Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

984 results · page 3 of 20

Aug 5, 2026Search Analytics for WP: Cross-Site Request ForgeryCVE-2026-7444 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the `process_bulk_action()` function of `MWTSA_Stats_Table`. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via a forged request granted they can trick a user with access to the plugin's "Search Analytics" dashboard page (Administrator by default) into performing an action such as clicking on a link.
Product
Search Analytics for WP
Affected
up to 1.4.16
What to do
Affects up to 1.4.16. Update Search Analytics for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2026Simple Yearly Archive: Stored Cross-Site ScriptingCVE-2026-7441 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlyArchive` shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Yearly Archive
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Simple Yearly Archive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 5, 2026GeoDirectory: Does not restrict a user-search handler to users allowed to list usersCVE-2026-16968 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators.
Product
GeoDirectory
Fixed in
2.8.168
What to do
Update GeoDirectory to 2.8.168 or newer.
Full record and what to do →NVD record wpscan.com
Aug 5, 2026The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard.CVE-2026-15941 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 4, 2026Clearfy Cache: Does not validate the redirect target in its Cyrlitera old-URL redirect handlerCVE-2026-16296 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.
Product
Clearfy Cache
Fixed in
2.4.3
What to do
Update Clearfy Cache to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 4, 2026Clearfy Cache: Does not perform a capability check in one of its admin-page dispatch pathsCVE-2026-16295 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.
Product
Clearfy Cache
Fixed in
2.4.3
What to do
Update Clearfy Cache to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 3, 2026Clearfy Cache: Does not restrict the classes allowedCVE-2026-16297 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.
Product
Clearfy Cache
Fixed in
2.4.3
What to do
Update Clearfy Cache to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 2, 2026LWS Optimize: Does not perform a capability check on its cache-clearing actionsCVE-2026-16042 · WordPress plugins & themes · reported by WPScanMedium 4.3
The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds.
Product
LWS Optimize
Fixed in
3.4
What to do
Update LWS Optimize to 3.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026JS Help Desk: Does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handlerCVE-2026-14928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
Product
JS Help Desk
Fixed in
3.1.4
What to do
Update JS Help Desk to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Search Atlas SEO: Does not perform a capability or nonce check in one of its AJAX handlersCVE-2026-15252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and consuming its indexing quota.
Product
Search Atlas SEO
Fixed in
2.6.12
What to do
Update Search Atlas SEO to 2.6.12 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026WP Hotel Booking: Does not sanitise and escape a search parameter on an administrative listing before using it in a SQL queryCVE-2026-15153 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
Product
WP Hotel Booking
Fixed in
2.3.2
What to do
Update WP Hotel Booking to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-15444 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 28, 2026WP Fast Total Search – The Power of Indexed Search: Generic SQL InjectionCVE-2026-12741 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Fast Total Search – The Power of Indexed Search
Affected
up to 1.80.280
What to do
Affects up to 1.80.280. Update WP Fast Total Search – The Power of Indexed Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 27, 2026Masteriyo LMS: Does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessionsCVE-2026-13332 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
Product
Masteriyo LMS
Fixed in
2.3.1
What to do
Update Masteriyo LMS to 2.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.CVE-2026-27418 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.
Affected
up to 1.81.282
What to do
Affects up to 1.81.282. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 20, 2026LearnPress: Does not escape a search parameter before reflecting it into an HTML attributeCVE-2026-12970 · WordPress plugins & themes · reported by WPScanHigh 7.1
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
Product
LearnPress
Fixed in
4.4.1
What to do
Update LearnPress to 4.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-13765 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including questions belonging to paid courses the attacker is not enrolled in.
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-15022 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via the wp_ajax_tutor_quiz_abandon handler, but the injected SQL executes only when a privileged user or Tutor REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, making this a second-order (stored) injection chain.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 16, 2026Advance Product Search- Voice & Ajax Search for WooCommerce: Generic SQL InjectionCVE-2026-12753 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advance Product Search- Voice & Ajax Search for WooCommerce
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Advance Product Search- Voice & Ajax Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 14, 2026Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Insecure Direct Object ReferenceCVE-2026-9341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read, overwrite, or delete the private lesson notes of any other user (including administrators), and to falsify lesson-completion progress for arbitrary users.
Product
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2026JetSearch: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-61977 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.
Product
JetSearch
Affected
up to 3.6.1.2
What to do
Affects up to 3.6.1.2. Update JetSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57383 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Stored XSS.This issue affects JobSearch: from n/a through <= 3.2.9.
Product
JobSearch
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 10, 2026BuddyHolis TableSearch: Stored Cross-Site ScriptingCVE-2026-15301 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BuddyHolis TableSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BuddyHolis TableSearch
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update BuddyHolis TableSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 8, 2026WP Learn Manager: Authorization bypassCVE-2026-12153 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on the vulnerable site.
Product
WP Learn Manager
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update WP Learn Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.CVE-2026-57683 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.CVE-2026-57357 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.CVE-2026-27412 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026Academy LMS – WordPress LMS Plugin for Complete eLearning Solution: Insecure Direct Object ReferenceCVE-2026-5348 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.8.1. This is due to the '/topics' REST API endpoint being registered with a permission callback set to '__return_true', allowing unauthenticated access to course curriculum data without verifying the course's post status or user enrollment. This makes it possible for unauthenticated attackers to access detailed curriculum information for private, draft, scheduled, or password-protected courses by enumerating course IDs.
