Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

3,643 results · page 22 of 73

Mar 6, 2026WP eCommerce: Does not have CSRF check in placeCVE-2026-1128 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP eCommerce WordPress plugin through 3.15.1 does not have CSRF check in place when deleting coupons, which could allow attackers to make a logged in admin remove them via a CSRF attack
Product
WP eCommerce
Affected
up to 3.15.1
What to do
Affects up to 3.15.1. Update WP eCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 5, 2026Login with Salesforce: Does not validate that users are allowed to login through SalesforceCVE-2026-2418 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
Product
Login with Salesforce
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Login with Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 5, 2026WooCommerce License Manager: Unrestricted Upload of File with Dangerous TypeCVE-2026-28114 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in firassaidi WooCommerce License Manager fs-license-manager allows Upload a Web Shell to a Web Server.This issue affects WooCommerce License Manager: from n/a through <= 7.0.6.
Product
WooCommerce License Manager
Affected
up to 7.0.6
What to do
Affects up to 7.0.6. Update WooCommerce License Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Marcell: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28095 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Marcell marcell allows PHP Local File Inclusion.This issue affects Marcell: from n/a through <= 1.2.14.
Product
Marcell
Affected
up to 1.2.14
What to do
Affects up to 1.2.14. Update Marcell to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Claue - Clean, Minimal Elementor WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27376 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JanStudio Claue - Clean, Minimal Elementor WooCommerce Theme claue allows Reflected XSS.This issue affects Claue - Clean, Minimal Elementor WooCommerce Theme: from n/a through <= 2.2.7.
Product
Claue - Clean, Minimal Elementor WooCommerce
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Claue - Clean, Minimal Elementor WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026WooCommerce Order Details: Missing AuthorizationCVE-2026-27374 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in vanquish WooCommerce Order Details woocommerce-order-details allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Order Details: from n/a through <= 3.1.
Product
WooCommerce Order Details
Affected
up to 3.1
What to do
Affects up to 3.1. Update WooCommerce Order Details to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Architecturer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27358 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.
Product
Architecturer
What to do
Update Architecturer to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026WooCommerce Coming Soon Product with Countdown: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27354 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows Stored XSS.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.
Product
WooCommerce Coming Soon Product with Countdown
Affected
up to 5.0
What to do
Affects up to 5.0. Update WooCommerce Coming Soon Product with Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Secudeal Payments for Ecommerce: Deserialization of Untrusted DataCVE-2026-22471 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This issue affects Secudeal Payments for Ecommerce: from n/a through <= 1.1.
Product
Secudeal Payments for Ecommerce
Affected
up to 1.1
What to do
Affects up to 1.1. Update Secudeal Payments for Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 5, 2026Keenarch: Unrestricted Upload of File with Dangerous TypeCVE-2025-68554 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Keenarch keenarch allows Using Malicious Files.This issue affects Keenarch: from n/a through < 2.0.1.
Product
Keenarch
What to do
Update Keenarch to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 27, 2026MailArchiver: SQL InjectionCVE-2026-2831 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MailArchiver
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update MailArchiver to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2026Japanized for WooCommerce: Improper AuthenticationCVE-2026-1305 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Japanized for WooCommerce plugin for WordPress is vulnerable to Improper Authentication in versions up to, and including, 2.8.4. This is due to a flawed permission check in the `paidy_webhook_permission_check` function that unconditionally returns `true` when the webhook signature header is omitted. This makes it possible for unauthenticated attackers to bypass payment verification and fraudulently mark orders as "Processing" or "Completed" without actual payment via a crafted POST request to the Paidy webhook endpoint.
Product
Japanized for WooCommerce
Affected
up to 2.8.4
What to do
Affects up to 2.8.4. Update Japanized for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 26, 2026WooCommerce Photo Reviews: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2026-28132 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews allows Code Injection.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.4.4.
