Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 25 of 126
Apr 8, 2026AI Workflow Automation: Missing AuthorizationCVE-2026-39699 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in massiveshift AI Workflow Automation ai-workflow-automation-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Workflow Automation: from n/a through <= 1.4.2.
- Product
- AI Workflow Automation
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update AI Workflow Automation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026The Publisher Desk ads.txt: Missing AuthorizationCVE-2026-39698 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Publisher Desk ads.txt: from n/a through <= 1.5.0.
- Product
- The Publisher Desk ads.txt
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update The Publisher Desk ads.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026MAIO – The new AI GEO / SEO tool: Missing AuthorizationCVE-2026-39697 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in HBSS Technologies MAIO – The new AI GEO / SEO tool maio-the-new-ai-geo-seo-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAIO – The new AI GEO / SEO tool: from n/a through <= 6.2.8.
- Product
- MAIO – The new AI GEO / SEO tool
- Affected
- up to 6.2.8
- What to do
- Affects up to 6.2.8. Update MAIO – The new AI GEO / SEO tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Simply Schedule Appointments: Missing AuthorizationCVE-2026-39694 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.
- Product
- Simply Schedule Appointments
- Affected
- up to 1.6.10.2
- What to do
- Affects up to 1.6.10.2. Update Simply Schedule Appointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Cryptocurrency Donation Box – Bitcoin & Crypto Donations: Missing AuthorizationCVE-2026-39691 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Donation Box – Bitcoin & Crypto Donations: from n/a through <= 2.2.13.
- Product
- Cryptocurrency Donation Box – Bitcoin & Crypto Donations
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update Cryptocurrency Donation Box – Bitcoin & Crypto Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Author Avatars List/Block: Missing AuthorizationCVE-2026-39690 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.
- Product
- Author Avatars List/Block
- Affected
- up to 2.1.25
- What to do
- Affects up to 2.1.25. Update Author Avatars List/Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026eShipper Commerce: Missing AuthorizationCVE-2026-39689 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eShipper Commerce: from n/a through <= 2.16.12.
- Product
- eShipper Commerce
- Affected
- up to 2.16.12
- What to do
- Affects up to 2.16.12. Update eShipper Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WP Frontend Profile: Missing AuthorizationCVE-2026-39688 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Frontend Profile: from n/a through <= 1.3.9.
- Product
- WP Frontend Profile
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update WP Frontend Profile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Rapid Car Check Vehicle Data: Missing AuthorizationCVE-2026-39687 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.
- Product
- Rapid Car Check Vehicle Data
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Rapid Car Check Vehicle Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026BSK PDF Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-39686 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.
- Product
- BSK PDF Manager
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update BSK PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026The Moneytizer: Missing AuthorizationCVE-2026-39685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Moneytizer: from n/a through <= 10.0.10.
- Product
- The Moneytizer
- Affected
- up to 10.0.10
- What to do
- Affects up to 10.0.10. Update The Moneytizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026linkPizza-Manager: Missing AuthorizationCVE-2026-39682 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5.
- Product
- linkPizza-Manager
- Affected
- up to 5.5.5
- What to do
- Affects up to 5.5.5. Update linkPizza-Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Diet Calorie Calculator: Missing AuthorizationCVE-2026-39680 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in MWP Development Diet Calorie Calculator diet-calorie-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Diet Calorie Calculator: from n/a through <= 1.1.1.
- Product
- Diet Calorie Calculator
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Diet Calorie Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Pinpoint Booking System: Missing AuthorizationCVE-2026-39678 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pinpoint Booking System Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through 2.9.9.7.2.
- Product
- Pinpoint Booking System
- Affected
- up to 2.9.9.7.2
- What to do
- Affects up to 2.9.9.7.2. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Download Manager: Missing AuthorizationCVE-2026-39676 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Manager: from n/a through <= 3.3.52.
- Product
- Download Manager
- Affected
- up to 3.3.52
- What to do
- Affects up to 3.3.52. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Court Reservation: Missing AuthorizationCVE-2026-39675 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Court Reservation: from n/a through <= 1.10.11.
- Product
- Court Reservation
- Affected
- up to 1.10.11
- What to do
- Affects up to 1.10.11. Update Court Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026iZooto: Missing AuthorizationCVE-2026-39673 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iZooto: from n/a through <= 3.7.20.
- Product
- iZooto
- Affected
- up to 3.7.20
- What to do
- Affects up to 3.7.20. Update iZooto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026ShipTime: Discounted Shipping Rates: Missing AuthorizationCVE-2026-39672 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShipTime: Discounted Shipping Rates: from n/a through <= 1.1.1.
- Product
- ShipTime: Discounted Shipping Rates
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update ShipTime: Discounted Shipping Rates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026NitroPack: Missing AuthorizationCVE-2026-39669 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.
- Product
- NitroPack
- Affected
- up to 1.19.3
- What to do
- Affects up to 1.19.3. Update NitroPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Book Previewer for Woocommerce: Missing AuthorizationCVE-2026-39668 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.
- Product
- Book Previewer for Woocommerce
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Book Previewer for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Leadrebel: Missing AuthorizationCVE-2026-39664 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadrebel: from n/a through <= 1.0.2.
- Product
- Leadrebel
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Leadrebel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026TrueBooker: Missing AuthorizationCVE-2026-39663 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.5.
- Product
- TrueBooker
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update TrueBooker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Product Price by Formula for WooCommerce: Missing AuthorizationCVE-2026-39662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Price by Formula for WooCommerce: from n/a through <= 2.5.6.
