

  Product

  AcyMailing SMTP Newsletter

  Affected

  up to 10.11.0

  What to do

  Affects up to 10.11.0. Update AcyMailing SMTP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026AcyMailing SMTP Newsletter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57739 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

  Product

  AcyMailing SMTP Newsletter

  Affected

  up to 10.11.0

  What to do

  Affects up to 10.11.0. Update AcyMailing SMTP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026tagDiv Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57734 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.

  Product

  tagDiv Composer

  Affected

  up to 5.4.3

  What to do

  Affects up to 5.4.3. Update tagDiv Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026tagDiv Cloud Library: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57733 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through <= 3.9.4.

  Product

  tagDiv Cloud Library

  Affected

  up to 3.9.4

  What to do

  Affects up to 3.9.4. Update tagDiv Cloud Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026tagDiv Opt-In Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57732 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows DOM-Based XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.4.

  Product

  tagDiv Opt-In Builder

  Affected

  up to 1.7.4

  What to do

  Affects up to 1.7.4. Update tagDiv Opt-In Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Flatsome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57728 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This issue affects Flatsome: from n/a through <= 3.20.5.

  Product

  Flatsome

  Affected

  up to 3.20.5

  What to do

  Affects up to 3.20.5. Update Flatsome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Kirki: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57726 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.

  Product

  Kirki

  Affected

  up to 6.0.12

  What to do

  Affects up to 6.0.12. Update Kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Kirki: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57725 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.

  Product

  Kirki

  Affected

  up to 6.0.11

  What to do

  Affects up to 6.0.11. Update Kirki to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Aimogen Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-57719 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3.

  Product

  Aimogen Pro

  Affected

  up to 2.8.3

  What to do

  Affects up to 2.8.3. Update Aimogen Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57718 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 2.0.12.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 2.0.12

  What to do

  Affects up to 2.0.12. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Fluent CRM: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57715 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.

  Product

  Fluent CRM

  Affected

  up to 3.1.7

  What to do

  Affects up to 3.1.7. Update Fluent CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026LatePoint: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57714 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.

  Product

  LatePoint

  Affected

  up to 5.6.3

  What to do

  Affects up to 5.6.3. Update LatePoint to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026WPZOOM Portfolio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57712 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Portfolio wpzoom-portfolio allows Reflected XSS.This issue affects WPZOOM Portfolio: from n/a through <= 1.4.29.

  Product

  WPZOOM Portfolio

  Affected

  up to 1.4.29

  What to do

  Affects up to 1.4.29. Update WPZOOM Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026SupportCandy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57711 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PSM Plugins SupportCandy supportcandy allows Stored XSS.This issue affects SupportCandy: from n/a through <= 3.4.8.

  Product

  SupportCandy

  Affected

  up to 3.4.8

  What to do

  Affects up to 3.4.8. Update SupportCandy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Membership For WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57709 · WordPress plugins & themes · reported by PatchstackHigh 8.6

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Path Traversal.This issue affects Membership For WooCommerce: from n/a through <= 3.1.0.

  Product

  Membership For WooCommerce

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update Membership For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Contact Form Entries: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57708 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Contact Form Entries contact-form-entries allows Reflected XSS.This issue affects Contact Form Entries: from n/a through <= 1.5.2.

  Product

  Contact Form Entries

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Contact Form Entries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Simple Business Directory Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57707 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.

  Product

  Simple Business Directory Pro

  Affected

  up to 15.9.4

  What to do

  Affects up to 15.9.4. Update Simple Business Directory Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Dokan: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57706 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan, Inc. Dokan dokan-lite allows Reflected XSS.This issue affects Dokan: from n/a through <= 5.0.6.

  Product

  Dokan

  Affected

  up to 5.0.6

  What to do

  Affects up to 5.0.6. Update Dokan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57702 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blind SQL Injection.This issue affects Amelia: from n/a through <= 2.4.2.

  Product

  Amelia

  Affected

  up to 2.4.2

  What to do

  Affects up to 2.4.2. Update Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Document Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57695 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through <= 5.1.0.

  Product

  Document Gallery

  Affected

  up to 5.1.0

  What to do

  Affects up to 5.1.0. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57693 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ad Inserter: from n/a through <= 2.8.11.

