Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,267 results · page 29 of 126
Mar 13, 2026e2pdf: Missing AuthorizationCVE-2026-32442 · WordPress plugins & themes · reported by PatchstackMedium 5
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.
- Product
- e2pdf
- Affected
- up to 1.28.15
- What to do
- Affects up to 1.28.15. Update e2pdf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WP Food: Missing AuthorizationCVE-2026-32440 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.
- Product
- WP Food
- What to do
- Update WP Food to the newest version.
Mar 13, 2026BigHearts: Missing AuthorizationCVE-2026-32439 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BigHearts: from n/a through <= 3.1.14.
- Product
- BigHearts
- Affected
- up to 3.1.14
- What to do
- Affects up to 3.1.14. Update BigHearts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW School Education: Missing AuthorizationCVE-2026-32438 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.
- Product
- VW School Education
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update VW School Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Portfolio: Missing AuthorizationCVE-2026-32437 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Portfolio: from n/a through <= 1.3.3.
- Product
- VW Portfolio
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update VW Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Photography: Missing AuthorizationCVE-2026-32436 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.
- Product
- VW Photography
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update VW Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Pet Shop: Missing AuthorizationCVE-2026-32435 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.
- Product
- VW Pet Shop
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update VW Pet Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Fitness: Missing AuthorizationCVE-2026-32434 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.
- Product
- VW Fitness
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update VW Fitness to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WP Time Slots Booking Form: Missing AuthorizationCVE-2026-32432 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.42.
- Product
- WP Time Slots Booking Form
- Affected
- up to 1.2.42
- What to do
- Affects up to 1.2.42. Update WP Time Slots Booking Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Popup Like box: Missing AuthorizationCVE-2026-32428 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Like box: from n/a through <= 3.7.7.
- Product
- Popup Like box
- Affected
- up to 3.7.7
- What to do
- Affects up to 3.7.7. Update Popup Like box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026VW Education Lite: Missing AuthorizationCVE-2026-32427 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Education Lite: from n/a through <= 2.2.0.
- Product
- VW Education Lite
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update VW Education Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Payment Gateway Pix For GiveWP: Missing AuthorizationCVE-2026-32425 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in linknacional Payment Gateway Pix For GiveWP payment-gateway-pix-for-givewp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Pix For GiveWP: from n/a through <= 2.2.3.
- Product
- Payment Gateway Pix For GiveWP
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Payment Gateway Pix For GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Admin and Site Enhancements (ASE): Missing AuthorizationCVE-2026-32423 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.4.0.
- Product
- Admin and Site Enhancements (ASE)
- Affected
- up to 8.4.0
- What to do
- Affects up to 8.4.0. Update Admin and Site Enhancements (ASE) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Post Timeline: Missing AuthorizationCVE-2026-32421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Agile Logix Post Timeline post-timeline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Timeline: from n/a through <= 2.4.1.
- Product
- Post Timeline
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Post Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Pochipp: Missing AuthorizationCVE-2026-32417 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through < 1.18.9.
- Product
- Pochipp
- What to do
- Update Pochipp to the newest version.
Mar 13, 2026PDF Poster: Missing AuthorizationCVE-2026-32416 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Poster: from n/a through <= 2.4.0.
- Product
- PDF Poster
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update PDF Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Permalink Manager Lite: Missing AuthorizationCVE-2026-32413 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Permalink Manager Lite: from n/a through < 2.5.3.
- Product
- Permalink Manager Lite
- What to do
- Update Permalink Manager Lite to the newest version.
Mar 13, 2026WBW Currency Switcher for WooCommerce: Missing AuthorizationCVE-2026-32410 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WBW Currency Switcher for WooCommerce: from n/a through <= 2.2.5.
- Product
- WBW Currency Switcher for WooCommerce
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WBW Currency Switcher for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Forminator: Missing AuthorizationCVE-2026-32409 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through <= 1.50.2.
- Product
- Forminator
- Affected
- up to 1.50.2
- What to do
- Affects up to 1.50.2. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Brizy: Missing AuthorizationCVE-2026-32408 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.23.
- Product
- Brizy
- Affected
- up to 2.7.23
- What to do
- Affects up to 2.7.23. Update Brizy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WPC Smart Wishlist for WooCommerce: Missing AuthorizationCVE-2026-32407 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Smart Wishlist for WooCommerce: from n/a through <= 5.0.8.
- Product
- WPC Smart Wishlist for WooCommerce
- Affected
- up to 5.0.8
- What to do
- Affects up to 5.0.8. Update WPC Smart Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WPC Product Bundles for WooCommerce: Missing AuthorizationCVE-2026-32406 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Product Bundles for WooCommerce: from n/a through <= 8.4.5.
- Product
- WPC Product Bundles for WooCommerce
- Affected
- up to 8.4.5
- What to do
- Affects up to 8.4.5. Update WPC Product Bundles for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WoodMart: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-32405 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in xtemos WoodMart woodmart allows Retrieve Embedded Sensitive Data.This issue affects WoodMart: from n/a through <= 8.3.9.
- Product
- WoodMart
- Affected
- up to 8.3.9
- What to do
- Affects up to 8.3.9. Update WoodMart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Studio99 WP Monitor: Missing AuthorizationCVE-2026-32404 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Studio99 Studio99 WP Monitor studio99-wp-monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Studio99 WP Monitor: from n/a through <= 1.0.3.
- Product
- Studio99 WP Monitor
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Studio99 WP Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Image Slider by Ays: Missing AuthorizationCVE-2026-32402 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider by Ays: from n/a through <= 2.7.1.
