Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,754exploited flaws on CISA’s list

33added in the last 30 days

298new WordPress flaws this week

13,899entries in the database

1,161 results · page 20 of 24

Mar 25, 2026Metagauss EventPrime eventprime-event-calendar-management: Deserialization of Untrusted DataCVE-2026-24378 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
Product
Metagauss EventPrime eventprime-event-calendar-management
What to do
Update Metagauss EventPrime eventprime-event-calendar-management to the newest version.
NVD record patchstack.com
Mar 25, 2026AncoraThemes Beelove beelove: Deserialization of Untrusted DataCVE-2026-22507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6.
Product
AncoraThemes Beelove beelove
What to do
Update AncoraThemes Beelove beelove to the newest version.
NVD record patchstack.com
Mar 25, 2026axiomthemes m2 | Construction and Tools Store m2-ce: Deserialization of Untrusted DataCVE-2026-22500 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.
Product
axiomthemes m2 | Construction and Tools Store m2-ce
What to do
Update axiomthemes m2 | Construction and Tools Store m2-ce to the newest version.
NVD record patchstack.com
Mar 25, 2026pebas Lisfinity Core lisfinity-core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-22484 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pebas Lisfinity Core lisfinity-core allows SQL Injection.This issue affects Lisfinity Core: from n/a through <= 1.5.0.
Product
pebas Lisfinity Core lisfinity-core
What to do
Update pebas Lisfinity Core lisfinity-core to the newest version.
NVD record patchstack.com
Mar 24, 2026WP DSGVO Tools (GDPR): Unauthorized account destructionCVE-2026-4283 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the `super-unsubscribe` AJAX action accepting a `process_now` parameter from unauthenticated users, which bypasses the intended email-confirmation flow and immediately triggers irreversible account anonymization. This makes it possible for unauthenticated attackers to permanently destroy any non-administrator user account (password randomized, username/email overwritten, roles stripped, comments anonymized, sensitive usermeta wiped) by submitting the victim's email address with `process_now=1`. The nonce required for the request is publicly available on any page containing the `[unsubscribe_form]` shortcode.
Product
WP DSGVO Tools (GDPR)
Affected
up to 3.1.38
What to do
Affects up to 3.1.38. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 23, 2026Woocommerce Custom Product Addons Pro: Remote Code ExecutionCVE-2026-4001 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_custom_formula() function within includes/process/price.php. This is due to insufficient sanitization and validation of user-submitted field values before passing them to PHP's eval() function. The sanitize_values() method strips HTML tags but does not escape single quotes or prevent PHP code injection. This makes it possible for unauthenticated attackers to execute arbitrary code on the server by submitting a crafted value to a WCPA text field configured with custom pricing formula (pricingType: "custom" with {this.value}).
Product
Woocommerce Custom Product Addons Pro
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update Woocommerce Custom Product Addons Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record acowebs.com wordfence.com
Mar 20, 2026Kali Forms: Remote Code ExecutionCVE-2026-3584 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to execute code on the server.
Product
Kali Forms
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 20, 2026Aimogen Pro: Arbitrary Function Call that can lead to privilege escalationCVE-2026-4038 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'aiomatic_call_ai_function_realtime' function in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions such as 'update_option' to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
Aimogen Pro
Affected
up to 2.7.5
What to do
Affects up to 2.7.5. Update Aimogen Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record codecanyon.net wordfence.com
Mar 19, 2026Syarif Mobile App Editor mobile-app-editor: Unrestricted Upload of File with Dangerous TypeCVE-2026-27067 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through <= 1.3.1.
Product
Syarif Mobile App Editor mobile-app-editor
What to do
Update Syarif Mobile App Editor mobile-app-editor to the newest version.
NVD record patchstack.com
Mar 19, 2026ThimPress BuilderPress builderpress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27065 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through <= 2.0.1.
