Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

5,659 results · page 23 of 114

Jun 29, 2026Subscriber Broken Access Control in MainWP <= 6.1.1 versions.CVE-2026-57327 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in MainWP <= 6.1.1 versions.
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 29, 2026In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference waCVE-2026-53325 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, there
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 26, 2026Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custoCVE-2026-12411 · Other software · Canonical · reported by security@ubuntu.comHigh 8.4
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
Product
lxd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 26, 2026Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.CVE-2026-57661 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.CVE-2026-57660 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.CVE-2026-57654 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.CVE-2026-57649 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.CVE-2026-57648 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.CVE-2026-57645 · WordPress plugins & themes · reported by PatchstackHigh 8.1
newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.CVE-2026-57640 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.CVE-2026-57632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.CVE-2026-57622 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.CVE-2026-57430 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.CVE-2026-57324 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.CVE-2026-57323 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-56063 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.CVE-2026-56061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.CVE-2026-56029 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.CVE-2026-56025 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.CVE-2026-54847 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.CVE-2026-54846 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.CVE-2026-54840 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.CVE-2026-54837 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.CVE-2026-54835 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.CVE-2026-54832 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.CVE-2026-52701 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.CVE-2026-24547 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.CVE-2025-64636 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.CVE-2025-63079 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.CVE-2025-63078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
Affected
up to 2.4.11
What to do
Affects up to 2.4.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.CVE-2025-63041 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing dataCVE-2026-57521 · Other software · bitwarden · reported by VulnCheckMedium 5.3
Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.
Product
server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary CVE-2026-56772 · Other software · samuelclay · reported by VulnCheckMedium 5.3
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.
Product
NewsBlur
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-55667 · Other software · filebrowser · reported by GitHubHigh 8.2
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one dereferencing operation that skips the symlink guard every other method enforces. The direct-upload handler runs RemoveAll on the user-controlled path during failed-upload cleanup, gated only by Perm.Create. If an escaping directory symlink already exists inside the user's scope, an authenticated create-only user can delete an out-of-scope target, bypassing both the ScopedFs boundary and the Perm.Delete gate. This vulnerability is fixed in 2.63.16.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54097 · Other software · filebrowser · reported by GitHubHigh 7.2
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser (with create + delete permissions in their own isolated scope) can silently destroy share-link records belonging to any other user — including the administrator — by performing a legitimate DELETE on a file in their own directory whose logical path happens to be a byte-prefix of another user's stored share.Link.Path. The file contents of the victim are not exposed, but the victim's share links are irrevocably wiped. This vulnerability is fixed in 2.63.6.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54096 · Other software · filebrowser · reported by GitHubHigh 8.4
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/<path>` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through `GET /api/public/dl/<hash>`. This vulnerability is fixed in 2.63.7.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54094 · Other software · filebrowser · reported by GitHubHigh 7.5
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54093 · Other software · filebrowser · reported by GitHubMedium 6.8
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the download-as-zip / download-as-tar archive entry names with filepath.ToSlash, which on a Linux host is a no-op for backslashes (\ is only a path separator on Windows). A file whose name contains Windows-style traversal is accepted by the resource handlers, stored on the Linux filesystem with a literal backslash name, and then emitted verbatim as the archive entry name. Windows extractors interpret \ as a path separator and write the extracted file outside the extraction directory — arbitrary file write on the victim who downloads and extracts the archive. This vulnerability is fixed in 2.63.6.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54092 · Other software · filebrowser · reported by GitHubMedium 6.5
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after testing, crashes, heavily lags any container created, and has even made my docker daemon start to send errors with status code 500 even after the container was destroyed. This vulnerability is fixed in 2.63.6.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54091 · Other software · filebrowser · reported by GitHubHigh 7.5
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and then evaluate descendant paths against the owner's global and per-user rules using the rebased relative path instead of the original path relative to the owner's scope. As a result, an attacker who knows a public directory share URL can access files and subdirectories that the owner explicitly blocked with rules, as long as those blocked paths are located underneath the shared directory. In the simplest case this is an unauthenticated information disclosure through `GET /api/public/share/*` and `GET /api/public/dl/*`. This vulnerability is fixed in 2.63.6.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54090 · Other software · filebrowser · reported by GitHubHigh 8.7
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured (e.g. /bin/sh -c), the command allowlist can be bypassed through shell metacharacters. The allowlist validates only the first token of user input, but the entire raw string is handed to the shell — semicolons, pipes, backticks, and $() all work to chain arbitrary commands after a permitted one. This vulnerability is fixed in 2.33.8.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54089 · Other software · filebrowser · reported by GitHubCritical 9.1
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication (auth.method=proxy), any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a non-existent username causes the server to automatically create a new user account, providing an account creation primitive with no authorization. This is an already known issue that has been documented in the documentation for several years, but has not been documented as a vulnerability before.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.CVE-2026-54088 · Other software · filebrowser · reported by GitHubCritical 9.3
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6.
Product
filebrowser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2026Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser.CVE-2026-57532 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 8.8
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.
Product
pretix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pretix.eu
Jun 25, 2026Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.CVE-2026-57429 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.
Affected
up to 4.6.2
What to do
Affects up to 4.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.CVE-2026-56023 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.CVE-2026-54844 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.CVE-2026-54830 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
Affected
up to 2.7.19
What to do
Affects up to 2.7.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.CVE-2026-54828 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.
Affected
up to 1.4.109
What to do
Affects up to 1.4.109. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.CVE-2026-27366 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
Affected
up to 6.1.1
What to do
Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.