  Product

  Ad Inserter

  Affected

  up to 2.8.11

  What to do

  Affects up to 2.8.11. Update Ad Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Anti-Malware Security and Brute-Force Firewall: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57691 · WordPress plugins & themes · reported by PatchstackMedium 5.8

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli Anti-Malware Security and Brute-Force Firewall gotmls allows Reflected XSS.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through <= 4.23.89.

  Product

  Anti-Malware Security and Brute-Force Firewall

  Affected

  up to 4.23.89

  What to do

  Affects up to 4.23.89. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57668 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.2.2.

  Product

  NEX-Forms

  Affected

  up to 9.2.2

  What to do

  Affects up to 9.2.2. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Message Filter for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57423 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter allows Reflected XSS.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.8.

  Product

  Message Filter for Contact Form 7

  Affected

  up to 1.6.3.8

  What to do

  Affects up to 1.6.3.8. Update Message Filter for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Bopo – WooCommerce Product Bundle Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57422 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Reflected XSS.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through <= 1.2.0.

  Product

  Bopo – WooCommerce Product Bundle Builder

  Affected

  up to 1.2.0

  What to do

  Affects up to 1.2.0. Update Bopo – WooCommerce Product Bundle Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026CRM Perks Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57421 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms: from n/a through <= 1.1.7.

  Product

  CRM Perks Forms

  Affected

  up to 1.1.7

  What to do

  Affects up to 1.1.7. Update CRM Perks Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Author Box WP Lens: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57420 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through <= 2.1.5.

  Product

  Author Box WP Lens

  Affected

  up to 2.1.5

  What to do

  Affects up to 2.1.5. Update Author Box WP Lens to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Cart Lift: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57417 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue affects Cart Lift: from n/a through <= 3.1.57.

  Product

  Cart Lift

  Affected

  up to 3.1.57

  What to do

  Affects up to 3.1.57. Update Cart Lift to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026SiteGround Email Marketing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57416 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.5.

  Product

  SiteGround Email Marketing

  Affected

  up to 1.7.5

  What to do

  Affects up to 1.7.5. Update SiteGround Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Gift Vouchers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57415 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codemenschen Gift Vouchers gift-voucher allows Stored XSS.This issue affects Gift Vouchers: from n/a through <= 4.7.0.

  Product

  Gift Vouchers

  Affected

  up to 4.7.0

  What to do

  Affects up to 4.7.0. Update Gift Vouchers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026ChatBot for eCommerce &#8211; WoowBot: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57414 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot for eCommerce &#8211; WoowBot woowbot-woocommerce-chatbot allows Stored XSS.This issue affects ChatBot for eCommerce &#8211; WoowBot: from n/a through <= 4.6.1.

  Product

  ChatBot for eCommerce &#8211; WoowBot

  Affected

  up to 4.6.1

  What to do

  Affects up to 4.6.1. Update ChatBot for eCommerce &#8211; WoowBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Instant Image Generator: Server-Side Request Forgery (SSRF)CVE-2026-57413 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows Server Side Request Forgery.This issue affects Instant Image Generator: from n/a through <= 2.1.4.

  Product

  Instant Image Generator

  Affected

  up to 2.1.4

  What to do

  Affects up to 2.1.4. Update Instant Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026CF7 Views &#8211; Complete Entry Management for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57411 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Views &#8211; Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views &#8211; Complete Entry Management for Contact Form 7: from n/a through <= 3.2.2.

  Product

  CF7 Views &#8211; Complete Entry Management for Contact Form 7

  Affected

  up to 3.2.2

  What to do

  Affects up to 3.2.2. Update CF7 Views &#8211; Complete Entry Management for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Active Products Tables for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57409 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows DOM-Based XSS.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.1.0.

  Product

  Active Products Tables for WooCommerce

  Affected

  up to 1.1.0

  What to do

  Affects up to 1.1.0. Update Active Products Tables for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026GD Security Headers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57403 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Security Headers gd-security-headers allows Reflected XSS.This issue affects GD Security Headers: from n/a through <= 1.8.

  Product

  GD Security Headers

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update GD Security Headers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026Flexible Refund and Return Order for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57402 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from n/a through <= 1.0.51.

  Product

  Flexible Refund and Return Order for WooCommerce

  Affected

  up to 1.0.51

  What to do

  Affects up to 1.0.51. Update Flexible Refund and Return Order for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jul 13, 2026SureDash: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57401 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.

  Product

  SureDash

  Affected

  up to 1.8.0

  What to do

  Affects up to 1.8.0. Update SureDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.