- Product
- Image Slider by Ays
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Image Slider by Ays to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Filter & Grids: Missing AuthorizationCVE-2026-32397 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter & Grids: from n/a through <= 3.5.1.
- Product
- Filter & Grids
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Filter & Grids to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Team: Missing AuthorizationCVE-2026-32396 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.13.
- Product
- Team
- Affected
- up to 5.0.13
- What to do
- Affects up to 5.0.13. Update Team to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Xpro Addons For Beaver Builder – Lite: Missing AuthorizationCVE-2026-32395 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-beaver-builder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Addons For Beaver Builder – Lite: from n/a through <= 1.5.6.
- Product
- Xpro Addons For Beaver Builder – Lite
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Xpro Addons For Beaver Builder – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026PublishPress Capabilities: Missing AuthorizationCVE-2026-32394 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through <= 2.31.0.
- Product
- PublishPress Capabilities
- Affected
- up to 2.31.0
- What to do
- Affects up to 2.31.0. Update PublishPress Capabilities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026SmartFix: Missing AuthorizationCVE-2026-32391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in linethemes SmartFix smartfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartFix: from n/a through < 1.2.4.
- Product
- SmartFix
- What to do
- Update SmartFix to the newest version.
Mar 13, 2026Nanosoft: Missing AuthorizationCVE-2026-32390 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in linethemes Nanosoft nanosoft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nanosoft: from n/a through < 1.3.2.
- Product
- Nanosoft
- What to do
- Update Nanosoft to the newest version.
Mar 13, 2026GLB: Missing AuthorizationCVE-2026-32388 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in linethemes GLB glb allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GLB: from n/a through <= 1.2.2.
- Product
- GLB
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update GLB to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Checkout for PayPal: Missing AuthorizationCVE-2026-32387 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout for PayPal: from n/a through <= 1.0.46.
- Product
- Checkout for PayPal
- Affected
- up to 1.0.46
- What to do
- Affects up to 1.0.46. Update Checkout for PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Envo Extra: Missing AuthorizationCVE-2026-32386 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.13.
- Product
- Envo Extra
- Affected
- up to 1.9.13
- What to do
- Affects up to 1.9.13. Update Envo Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026RegistrationMagic: Missing AuthorizationCVE-2026-32385 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.
- Product
- RegistrationMagic
- Affected
- up to 6.0.7.6
- What to do
- Affects up to 6.0.7.6. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Ridhi: Missing AuthorizationCVE-2026-32383 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Ridhi ridhi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ridhi: from n/a through <= 1.1.2.
- Product
- Ridhi
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ridhi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Digital Download: Missing AuthorizationCVE-2026-32382 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Digital Download digital-download allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Digital Download: from n/a through <= 1.1.4.
- Product
- Digital Download
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Digital Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026App Landing Page: Missing AuthorizationCVE-2026-32381 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme App Landing Page app-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App Landing Page: from n/a through <= 1.2.2.
- Product
- App Landing Page
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update App Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Numinous: Missing AuthorizationCVE-2026-32380 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Numinous numinous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Numinous: from n/a through <= 1.3.0.
- Product
- Numinous
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Numinous to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Rara Academic: Missing AuthorizationCVE-2026-32379 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Rara Academic rara-academic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rara Academic: from n/a through <= 1.2.2.
- Product
- Rara Academic
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Rara Academic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Book Landing Page: Missing AuthorizationCVE-2026-32378 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Book Landing Page book-landing-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Landing Page: from n/a through <= 1.2.7.
- Product
- Book Landing Page
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Book Landing Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Pranayama Yoga: Missing AuthorizationCVE-2026-32377 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Pranayama Yoga pranayama-yoga allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pranayama Yoga: from n/a through <= 1.2.2.
- Product
- Pranayama Yoga
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Pranayama Yoga to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Kalon: Missing AuthorizationCVE-2026-32376 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Kalon kalon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalon: from n/a through <= 1.2.9.
- Product
- Kalon
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Kalon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Travel Diaries: Missing AuthorizationCVE-2026-32375 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Travel Diaries travel-diaries allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Diaries: from n/a through <= 1.2.4.
- Product
- Travel Diaries
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Travel Diaries to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026The Minimal: Missing AuthorizationCVE-2026-32374 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme The Minimal the-minimal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Minimal: from n/a through <= 1.2.9.
- Product
- The Minimal
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update The Minimal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026SMS Alert Order Notifications: Missing AuthorizationCVE-2026-32373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through <= 3.9.0.
- Product
- SMS Alert Order Notifications
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update SMS Alert Order Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-32372 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Retrieve Embedded Sensitive Data.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 3.2.4.
- Product
- ShopBuilder – Elementor WooCommerce Builder Addons
- Affected
- up to 3.2.4
- What to do
- Affects up to 3.2.4. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Elegant Pink: Missing AuthorizationCVE-2026-32371 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Elegant Pink elegant-pink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elegant Pink: from n/a through <= 1.3.3.
- Product
- Elegant Pink
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Elegant Pink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026Influencer: Missing AuthorizationCVE-2026-32370 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in raratheme Influencer influencer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Influencer: from n/a through <= 1.1.7.
- Product
- Influencer
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Influencer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2026WPLifeCycle: Missing AuthorizationCVE-2026-32363 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Funlus Oy WPLifeCycle free-php-version-info allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLifeCycle: from n/a through <= 3.3.1.
- Product
- WPLifeCycle
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update WPLifeCycle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.