- Product
- Product Price by Formula for WooCommerce
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Product Price by Formula for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Panda Pods Repeater Field: Missing AuthorizationCVE-2026-39658 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through <= 1.5.12.
- Product
- Panda Pods Repeater Field
- Affected
- up to 1.5.12
- What to do
- Affects up to 1.5.12. Update Panda Pods Repeater Field to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026leadlovers forms: Missing AuthorizationCVE-2026-39657 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through <= 1.0.2.
- Product
- leadlovers forms
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update leadlovers forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Razorpay for WooCommerce: Missing AuthorizationCVE-2026-39656 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay for WooCommerce: from n/a through <= 4.8.2.
- Product
- Razorpay for WooCommerce
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Razorpay for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Video Conferencing with Zoom: Missing AuthorizationCVE-2026-39653 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Conferencing with Zoom: from n/a through <= 4.6.6.
- Product
- Video Conferencing with Zoom
- Affected
- up to 4.6.6
- What to do
- Affects up to 4.6.6. Update Video Conferencing with Zoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026iGMS Direct Booking: Missing AuthorizationCVE-2026-39652 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iGMS Direct Booking: from n/a through <= 1.3.
- Product
- iGMS Direct Booking
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update iGMS Direct Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Total Poll Lite: Missing AuthorizationCVE-2026-39651 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through <= 4.12.0.
- Product
- Total Poll Lite
- Affected
- up to 4.12.0
- What to do
- Affects up to 4.12.0. Update Total Poll Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026UnitechPay: Missing AuthorizationCVE-2026-39650 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through <= 1.0.2.
- Product
- UnitechPay
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update UnitechPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Royale News: Missing AuthorizationCVE-2026-39649 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royale News: from n/a through <= 2.2.4.
- Product
- Royale News
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Royale News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Cream Blog: Missing AuthorizationCVE-2026-39648 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.
- Product
- Cream Blog
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Cream Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Wp Ultimate Review: Missing AuthorizationCVE-2026-39644 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.
- Product
- Wp Ultimate Review
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Payment Plugins for PayPal WooCommerce: Missing AuthorizationCVE-2026-39643 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through <= 2.0.13.
- Product
- Payment Plugins for PayPal WooCommerce
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update Payment Plugins for PayPal WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026RPS Include Content: Missing AuthorizationCVE-2026-39639 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RPS Include Content: from n/a through <= 1.2.2.
- Product
- RPS Include Content
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update RPS Include Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Mogi: Missing AuthorizationCVE-2026-39637 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through <= 1.2.3.
- Product
- Mogi
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Mogi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WPSchoolPress: Missing AuthorizationCVE-2026-39631 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through <= 2.2.35.
- Product
- WPSchoolPress
- Affected
- up to 2.2.35
- What to do
- Affects up to 2.2.35. Update WPSchoolPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Ashe: Missing AuthorizationCVE-2026-39627 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wproyal Ashe ashe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe: from n/a through <= 2.266.
- Product
- Ashe
- Affected
- up to 2.266
- What to do
- Affects up to 2.266. Update Ashe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Biolife: Missing AuthorizationCVE-2026-39624 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kutethemes Biolife biolife allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Biolife: from n/a through <= 3.2.3.
- Product
- Biolife
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Biolife to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Education Base: Missing AuthorizationCVE-2026-39622 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in acmethemes Education Base education-base allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Education Base: from n/a through <= 3.0.8.
- Product
- Education Base
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Education Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Download Attachments: Authorization Bypass Through User-Controlled KeyCVE-2026-39616 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Attachments: from n/a through <= 1.4.0.
- Product
- Download Attachments
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Download Attachments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026JW Player for: Missing AuthorizationCVE-2026-39614 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JW Player for WordPress: from n/a through <= 2.3.6.
- Product
- JW Player for
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update JW Player for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026KuteShop: Missing AuthorizationCVE-2026-39612 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KuteShop: from n/a through <= 4.2.9.
- Product
- KuteShop
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update KuteShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026WpXmas-Snow: Missing AuthorizationCVE-2026-39610 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpXmas-Snow: from n/a through <= 1.1.
- Product
- WpXmas-Snow
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WpXmas-Snow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Wava Payment: Missing AuthorizationCVE-2026-39609 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wava Payment: from n/a through <= 0.3.7.
- Product
- Wava Payment
- Affected
- up to 0.3.7
- What to do
- Affects up to 0.3.7. Update Wava Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026iPOSpays Gateways WC: Missing AuthorizationCVE-2026-39608 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through <= 1.3.7.
- Product
- iPOSpays Gateways WC
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update iPOSpays Gateways WC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Filter Plus: Missing AuthorizationCVE-2026-39607 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter Plus: from n/a through <= 1.1.17.
- Product
- Filter Plus
- Affected
- up to 1.1.17
- What to do
- Affects up to 1.1.17. Update Filter Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026BizReview: Missing AuthorizationCVE-2026-39606 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizReview: from n/a through <= 1.5.13.
- Product
- BizReview
- Affected
- up to 1.5.13
- What to do
- Affects up to 1.5.13. Update BizReview to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Super Custom Login: Missing AuthorizationCVE-2026-39605 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Custom Login: from n/a through <= 1.1.
- Product
- Super Custom Login
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Super Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Order Tracking: Missing AuthorizationCVE-2026-39602 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3.
- Product
- Order Tracking
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update Order Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.