Product
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Adminify: Does not perform per-user read-capability checks on the results returned by one of its administration search featuresCVE-2026-11781 · WordPress plugins & themes · reported by WPScanLow 2.7
The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names.
Product
Adminify
Fixed in
4.2.10
What to do
Update Adminify to 4.2.10 or newer.
Full record and what to do →NVD record wpscan.com
Jul 1, 2026LearnPress: Stored Cross-Site ScriptingCVE-2026-12732 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections() method at line 98, where the attacker-controlled attribute is inserted into an HTML class attribute via sprintf('<form class="%s">', $class_wrapper_form) without esc_attr() escaping. The FilterCourseShortcode::render() handler does not apply shortcode_atts() filtering, so raw user attributes flow directly through do_action('learn-press/filter-courses/layout', $data) into the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
LearnPress
Affected
up to 4.4.0
What to do
Affects up to 4.4.0. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2026-13443 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.13
What to do
Affects up to 3.9.13. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 1, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Insecure Direct Object ReferenceCVE-2026-11988 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.9.1 via the 'userId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the course enrollment progress and completion data belonging to any instructor or administrator account on the site. This IDOR does not apply when the target user is a regular subscriber, as the guard correctly blocks cross-subscriber access; exploitation is limited to cases where the victim user holds the LP_TEACHER_ROLE or administrator role.
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Affected
up to 4.3.9.1
What to do
Affects up to 4.3.9.1. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 30, 2026The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versionCVE-2026-9711 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted the "Enable additional search queries" setting is enabled and at least one published event exists.
Affected
up to 5.0.11
What to do
Affects up to 5.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record myeventon.com wordfence.com
Jun 29, 2026Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.CVE-2026-57320 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 26, 2026Ivory Search – WordPress Search: Stored Cross-Site ScriptingCVE-2026-11356 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings in all versions up to, and including, 5.5.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ivory Search – WordPress Search
Affected
up to 5.5.15
What to do
Affects up to 5.5.15. Update Ivory Search – WordPress Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2026Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.CVE-2026-56070 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 24, 2026ClearSale Total: SQL InjectionCVE-2026-8705 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so execution continues regardless of nonce validity. On PHP < 8.0 the attacker-supplied `$metodo` value bypasses the `switch ($metodo) { case 4: ... }` guard via loose type juggling (the string `"4 AND SLEEP(5)"` compares equal to integer `4`), reaching an unquoted `UPDATE wp_cs_total_dadosextras SET metodo=$metodo, ...` query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the target server to be running PHP < 8.0.
Product
ClearSale Total
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update ClearSale Total to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 24, 2026SearchPlus: Unauthorized modification and deletion of dataCVE-2026-8617 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a missing capability check and missing nonce validation on the searchplus_save_token_action_callback() and searchplus_reset_token_action_callback() functions, both of which are exposed to unauthenticated users through the wp_ajax_nopriv_ hooks. This makes it possible for unauthenticated attackers to overwrite or delete the plugin's stored account token and account name options (dym_token, dym_name, searchplus_token, searchplus_name, sp_token, sp_name).
Product
SearchPlus
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update SearchPlus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 18, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-10736 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 3.9.11
What to do
Affects up to 3.9.11. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 17, 2026LearnPress: Does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capabilityCVE-2026-8383 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request
Product
LearnPress
Fixed in
4.3.7
What to do
Update LearnPress to 4.3.7 or newer.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.CVE-2026-54186 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.CVE-2026-49079 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.
Affected
up to 3.5.17
What to do
Affects up to 3.5.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.CVE-2026-49057 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.CVE-2025-60085 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.
Affected
up to 1.15.0
What to do
Affects up to 1.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions.CVE-2026-42664 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions.
Affected
up to 1.38.2
What to do
Affects up to 1.38.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026callback.php that: WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusionCVE-2016-20080 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_abspath parameter to read sensitive files like wp-config.php or execute remote code.
Product
callback.php that
Affected
up to 3.0
What to do
Affects up to 3.0. Update callback.php that to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record brandfolder.com wordpress.org
Jun 15, 2026WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by maCVE-2016-20079 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.
Affected
up to 2.28.3
What to do
Affects up to 2.28.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org exploit-db.com
Jun 6, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-8502 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'return_type' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the plaintext post_password of password-protected courses and the full post_content, post_author, and post_name of unpublished draft, private, and pending courses via the unrestricted SELECT * fallback query. Exploitation requires supplying both c_status=all (to bypass the publish-only post_status WHERE clause) and return_type=json (to prevent the safe DISTINCT(ID) AS ID field override) in a single unauthenticated request to the /wp-json/lp/v1/courses/archive-course endpoint.
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Affected
up to 4.3.6
What to do
Affects up to 4.3.6. Update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026LearnPress – Backup & Migration Tool: PHP Object InjectionCVE-2026-7566 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Product
LearnPress – Backup & Migration Tool
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update LearnPress – Backup & Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2026LearnPress – Backup & Migration Tool: Arbitrary File ReadCVE-2026-7565 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including, 4.1.4 via the 'import-user-file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Product
LearnPress – Backup & Migration Tool
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update LearnPress – Backup & Migration Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.