Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

559 results · page 3 of 12

Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65500 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.CVE-2026-61947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.CVE-2026-59555 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
Affected
up to 2.7.8.3
What to do
Affects up to 2.7.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.CVE-2026-59541 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.
Affected
up to 6.3.1
What to do
Affects up to 6.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.CVE-2026-59525 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.
Affected
up to 2.7.8.3
What to do
Affects up to 2.7.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.CVE-2026-27423 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.
Affected
up to 2.7.8.4
What to do
Affects up to 2.7.8.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 16, 2026Happy Coders OTP Login for WooCommerce: Does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifierCVE-2026-12492 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.
Product
Happy Coders OTP Login for WooCommerce
Fixed in
2.8
What to do
Update Happy Coders OTP Login for WooCommerce to 2.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026SEO Booster: Time-based SQL InjectionCVE-2026-15445 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Although esc_sql() and sanitize_text_field() are applied, neither neutralizes SQL keywords, commas, parentheses, or subquery syntax in an unquoted ORDER BY context, leaving the clause fully attacker-controlled.
Product
SEO Booster
Affected
up to 7.3.1
What to do
Affects up to 7.3.1. Update SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not restrict the PHP classes allowedCVE-2026-12081 · WordPress plugins & themes · reported by WPScanMedium 5
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
Product
Database for Contact Form 7, WPforms, Elementor forms
Fixed in
1.5.2
What to do
Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 11, 2026WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales: Time-based blind SQL InjectionCVE-2026-4661 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete absence of authorization checks and the endpoint being registered for unauthenticated users via wp_ajax_nopriv_. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries and extract sensitive information from the database via time-based blind SQL injection techniques, including administrator password hashes.
Product
WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026Catalyst Connect Zoho CRM Client Portal: Time-based SQL InjectionCVE-2025-5017 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Catalyst Connect Zoho CRM Client Portal
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Catalyst Connect Zoho CRM Client Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 11, 2026Form Vibes – Database Manager for Forms: Stored Cross-Site ScriptingCVE-2026-13378 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Form Vibes – Database Manager for Forms
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Form Vibes – Database Manager for Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 11, 2026ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base: Unauthorized cache deletionCVE-2026-1832 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability check on the 'thrivedesk_clear_cache' AJAX action in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's cache.
Product
ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cwe.mitre.org plugins.trac.wordpress.org
Jul 10, 2026JoomSport – for Sports: Team & League, Football, Hockey & more: Time-based SQL InjectionCVE-2026-13010 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The shortcode can be embedded in posts or pages by Contributor-level users, making this exploitable by any authenticated user with at least that role.
Product
JoomSport – for Sports: Team & League, Football, Hockey & more
Affected
up to 5.7.9
What to do
Affects up to 5.7.9. Update JoomSport – for Sports: Team & League, Football, Hockey & more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot: Generic SQL InjectionCVE-2026-15104 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a supported multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress) to be active on the site, as the vulnerable code path is gated by Helper::is_multilingual_active().
Product
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026TelSender: DOM-Based Cross-Site ScriptingCVE-2026-15298 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for unauthenticated attackers to inject malicious scripts via Telegram chat titles that execute when an administrator opens the TelSender settings page and clicks the "Tested" button.
Product
TelSender
Affected
up to 1.14.14
What to do
Affects up to 1.14.14. Update TelSender to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026Booking calendar, Appointment Booking System: Time-based SQL InjectionCVE-2026-15289 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpdevart_id’ parameter in all versions up to, and including, 3.2.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. In order to exploit the vulnerability, the Pro version of the plugin must be installed and activated, with the 'Delete previous dates' option checked.
