Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,928 results · page 28 of 99
Jun 17, 2026Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.CVE-2026-40723 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.CVE-2026-39595 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.
- Affected
- up to 2.9.1
- What to do
- Affects up to 2.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.CVE-2026-24611 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions.CVE-2026-24610 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions.
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions.CVE-2026-24575 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions.
- Affected
- up to 3.29.0
- What to do
- Affects up to 3.29.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.CVE-2026-22343 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.
- Affected
- up to 11.2.0
- What to do
- Affects up to 11.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Subscriber Broken Access Control in Genemy <= 1.6.6 versions.CVE-2025-69137 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Genemy <= 1.6.6 versions.
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026The device has a webserver that exposes a REST API authenticated with a token on the management network.CVE-2026-22313 · Other software · Radiflow · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.1
The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.
- Product
- iSAP Smart Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026The device has a webserver that exposes a REST API authenticated with a constant token.CVE-2026-22312 · Other software · Radiflow · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.6
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
- Product
- iSAP Smart Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in chalCVE-2026-10303 · Other software · ServerCo · reported by 44488dab-36db-4358-99f9-bc116477f914High 7.4
In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation. An attacker who can supply ACME challenge responses to getssl (for example, a malicious or compromised CA endpoint, or an on-path adversary able to tamper with that response path) could exploit this to achieve unauthorized file write/path traversal effects, usually with elevated privileges, ultimately allowing for remote command injection. This issue appears related in spirit to CVE-2023-38198, and is an instance of CWE-73, "External control of file name or path." Other ACME shell script handlers may be affected by similar issues.
- Product
- getssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopCVE-2026-53862 · Other software · OpenClaw · reported by VulnCheckLow 2.3
OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond intended scope limits.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 16, 2026OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional paCVE-2026-53855 · Other software · OpenClaw · reported by VulnCheckHigh 7.6
OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 16, 2026OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority aCVE-2026-53843 · Other software · OpenClaw · reported by VulnCheckHigh 8.7
OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 16, 2026Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting ofCVE-2026-53776 · Other software · PerryTS · reported by VulnCheckCritical 9.3
Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indefinitely, bypassing force-expired sessions such as user logout or administrative revocation.
- Product
- perry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.CVE-2026-54190 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.
- Affected
- up to 1.12.5
- What to do
- Affects up to 1.12.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.CVE-2026-52714 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.
- Affected
- up to 12.4.16
- What to do
- Affects up to 12.4.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.CVE-2026-52711 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.
- Affected
- up to 1.8.14
- What to do
- Affects up to 1.8.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 16, 2026Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.CVE-2026-39490 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g.CVE-2026-48713 · Other software · i18next · reported by GitHubCritical 9.1
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFile() splits each queued missing-key string on the configured keySeparator (default .) before calling the internal setPath() walker. The walker (getLastOfPath in lib/utils.js) did not guard against unsafe segments, so a key like "__proto__.polluted" was split into ["__proto__", "polluted"] and walked straight into Object.prototype, allowing an attacker to write arbitrary properties onto the global object prototype. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. Applications are affected only if the missingKeyHandler (or another route that forwards untrusted request bodies to i18next.t(..., { ... }) with saveMissing: true) is reachable by untrusted users and the default behaviour of splitting missing-key strings on keySeparator is in use (i.e. keySeparator is not false). Apps that do not expose missing-key pers
- Product
- i18next-fs-backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2026Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.CVE-2026-49775 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
- Affected
- up to 2.11.28
- What to do
- Affects up to 2.11.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.CVE-2026-49764 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
- Affected
- up to 6.0.8.6
- What to do
- Affects up to 6.0.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.CVE-2026-49110 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.CVE-2026-49070 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.
- Affected
- up to 9.4.0.0
- What to do
- Affects up to 9.4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.CVE-2026-49065 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.CVE-2026-48970 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.
- Affected
- up to 9.5.10
- What to do
- Affects up to 9.5.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.CVE-2026-48887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.CVE-2026-48883 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.
- Affected
- up to 8.5.3
- What to do
- Affects up to 8.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.CVE-2026-48881 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.CVE-2026-48873 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.
- Affected
- up to 10.1.2
- What to do
- Affects up to 10.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.CVE-2026-48835 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.
- Affected
- up to 1.10.0.4
- What to do
- Affects up to 1.10.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.CVE-2026-42743 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.CVE-2026-42668 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.
- Affected
- up to 1.18.0
- What to do
- Affects up to 1.18.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.CVE-2026-42666 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.
- Affected
- up to 10.30.25
- What to do
- Affects up to 10.30.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions.CVE-2026-42664 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions.
- Affected
- up to 1.38.2
- What to do
- Affects up to 1.38.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.CVE-2026-42659 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.
- Affected
- up to 1.126.12
- What to do
- Affects up to 1.126.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.CVE-2026-42651 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.
- Affected
- up to 5.3.9
- What to do
- Affects up to 5.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.CVE-2026-42640 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.
- Affected
- up to 5.3.8
- What to do
- Affects up to 5.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.CVE-2026-42411 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.CVE-2026-42378 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.
- Affected
- up to 8.4.1
- What to do
- Affects up to 8.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.CVE-2026-40799 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.
- Affected
- up to 1.38.0
- What to do
- Affects up to 1.38.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Amelia <= 2.2 versions.CVE-2026-40795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Amelia <= 2.2 versions.
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in myCred <= 3.0.3 versions.CVE-2026-40794 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in myCred <= 3.0.3 versions.
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.CVE-2026-40793 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 15, 2026Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.CVE-2026-40788 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.
- Affected
- up to 7.9.7
- What to do
- Affects up to 7.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.CVE-2026-40785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.
- Affected
- up to 5.6.7
- What to do
- Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.CVE-2026-40782 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.CVE-2026-40781 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.CVE-2026-40776 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.
- Affected
- up to 4.1.8
- What to do
- Affects up to 4.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.CVE-2026-40775 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.CVE-2026-40774 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.
- Affected
- up to 1.7.06
- What to do
- Affects up to 1.7.06. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.