Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
40,729 results · page 209 of 815
Jan 23, 2026GeoDirectory: Cross-Site Request Forgery (CSRF)CVE-2026-24549 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a through <= 2.8.149.
- Product
- GeoDirectory
- Affected
- up to 2.8.149
- What to do
- Affects up to 2.8.149. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Radio Player: Server-Side Request Forgery (SSRF)CVE-2026-24548 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.91.
- Product
- Radio Player
- Affected
- up to 2.0.91
- What to do
- Affects up to 2.0.91. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026HD Quiz: Missing AuthorizationCVE-2026-24544 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Harmonic Design HD Quiz hd-quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz: from n/a through <= 2.0.9.
- Product
- HD Quiz
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update HD Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Materialis Companion: Missing AuthorizationCVE-2026-24543 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52.
- Product
- Materialis Companion
- Affected
- up to 1.3.52
- What to do
- Affects up to 1.3.52. Update Materialis Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP Term Order: Cross-Site Request Forgery (CSRF)CVE-2026-24542 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term Order: from n/a through <= 2.1.0.
- Product
- WP Term Order
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WP Term Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Download After Email: Missing AuthorizationCVE-2026-24541 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through <= 2.1.9.
- Product
- Download After Email
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update Download After Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Integrate Google Drive: Missing AuthorizationCVE-2026-24540 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through <= 1.5.6.
- Product
- Integrate Google Drive
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Protección de datos – RGPD: Missing AuthorizationCVE-2026-24539 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ABCdatos Protección de datos – RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protección de datos – RGPD: from n/a through <= 0.68.
- Product
- Protección de datos – RGPD
- Affected
- up to 0.68
- What to do
- Affects up to 0.68. Update Protección de datos – RGPD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Omnipress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24538 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.6.7.
- Product
- Omnipress
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Webpushr: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24536 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0.
- Product
- Webpushr
- Affected
- up to 4.38.0
- What to do
- Affects up to 4.38.0. Update Webpushr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Automatic Featured Images from Videos: Missing AuthorizationCVE-2026-24535 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through <= 1.2.7.
- Product
- Automatic Featured Images from Videos
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Automatic Featured Images from Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Booter: Missing AuthorizationCVE-2026-24534 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in uPress Booter booter-bots-crawlers-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booter: from n/a through <= 1.5.7.
- Product
- Booter
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Booter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026SiteLock Security – WP Hardening, Login Security & Malware Scans: Missing AuthorizationCVE-2026-24532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through <= 5.0.2.
- Product
- SiteLock Security – WP Hardening, Login Security & Malware Scans
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update SiteLock Security – WP Hardening, Login Security & Malware Scans to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Prowess: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24531 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through <= 2.3.
- Product
- Prowess
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Prowess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WebP Conversion: Missing AuthorizationCVE-2026-24530 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in sheepfish WebP Conversion webp-conversion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebP Conversion: from n/a through <= 2.2.
- Product
- WebP Conversion
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WebP Conversion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Quick Restaurant Reservations: Missing AuthorizationCVE-2026-24529 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Alejandro Quick Restaurant Reservations quick-restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Restaurant Reservations: from n/a through <= 1.6.7.
- Product
- Quick Restaurant Reservations
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Quick Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Nova Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24528 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.This issue affects Nova Blocks: from n/a through <= 2.1.9.
- Product
- Nova Blocks
- Affected
- up to 2.1.9
- What to do
- Affects up to 2.1.9. Update Nova Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Email Inquiry & Cart Options for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24526 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Truman Email Inquiry & Cart Options for WooCommerce woocommerce-email-inquiry-cart-options allows DOM-Based XSS.This issue affects Email Inquiry & Cart Options for WooCommerce: from n/a through <= 3.5.0.