Product
WooCommerce Photo Reviews
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update WooCommerce Photo Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 22, 2026The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce: Insufficient Verification of Data AuthenticityCVE-2026-2385 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 6.4.7. This is due to the plugin decrypting and trusting attacker-controlled email_data in an unauthenticated AJAX handler without cryptographic authenticity guarantees. This makes it possible for unauthenticated attackers to tamper with form email routing and redirection values to trigger unauthorized email relay and attacker-controlled redirection via the 'email_data' parameter.
Product
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.4.7
What to do
Affects up to 6.4.7. Update The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 20, 2026Print Invoice & Delivery Notes for WooCommerce: Missing AuthorizationCVE-2026-24946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.8.0.
Product
Print Invoice & Delivery Notes for WooCommerce
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update Print Invoice & Delivery Notes for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Woocommerce Category Banner Management: Deserialization of Untrusted DataCVE-2026-22354 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Dotstore Woocommerce Category Banner Management banner-management-for-woocommerce allows Object Injection.This issue affects Woocommerce Category Banner Management: from n/a through <= 2.5.1.
Product
Woocommerce Category Banner Management
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Woocommerce Category Banner Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Persian Woocommerce SMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-22352 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through <= 7.1.1.
Product
Persian Woocommerce SMS
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update Persian Woocommerce SMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026RVCFDI para Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69386 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realvirtualmx RVCFDI para Woocommerce rvcfdi-para-woocommerce allows Reflected XSS.This issue affects RVCFDI para Woocommerce: from n/a through <= 8.1.8.
Product
RVCFDI para Woocommerce
Affected
up to 8.1.8
What to do
Affects up to 8.1.8. Update RVCFDI para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Cartify - WooCommerce Gutenberg: Missing AuthorizationCVE-2025-69385 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in AgniHD Cartify - WooCommerce Gutenberg WordPress Theme cartify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cartify - WooCommerce Gutenberg WordPress Theme: from n/a through <= 1.3.
Product
Cartify - WooCommerce Gutenberg
Affected
up to 1.3
What to do
Affects up to 1.3. Update Cartify - WooCommerce Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026WooCommerce Bulk Product Editor: Missing AuthorizationCVE-2025-69381 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Product Editor: from n/a through <= 3.0.
Product
WooCommerce Bulk Product Editor
Affected
up to 3.0
What to do
Affects up to 3.0. Update WooCommerce Bulk Product Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Product Filter for WooCommerce: Incorrect Privilege AssignmentCVE-2025-69378 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Incorrect Privilege Assignment vulnerability in XforWooCommerce Product Filter for WooCommerce prdctfltr allows Privilege Escalation.This issue affects Product Filter for WooCommerce: from n/a through <= 9.1.2.
Product
Product Filter for WooCommerce
Affected
up to 9.1.2
What to do
Affects up to 9.1.2. Update Product Filter for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Emerce Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69366 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Injection.This issue affects Emerce Core: from n/a through <= 1.8.
Product
Emerce Core
Affected
up to 1.8
What to do
Affects up to 1.8. Update Emerce Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Primer MyData for Woocommerce: Path Traversal: '.../...//'CVE-2025-69325 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Path Traversal: '.../...//' vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Path Traversal.This issue affects Primer MyData for Woocommerce: from n/a through <= 4.2.8.
Product
Primer MyData for Woocommerce
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update Primer MyData for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Simple Archive Generator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68880 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.
Product
Simple Archive Generator
Affected
up to 5.2
What to do
Affects up to 5.2. Update Simple Archive Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: Missing AuthorizationCVE-2025-68834 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-sheet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sync Master Sheet – Product Sync with Google Sheet for WooCommerce: from n/a through <= 1.1.3.
Product
Sync Master Sheet – Product Sync with Google Sheet for WooCommerce
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Sync Master Sheet – Product Sync with Google Sheet for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026WooCommerce Coming Soon Product with Countdown: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68552 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows PHP Local File Inclusion.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.
Product
WooCommerce Coming Soon Product with Countdown
Affected
up to 5.0
What to do
Affects up to 5.0. Update WooCommerce Coming Soon Product with Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Mollie Payments for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68501 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce allows Reflected XSS.This issue affects Mollie Payments for WooCommerce: from n/a through <= 8.1.1.