Product
ThimPress BuilderPress builderpress
What to do
Update ThimPress BuilderPress builderpress to the newest version.
NVD record patchstack.com
Mar 19, 2026Themeton Finag: Deserialization of Untrusted DataCVE-2025-60237 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.
Product
Themeton Finag
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Themeton Finag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Mar 19, 2026Themeton Zuut: Deserialization of Untrusted DataCVE-2025-60233 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Zuut allows Object Injection.This issue affects Zuut: from n/a through 1.4.2.
Product
Themeton Zuut
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Themeton Zuut to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record patchstack.com
Mar 19, 2026Rymera Web Co Pty Ltd: Incorrect Privilege AssignmentCVE-2026-27542 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.
Product
Rymera Web Co Pty Ltd
What to do
Update Rymera Web Co Pty Ltd to the newest version.
NVD record patchstack.com
Mar 19, 2026Rymera Web Co Pty Ltd: Unrestricted Upload of File with Dangerous TypeCVE-2026-27540 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1.
Product
Rymera Web Co Pty Ltd
What to do
Update Rymera Web Co Pty Ltd to the newest version.
NVD record patchstack.com
Mar 19, 2026Cozmoslabs Profile Builder Pro: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-27413 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0.
Product
Cozmoslabs Profile Builder Pro
Fixed in
3.14.0
What to do
Update Cozmoslabs Profile Builder Pro to 3.14.0 or newer.
NVD record patchstack.com
Mar 18, 2026shinetheme Traveler traveler: Deserialization of Untrusted DataCVE-2026-25449 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
Product
shinetheme Traveler traveler
What to do
Update shinetheme Traveler traveler to the newest version.
NVD record patchstack.com
Mar 13, 2026Pix for WooCommerce: Arbitrary file uploadsCVE-2026-3891 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Pix for WooCommerce
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update Pix for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2026Yannick Lefebvre Modal Dialog modal-dialog: Improper Control of Generation of Code ('Code Injection')CVE-2026-32367 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in Yannick Lefebvre Modal Dialog modal-dialog allows Remote Code Inclusion.This issue affects Modal Dialog: from n/a through <= 3.5.16.
Product
Yannick Lefebvre Modal Dialog modal-dialog
What to do
Update Yannick Lefebvre Modal Dialog modal-dialog to the newest version.
NVD record patchstack.com
Mar 11, 2026Datalogics Ecommerce Delivery: Exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verificationCVE-2026-2631 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.
Product
Datalogics Ecommerce Delivery
Fixed in
2.6.60
What to do
Update Datalogics Ecommerce Delivery to 2.6.60 or newer.
NVD record wpscan.com
Mar 10, 2026Tutor LMS Pro: Authentication bypassCVE-2026-0953 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.
Product
Tutor LMS Pro
Affected
up to 3.9.5
What to do
Affects up to 3.9.5. Update Tutor LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record tutorlms.com wordfence.com
Mar 6, 2026PowerPack for LearnDash: Does not have authorization and CRSF checks in an AJAX actionCVE-2026-2446 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users
Product
PowerPack for LearnDash
Fixed in
1.3.0
What to do
Update PowerPack for LearnDash to 1.3.0 or newer.
NVD record wpscan.com
Mar 5, 2026Database for Contact Form 7, WPforms, Elementor forms: PHP Object InjectionCVE-2026-2599 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 5, 2026Login with Salesforce: Does not validate that users are allowed to login through SalesforceCVE-2026-2418 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
Product
Login with Salesforce
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Login with Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD record wpscan.com
Mar 5, 2026loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-28115 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.
Product
loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem
What to do
Update loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem to the newest version.
NVD record patchstack.com
Mar 5, 2026firassaidi WooCommerce License Manager fs-license-manager: Unrestricted Upload of File with Dangerous TypeCVE-2026-28114 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in firassaidi WooCommerce License Manager fs-license-manager allows Upload a Web Shell to a Web Server.This issue affects WooCommerce License Manager: from n/a through <= 7.0.6.