Product
Booking calendar, Appointment Booking System
Affected
up to 3.2.17
What to do
Affects up to 3.2.17. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2026rtMedia for WordPress, BuddyPress and bbPress: Time-based SQL InjectionCVE-2026-15287 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up to, and including, 4.6.18 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
rtMedia for WordPress, BuddyPress and bbPress
Affected
up to 4.6.18
What to do
Affects up to 4.6.18. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 9, 2026Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Time-based SQL InjectionCVE-2026-14342 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
Affected
up to 1.24.2
What to do
Affects up to 1.24.2. Update Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 8, 2026My Calendar – Accessible Event Manager: Time-based blind SQL InjectionCVE-2026-6854 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
My Calendar – Accessible Event Manager
Affected
up to 3.7.8
What to do
Affects up to 3.7.8. Update My Calendar – Accessible Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 8, 2026Tainacan: Time-based blind SQL InjectionCVE-2026-6230 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tainacan
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Tainacan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Jul 8, 2026Eventer: Time-based SQL InjectionCVE-2026-9700 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Eventer
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Eventer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 2, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Stored Cross-Site ScriptingCVE-2026-12734 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'connectorWidth' Block Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Stored Cross-Site ScriptingCVE-2026-12731 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot: Missing AuthorizationCVE-2026-12729 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability check on the do_migration() function registered as the wedocs_migrate_betterdocs_to_wedocs AJAX action, which performs no nonce verification via check_ajax_referer() and no capability check via current_user_can() before executing sensitive operations. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full BetterDocs-to-weDocs data migration, creating and modifying 'docs' custom post type entries with attacker-controlled titles, updating site options, and deactivating the BetterDocs and BetterDocs Pro plugins via deactivate_plugins().
Product
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026WP Database Backup – Unlimited Database & Files Backup by Backup for WP: OS Command InjectionCVE-2026-9834 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/admin/class-wpdb-admin.php` without wrapping them in `escapeshellarg()`—every other argument in the same command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the exclude-table values the sole exception—and because the only applied filtering, `sanitize_text_field()` via `recursive_sanitize_text_field()`, strips HTML tags but leaves shell metacharacters such as `;`, `|`, `` ` ``, and `$()` intact. This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary operating system commands on the server, potentially enabling full remote code execution. The injection is stored: malicious values submitted through the plugin settings form are persisted to the WordPress options table via `update_option('wp_db_exclude_ta
Product
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
Affected
up to 7.11
What to do
Affects up to 7.11. Update WP Database Backup – Unlimited Database & Files Backup by Backup for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Database for Contact Form 7, WPforms, Elementor forms: Arbitrary File CopyCVE-2026-9145 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() without validating that the value corresponds to a legitimately uploaded file — when no file is present in $_FILES, raw_value reflects the attacker-controlled POST string. copy() accepts both local filesystem paths and URL sources, so the attacker can target any file readable by the PHP process or supply an attacker-controlled remote URL. Elementor Pro is a prerequisite for triggering the code path (it owns the elementor_pro/forms/new_record hook and populates the Form_Record object), but the bug itself is entirely in Contact Form Entries' handler. This could allow unauthenticated attackers to disclose arbitrary files on the affected site's server. The file is copied to a directory unknown to the attacker; the hashed directory name provides defense-in-depth but is generated from non-cryptographic sources (uniqid() + rand()) and should not be relied upon as the prim
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.CVE-2026-56048 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 25, 2026Gravity Forms Booking: Time-based SQL InjectionCVE-2026-2508 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Gravity Forms Booking
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Gravity Forms Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gravitybooking.com gravitybooking.com
Jun 25, 2026Dokan Pro: Time-based SQL InjectionCVE-2026-12079 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Dokan Pro
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update Dokan Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dokan.co wordfence.com
Jun 25, 2026Dokan Pro: Time-based SQL InjectionCVE-2026-12077 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Dokan Pro
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update Dokan Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record dokan.co wordfence.com
Jun 19, 2026Database for Contact Form 7, WPforms, Elementor forms: Arbitrary file deletionCVE-2026-9843 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON key to bypass the stored-path isset check and trigger deletion of the traversal-specified file.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2026BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor: Stored Cross-Site ScriptingCVE-2026-12157 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of the betterdocs/category-slate-layout Gutenberg block in versions up to, and including, 4.5.3. This is due to insufficient input sanitization and output escaping in the CategorySlateLayout::render() method, which echoes the blockId block attribute directly into an HTML class attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.CVE-2026-39587 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.
