Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,614 results · page 23 of 93
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-66663 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
- Affected
- up to 5.5.79
- What to do
- Affects up to 5.5.79. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-66662 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
- Affected
- up to 3.29.10
- What to do
- Affects up to 3.29.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.CVE-2026-66452 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.CVE-2026-66451 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.
- Affected
- up to 4.1.9
- What to do
- Affects up to 4.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.CVE-2026-66447 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
- Affected
- up to 5.1.7
- What to do
- Affects up to 5.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.CVE-2026-66440 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.CVE-2026-66439 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.
- Affected
- up to 3.2.0.3
- What to do
- Affects up to 3.2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.CVE-2026-66425 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.CVE-2026-65581 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
- Affected
- up to 1.29.0
- What to do
- Affects up to 1.29.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.CVE-2026-65579 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
- Affected
- up to 1.21.0
- What to do
- Affects up to 1.21.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Agora <= 1.9 versions.CVE-2026-65578 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.CVE-2026-65577 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
- Affected
- up to 1.18.0
- What to do
- Affects up to 1.18.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.CVE-2026-65576 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
- Affected
- up to 1.2.14
- What to do
- Affects up to 1.2.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.CVE-2026-65575 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.CVE-2026-65574 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
- Affected
- up to 1.18
- What to do
- Affects up to 1.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.CVE-2026-65573 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
- Affected
- up to 1.22
- What to do
- Affects up to 1.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.CVE-2026-65572 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.CVE-2026-65571 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
- Affected
- up to 1.2.11.1
- What to do
- Affects up to 1.2.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.CVE-2026-65570 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
- Affected
- up to 1.8.70
- What to do
- Affects up to 1.8.70. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.CVE-2026-65565 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
- Affected
- up to 5.2.3.3
- What to do
- Affects up to 5.2.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.CVE-2026-65560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
- Affected
- up to 2.5.48
- What to do
- Affects up to 2.5.48. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.CVE-2026-65556 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
- Affected
- up to 3.1.43
- What to do
- Affects up to 3.1.43. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.CVE-2026-65553 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.CVE-2026-65546 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
- Affected
- up to 3.1.3.1
- What to do
- Affects up to 3.1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.CVE-2026-65545 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
- Affected
- up to 3.6.8
- What to do
- Affects up to 3.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.CVE-2026-65544 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
- Affected
- up to 7.14.5
- What to do
- Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.CVE-2026-65542 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
- Affected
- up to 7.14.5
- What to do
- Affects up to 7.14.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.CVE-2026-65541 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.CVE-2026-65523 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.CVE-2026-65520 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.CVE-2026-65517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.CVE-2026-65515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
- Affected
- up to 2.35.0
- What to do
- Affects up to 2.35.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65513 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
- Affected
- up to 1.6.12.10
- What to do
- Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.CVE-2026-65509 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
- Affected
- up to 7.5.1
- What to do
- Affects up to 7.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.CVE-2026-65508 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
- Affected
- up to 1.6.12.10
- What to do
- Affects up to 1.6.12.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.CVE-2026-65507 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.CVE-2026-65504 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.CVE-2026-65502 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.
- Affected
- up to 8.7.13
- What to do
- Affects up to 8.7.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.CVE-2026-61982 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.CVE-2026-61964 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
- Affected
- up to 5.2.9
- What to do
- Affects up to 5.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.CVE-2026-61963 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
- Affected
- up to 3.38
- What to do
- Affects up to 3.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.CVE-2026-61961 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
- Affected
- up to 4.5.6
- What to do
- Affects up to 4.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.CVE-2026-32548 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.
- Affected
- up to 4.6.2
- What to do
- Affects up to 4.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.CVE-2026-32469 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.CVE-2026-28180 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.
- Affected
- up to 8.9.0
- What to do
- Affects up to 8.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.CVE-2026-28172 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.CVE-2026-28169 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
- Affected
- up to 2.52.0
- What to do
- Affects up to 2.52.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.CVE-2026-28143 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
- Affected
- up to 1.56.0
- What to do
- Affects up to 1.56.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.CVE-2026-28141 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
- Affected
- up to 4.2.3
- What to do
- Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2026Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.CVE-2026-28140 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.
- Affected
- up to 3.6.4.1
- What to do
- Affects up to 3.6.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.