Product
firassaidi WooCommerce License Manager fs-license-manager
What to do
Update firassaidi WooCommerce License Manager fs-license-manager to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Good Energy goodenergy: Deserialization of Untrusted DataCVE-2026-28105 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.
Product
ThemeREX Good Energy goodenergy
What to do
Update ThemeREX Good Energy goodenergy to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Pizza House pizzahouse: Deserialization of Untrusted DataCVE-2026-28074 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.
Product
ThemeREX Pizza House pizzahouse
What to do
Update ThemeREX Pizza House pizzahouse to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Healer - Doctor, Clinic & Medical WordPress Theme healer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28043 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Healer - Doctor, Clinic & Medical WordPress Theme healer allows PHP Local File Inclusion.This issue affects Healer - Doctor, Clinic & Medical WordPress Theme: from n/a through <= 1.0.0.
Product
ThemeREX Healer - Doctor, Clinic & Medical WordPress Theme healer
What to do
Update ThemeREX Healer - Doctor, Clinic & Medical WordPress Theme healer to the newest version.
NVD record patchstack.com
Mar 5, 2026Marketing Fire Widget Options widget-options: Improper Control of Generation of Code ('Code Injection')CVE-2026-27984 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Marketing Fire Widget Options widget-options allows Code Injection.This issue affects Widget Options: from n/a through <= 4.1.3.
Product
Marketing Fire Widget Options widget-options
What to do
Update Marketing Fire Widget Options widget-options to the newest version.
NVD record patchstack.com
Mar 5, 2026designthemes LMS Elementor Pro lms-elementor-pro: Incorrect Privilege AssignmentCVE-2026-27983 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.
Product
designthemes LMS Elementor Pro lms-elementor-pro
What to do
Update designthemes LMS Elementor Pro lms-elementor-pro to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Dentario dentario: Deserialization of Untrusted DataCVE-2026-27439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.
Product
ThemeREX Dentario dentario
What to do
Update ThemeREX Dentario dentario to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Kingler kingler: Deserialization of Untrusted DataCVE-2026-27438 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.
Product
ThemeREX Kingler kingler
What to do
Update ThemeREX Kingler kingler to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Tennis Club tennis-sportclub: Deserialization of Untrusted DataCVE-2026-27437 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.
Product
ThemeREX Tennis Club tennis-sportclub
What to do
Update ThemeREX Tennis Club tennis-sportclub to the newest version.
NVD record patchstack.com
Mar 5, 2026SeventhQueen Sweet Date sweetdate: Deserialization of Untrusted DataCVE-2026-27417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.
Product
SeventhQueen Sweet Date sweetdate
What to do
Update SeventhQueen Sweet Date sweetdate to the newest version.
NVD record patchstack.com
Mar 5, 2026designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-27389 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.1.
Product
designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon
What to do
Update designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon to the newest version.
NVD record patchstack.com
Mar 5, 2026BoldGrid W3 Total Cache w3-total-cache: Improper Validation of Specified Quantity in InputCVE-2026-27384 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a through <= 2.9.1.
Product
BoldGrid W3 Total Cache w3-total-cache
What to do
Update BoldGrid W3 Total Cache w3-total-cache to the newest version.
NVD record patchstack.com
Mar 5, 2026zozothemes Charety charety: Unrestricted Upload of File with Dangerous TypeCVE-2026-24960 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Charety charety allows Using Malicious Files.This issue affects Charety: from n/a through < 2.0.2.
Product
zozothemes Charety charety
What to do
Update zozothemes Charety charety to the newest version.
NVD record patchstack.com
Mar 5, 2026Jordy Meow AI Engine ai-engine: Unrestricted Upload of File with Dangerous TypeCVE-2026-23802 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine ai-engine allows Using Malicious Files.This issue affects AI Engine: from n/a through <= 3.3.2.