Product
Mollie Payments for WooCommerce
Affected
up to 8.1.1
What to do
Affects up to 8.1.1. Update Mollie Payments for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Addonify Floating Cart For WooCommerce: Missing AuthorizationCVE-2025-68025 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify Floating Cart For WooCommerce addonify-floating-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify Floating Cart For WooCommerce: from n/a through <= 1.2.17.
Product
Addonify Floating Cart For WooCommerce
Affected
up to 1.2.17
What to do
Affects up to 1.2.17. Update Addonify Floating Cart For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Addonify – WooCommerce Wishlist: Missing AuthorizationCVE-2025-68024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – WooCommerce Wishlist: from n/a through <= 2.0.15.
Product
Addonify – WooCommerce Wishlist
Affected
up to 2.0.15
What to do
Affects up to 2.0.15. Update Addonify – WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Addonify – Compare Products For WooCommerce: Missing AuthorizationCVE-2025-68023 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – Compare Products For WooCommerce: from n/a through <= 1.1.17.
Product
Addonify – Compare Products For WooCommerce
Affected
up to 1.1.17
What to do
Affects up to 1.1.17. Update Addonify – Compare Products For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026Plugin BlueX for WooCommerce: Missing AuthorizationCVE-2025-68022 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin BlueX for WooCommerce: from n/a through <= 3.1.6.
Product
Plugin BlueX for WooCommerce
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update Plugin BlueX for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 20, 2026UPI QR Code Payment Gateway for WooCommerce: Missing AuthorizationCVE-2025-67969 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through <= 1.5.1.
Product
UPI QR Code Payment Gateway for WooCommerce
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update UPI QR Code Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Product Table and List Builder for WooCommerce Lite: Time-based SQL InjectionCVE-2026-2232 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Product Table and List Builder for WooCommerce Lite
Affected
up to 4.6.2
What to do
Affects up to 4.6.2. Update Product Table and List Builder for WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Sales Countdown Timer for WooCommerce and: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27052 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a through < 1.1.9.
Product
Sales Countdown Timer for WooCommerce and
What to do
Update Sales Countdown Timer for WooCommerce and to the newest version.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Update URLs – Quick and Easy way to search old links and replace them with new links in: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-25392 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress: from n/a through <= 1.4.3.
Product
Update URLs – Quick and Easy way to search old links and replace them with new links in
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Update URLs – Quick and Easy way to search old links and replace them with new links in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026WiserReview Product Reviews for WooCommerce: Missing AuthorizationCVE-2026-25318 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Wisernotify team WiserReview Product Reviews for WooCommerce wiser-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserReview Product Reviews for WooCommerce: from n/a through <= 2.9.
Product
WiserReview Product Reviews for WooCommerce
Affected
up to 2.9
What to do
Affects up to 2.9. Update WiserReview Product Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Ultimate Gift Cards For WooCommerce: Missing AuthorizationCVE-2026-24375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Gift Cards For WooCommerce: from n/a through <= 3.2.4.
Product
Ultimate Gift Cards For WooCommerce
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Ultimate Gift Cards For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Media Search Enhanced: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-23805 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced media-search-enhanced allows SQL Injection.This issue affects Media Search Enhanced: from n/a through <= 0.9.1.
Product
Media Search Enhanced
Affected
up to 0.9.1
What to do
Affects up to 0.9.1. Update Media Search Enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026YITH WooCommerce Compare: Deserialization of Untrusted DataCVE-2026-22333 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through <= 3.6.0.
Product
YITH WooCommerce Compare
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update YITH WooCommerce Compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 19, 2026Whatsiplus Scheduled Notification for Woocommerce: Cross-Site Request ForgeryCVE-2026-1455 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Whatsiplus Scheduled Notification for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validation on the 'wsnfw_save_users_settings' AJAX action. This makes it possible for unauthenticated attackers to modify plugin configuration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Whatsiplus Scheduled Notification for Woocommerce
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Whatsiplus Scheduled Notification for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Prodigy Commerce: Local File InclusionCVE-2026-0926 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Prodigy Commerce
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Prodigy Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Mega Store Woocommerce: Unauthorized modification of dataCVE-2025-14357 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Mega Store Woocommerce theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setup_widgets() function in core/includes/importer/whizzie.php in all versions up to, and including, 5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary pages and modify site settings.