Affected
up to 5.9.0
What to do
Affects up to 5.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injeCVE-2019-25746 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record slicedinvoices.com wordpress.org
Jun 15, 2026the shortcode function that fails to sanitize the calendar parameter before using it in database queries: WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injectionCVE-2016-20069 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.
Product
the shortcode function that fails to sanitize the calendar parameter before using it in database queries
What to do
Update the shortcode function that fails to sanitize the calendar parameter before using it in database queries to the newest version.
Full record and what to do →NVD record wordpress.dwbooster.com exploit-db.com
Jun 10, 2026Newsletters: Time-based SQL InjectionCVE-2026-3018 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Newsletters
Affected
up to 4.13
What to do
Affects up to 4.13. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2026Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates: DOM-Based Stored Cross-Site ScriptingCVE-2025-8444 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates
Affected
up to 4.2.6
What to do
Affects up to 4.2.6. Update Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2026Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploitiCVE-2017-20245 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploiting the unescaped 'idsignup' POST parameter. Attackers can send crafted requests to the admin-ajax.php endpoint with malicious SQL payloads in the 'idsignup' parameter to read arbitrary data from the database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wow-company.com tad.group
Jun 9, 2026Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by eCVE-2017-20244 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php endpoint with the 'send_mwp_form' action to extract sensitive database contents.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wow-company.com tad.group
Jun 9, 2026WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate daCVE-2017-20243 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the space_id parameter. Attackers can send GET requests to the booking-page endpoint with malicious space_id values using AND SLEEP() payloads to extract sensitive database information.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record codecanyon.net exploit-db.com
Jun 6, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Time-based SQL InjectionCVE-2026-9829 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler — accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter — and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.41
What to do
Affects up to 1.8.41. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 5, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Time-based blind SQL InjectionCVE-2026-6448 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. If the secret key is exposed, this can be exploited by lower-privileged users.
Product
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Affected
up to 11.1.2
What to do
Affects up to 11.1.2. Update Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2026WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database qCVE-2019-25745 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 28, 2026Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Time-based blind SQL InjectionCVE-2026-7048 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.8.40 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable by embedding a malicious shortcode in a post or draft, allowing the injected SQL to execute when the shortcode is rendered.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.40
What to do
Affects up to 1.8.40. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 28, 2026Appointment Booking Calendar — Simply Schedule Appointments Booking: Time-based blind SQL InjectionCVE-2026-7797 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'append_where_sql' parameter in all versions up to, and including, 1.6.11.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The /appointments/bulk REST endpoint is reachable by unauthenticated attackers because its permission check accepts a public nonce that is embedded in the booking widget's frontend JavaScript (ssa.api.public_nonce) and visible to all site visitors; exploitation requires issuing the request as a PUT with an application/x-www-form-urlencoded body so that PHP's superglobals are not populated and the blocklist check silently passes.
Product
Appointment Booking Calendar — Simply Schedule Appointments Booking
Affected
up to 1.6.11.8
What to do
Affects up to 1.6.11.8. Update Appointment Booking Calendar — Simply Schedule Appointments Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026EnvíaloSimple: Email Marketing y Newsletters: Time-based blind SQL InjectionCVE-2026-7618 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
EnvíaloSimple: Email Marketing y Newsletters
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update EnvíaloSimple: Email Marketing y Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Islamic Database: Stored Cross-Site ScriptingCVE-2026-8845 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Islamic Database plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'islamicDB-roqya' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied 'width' and 'height' shortcode attributes within the islamicDB_sc_quran_qari_roqya() function, which are concatenated directly into HTML iframe attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Islamic Database
Affected
up to 1.0
What to do
Affects up to 1.0. Update Islamic Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 27, 2026Firebase Support & Chat Management: Privilege escalationCVE-2026-8787 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.
Product
Firebase Support & Chat Management
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Firebase Support & Chat Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.