- Product
- Email Inquiry & Cart Options for WooCommerce
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update Email Inquiry & Cart Options for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026CLP Varnish Cache: Missing AuthorizationCVE-2026-24525 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in CloudPanel CLP Varnish Cache clp-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CLP Varnish Cache: from n/a through <= 1.0.2.
- Product
- CLP Varnish Cache
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update CLP Varnish Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Tablesome: Missing AuthorizationCVE-2026-24524 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.2.8.
- Product
- Tablesome
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Tablesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP FullCalendar: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24523 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.
- Product
- WP FullCalendar
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update WP FullCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026WP Subscribe: Missing AuthorizationCVE-2026-24522 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscribe: from n/a through <= 1.2.16.
- Product
- WP Subscribe
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update WP Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026Kama Thumbnail: Cross-Site Request Forgery (CSRF)CVE-2026-24521 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Timur Kamaev Kama Thumbnail kama-thumbnail allows Cross Site Request Forgery.This issue affects Kama Thumbnail: from n/a through <= 3.5.1.
- Product
- Kama Thumbnail
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Kama Thumbnail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Unauthorized modification or loss of dataCVE-2025-13921 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capability check on the 'wedocs_user_documentation_handling_capabilities' function in all versions up to, and including, 2.1.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit any documentation post. The vulnerability was partially patched in version 2.1.16.
- Product
- weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
- Affected
- up to 2.1.16
- What to do
- Affects up to 2.1.16. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026WP DSGVO Tools (GDPR): Stored Cross-Site ScriptingCVE-2026-0914 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lw_content_block' shortcode in all versions up to, and including, 3.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP DSGVO Tools (GDPR)
- Affected
- up to 3.1.36
- What to do
- Affects up to 3.1.36. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026Melapress Role Editor: Privilege EscalationCVE-2025-14866 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on the 'save_secondary_roles_field' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to assign themselves additional roles including Administrator.
- Product
- Melapress Role Editor
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Melapress Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026The BuddyPress: Arbitrary shortcode executionCVE-2024-11976 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The BuddyPress
- Affected
- up to 14.3.3
- What to do
- Affects up to 14.3.3. Update The BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026KiviCare – Clinic & Patient Management System (EHR): Arbitrary file uploadsCVE-2026-0927 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport() function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload text files and PDF documents to the affected site's server which may be leveraged for further attacks such as hosting malicious content or phishing pages via PDF files.
- Product
- KiviCare – Clinic & Patient Management System (EHR)
- Affected
- up to 3.6.15
- What to do
- Affects up to 3.6.15. Update KiviCare – Clinic & Patient Management System (EHR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging: Stored Cross-Site ScriptingCVE-2025-14745 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' shortcode in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
- Affected
- up to 5.0.10
- What to do
- Affects up to 5.0.10. Update RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-14069 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Schema & Structured Data for WP & AMP
- Affected
- up to 1.54
- What to do
- Affects up to 1.54. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2026Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Stored Cross-Site ScriptingCVE-2025-15522 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page.
- Product
- Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
- Affected
- up to 6.10.0.2
- What to do
- Affects up to 6.10.0.2. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.CVE-2025-66428 · WordPress plugins & themes · reported by MITREHigh 8.8
An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.
- Fixed in
- 6.9.1
- What to do
- Update the plugin to 6.9.1 or newer.
Jan 22, 2026Kentha Elementor Widgets: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24390 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Kentha Elementor Widgets kentha-elementor allows PHP Local File Inclusion.This issue affects Kentha Elementor Widgets: from n/a through < 3.1.
- Product
- Kentha Elementor Widgets
- What to do
- Update Kentha Elementor Widgets to the newest version.
Jan 22, 2026Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24389 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows DOM-Based XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.2.
- Product
- Gallery PhotoBlocks
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Gallery PhotoBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WPMasterToolKit: Missing AuthorizationCVE-2026-24388 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMasterToolKit: from n/a through <= 2.14.0.