Product
Mega Store Woocommerce
Affected
up to 5.9
What to do
Affects up to 5.9. Update Mega Store Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Feb 19, 2026Razorpay for WooCommerce: Unauthorized modification of dataCVE-2025-14294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Razorpay for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the getCouponList() function in all versions up to, and including, 4.7.8. This is due to the checkAuthCredentials() permission callback always returning true, providing no actual authentication. This makes it possible for unauthenticated attackers to modify the billing and shipping contact information (email and phone) of any WooCommerce order by knowing or guessing the order ID.
Product
Razorpay for WooCommerce
Affected
up to 4.7.8
What to do
Affects up to 4.7.8. Update Razorpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Authorization bypassCVE-2025-13930 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 7.8.5. This is due to the plugin not properly verifying that a user is authorized to delete an attachment combined with flawed guest order ownership validation. This makes it possible for unauthenticated attackers to delete attachments associated with guest orders using only the publicly available wooccm_upload nonce and attachment ID.
Product
Checkout Field Manager (Checkout Manager) for WooCommerce
Affected
up to 7.8.5
What to do
Affects up to 7.8.5. Update Checkout Field Manager (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026CTX Feed – WooCommerce Product Feed Manager: Unauthorized arbitrary plugin installationCVE-2025-12975 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CTX Feed – WooCommerce Product Feed Manager plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the woo_feed_plugin_installing() function in all versions up to, and including, 6.6.11. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install arbitrary plugins which can be leveraged to achieve remote code execution.
Product
CTX Feed – WooCommerce Product Feed Manager
Affected
up to 6.6.11
What to do
Affects up to 6.6.11. Update CTX Feed – WooCommerce Product Feed Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Feb 19, 2026Checkout Field Manager (Checkout Manager) for WooCommerce: Unauthenticated limited file uploadCVE-2025-12500 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the "ajax_checkout_attachment_upload" function. This makes it possible for unauthenticated attackers to upload files to the server, though file types are limited to WordPress's default allowed MIME types (images, documents, etc.).
Product
Checkout Field Manager (Checkout Manager) for WooCommerce
Affected
up to 7.8.1
What to do
Affects up to 7.8.1. Update Checkout Field Manager (Checkout Manager) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 19, 2026Printful Integration for WooCommerce: Server-Side Request ForgeryCVE-2025-12375 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Printful Integration for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.11 via the advanced size chart REST API endpoint. This is due to insufficient validation of user-supplied URLs before passing them to the download_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Product
Printful Integration for WooCommerce
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update Printful Integration for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce: Incorrect AuthorizationCVE-2026-2386 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpae_create_page() AJAX handler authorizing users only with current_user_can('edit_posts') while accepting a user-controlled 'post_type' value passed directly to wp_insert_post() without post-type-specific capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to create arbitrary draft posts for restricted post types (e.g., 'page' and 'nxt_builder') via the 'post_type' parameter.
Product
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
Affected
up to 6.4.7
What to do
Affects up to 6.4.7. Update The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 18, 2026YayMail – WooCommerce Email Customizer: Stored Cross-Site ScriptingCVE-2026-1943 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
YayMail – WooCommerce Email Customizer
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update YayMail – WooCommerce Email Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 18, 2026YayMail – WooCommerce Email Customizer: Unauthorized license key deletionCVE-2026-1938 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the `/yaymail-license/v1/license/delete` REST endpoint in versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to delete the plugin's license key via the '/yaymail-license/v1/license/delete' endpoint granted they can obtain the REST API nonce.
Product
YayMail – WooCommerce Email Customizer
Affected
up to 4.3.2
What to do
Affects up to 4.3.2. Update YayMail – WooCommerce Email Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.