Product
Jordy Meow AI Engine ai-engine
What to do
Update Jordy Meow AI Engine ai-engine to the newest version.
NVD record patchstack.com
Mar 5, 2026axiomthemes Mounthood mounthood: Deserialization of Untrusted DataCVE-2026-22501 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1.3.2.
Product
axiomthemes Mounthood mounthood
What to do
Update axiomthemes Mounthood mounthood to the newest version.
NVD record patchstack.com
Mar 5, 2026AncoraThemes Jardi jardi: Deserialization of Untrusted DataCVE-2026-22497 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Jardi jardi allows Object Injection.This issue affects Jardi: from n/a through <= 1.7.2.
Product
AncoraThemes Jardi jardi
What to do
Update AncoraThemes Jardi jardi to the newest version.
NVD record patchstack.com
Mar 5, 2026axiomthemes Estate estate: Deserialization of Untrusted DataCVE-2026-22475 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.
Product
axiomthemes Estate estate
What to do
Update axiomthemes Estate estate to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Equestrian Centre equestrian-centre: Deserialization of Untrusted DataCVE-2026-22474 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.
Product
ThemeREX Equestrian Centre equestrian-centre
What to do
Update ThemeREX Equestrian Centre equestrian-centre to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Solaris solaris: Deserialization of Untrusted DataCVE-2026-22454 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
Product
ThemeREX Solaris solaris
What to do
Update ThemeREX Solaris solaris to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeREX Pets Club petclub: Deserialization of Untrusted DataCVE-2026-22453 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
Product
ThemeREX Pets Club petclub
What to do
Update ThemeREX Pets Club petclub to the newest version.
NVD record patchstack.com
Mar 5, 2026AncoraThemes Handyman handyman-services: Deserialization of Untrusted DataCVE-2026-22451 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.7.
Product
AncoraThemes Handyman handyman-services
What to do
Update AncoraThemes Handyman handyman-services to the newest version.
NVD record patchstack.com
Mar 5, 2026ThemeGoods Grand Wedding grandwedding: Deserialization of Untrusted DataCVE-2026-22417 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.
Product
ThemeGoods Grand Wedding grandwedding
What to do
Update ThemeGoods Grand Wedding grandwedding to the newest version.
NVD record patchstack.com
Mar 5, 2026Builderall Builderall Builder for WordPress builderall-cheetah-for-wp: Improper Control of Generation of Code ('Code Injection')CVE-2026-22390 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Code Injection.This issue affects Builderall Builder for WordPress: from n/a through <= 3.0.1.
Product
Builderall Builderall Builder for WordPress builderall-cheetah-for-wp
What to do
Update Builderall Builderall Builder for WordPress builderall-cheetah-for-wp to the newest version.
NVD record patchstack.com
Mar 5, 2026don-themes Riode Core riode-core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69338 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injection.This issue affects Riode Core: from n/a through <= 1.6.26.
Product
don-themes Riode Core riode-core
What to do
Update don-themes Riode Core riode-core to the newest version.
NVD record patchstack.com
Mar 5, 2026zozothemes Nutrie nutrie: Unrestricted Upload of File with Dangerous TypeCVE-2025-68555 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Nutrie nutrie allows Upload a Web Shell to a Web Server.This issue affects Nutrie: from n/a through < 2.0.1.
Product
zozothemes Nutrie nutrie
What to do
Update zozothemes Nutrie nutrie to the newest version.
NVD record patchstack.com
Mar 5, 2026zozothemes Keenarch keenarch: Unrestricted Upload of File with Dangerous TypeCVE-2025-68554 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Keenarch keenarch allows Using Malicious Files.This issue affects Keenarch: from n/a through < 2.0.1.
Product
zozothemes Keenarch keenarch
What to do
Update zozothemes Keenarch keenarch to the newest version.
NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Start a project

Tell us what you're building.

A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll build it writes back

02A planning call, then a written plan with the price and the date

03A preview on your phone while it's being built

04Launch night handled: redirects, email, Google

843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.