- Product
- WPMasterToolKit
- Affected
- up to 2.14.0
- What to do
- Affects up to 2.14.0. Update WPMasterToolKit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Quick Post Duplicator: Missing AuthorizationCVE-2026-24387 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator wp-quick-post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through <= 2.1.
- Product
- WP Quick Post Duplicator
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WP Quick Post Duplicator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Element Invader – Template Kits for Elementor: Missing AuthorizationCVE-2026-24386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Element Invader Element Invader – Template Kits for Elementor elementinvader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Invader – Template Kits for Elementor: from n/a through <= 1.2.4.
- Product
- Element Invader – Template Kits for Elementor
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Element Invader – Template Kits for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Merge + Minify + Refresh: Cross-Site Request Forgery (CSRF)CVE-2026-24384 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in launchinteractive Merge + Minify + Refresh merge-minify-refresh allows Cross Site Request Forgery.This issue affects Merge + Minify + Refresh: from n/a through <= 2.14.
- Product
- Merge + Minify + Refresh
- Affected
- up to 2.14
- What to do
- Affects up to 2.14. Update Merge + Minify + Refresh to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026B Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24383 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows DOM-Based XSS.This issue affects B Slider: from n/a through <= 2.0.6.
- Product
- B Slider
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update B Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026PhotoMe: Server-Side Request Forgery (SSRF)CVE-2026-24381 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through < 5.7.2.
- Product
- PhotoMe
- What to do
- Update PhotoMe to the newest version.
Jan 22, 2026EventPrime: Missing AuthorizationCVE-2026-24380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.0.
- Product
- EventPrime
- Affected
- up to 4.2.8.0
- What to do
- Affects up to 4.2.8.0. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026WP Job Portal: Authorization Bypass Through User-Controlled KeyCVE-2026-24379 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.3.
- Product
- WP Job Portal
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Nexter Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24377 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.6.3.
- Product
- Nexter Blocks
- Affected
- up to 4.6.3
- What to do
- Affects up to 4.6.3. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026RegistrationMagic: Cross-Site Request Forgery (CSRF)CVE-2026-24374 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Request Forgery.This issue affects RegistrationMagic: from n/a through <= 6.0.6.9.
- Product
- RegistrationMagic
- Affected
- up to 6.0.6.9
- What to do
- Affects up to 6.0.6.9. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026BA Book Everything: Missing AuthorizationCVE-2026-24371 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in bookingalgorithms BA Book Everything ba-book-everything allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BA Book Everything: from n/a through <= 1.8.16.
- Product
- BA Book Everything
- Affected
- up to 1.8.16
- What to do
- Affects up to 1.8.16. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026The Grid: Missing AuthorizationCVE-2026-24368 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
- Product
- The Grid
- Affected
- up to 2.8.0
- What to do
- Affects up to 2.8.0. Update The Grid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-24367 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.
- Product
- Traveler
- What to do
- Update Traveler to the newest version.
Jan 22, 2026YITH WooCommerce Request A Quote: Missing AuthorizationCVE-2026-24366 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through <= 2.46.0.
- Product
- YITH WooCommerce Request A Quote
- Affected
- up to 2.46.0
- What to do
- Affects up to 2.46.0. Update YITH WooCommerce Request A Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2026Stock Manager for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2026-24365 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in storeapps Stock Manager for WooCommerce woocommerce-stock-manager allows Cross Site Request Forgery.This issue affects Stock Manager for WooCommerce: from n/a through < 3.6.0.
- Product
- Stock Manager for WooCommerce
- What to do
- Update Stock Manager for WooCommerce to the newest version.
Jan 22, 2026LearnPress – Course Review: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24361 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress – Course Review learnpress-course-review allows Stored XSS.This issue affects LearnPress – Course Review: from n/a through <= 4.1.9.
- Product
- LearnPress – Course Review
- Affected
- up to 4.1.9
- What to do
- Affects up to 4.1.9. Update LearnPress – Course Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.