Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
359 results · page 3 of 8
Sep 20, 2026Photo Gallery, Sliders, Proofing and: Does not check that a user holds its options capability before saving image sizing settingsCVE-2026-81654 · WordPress plugins & themes · reported by WPScanLow 3.1
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
- Product
- Photo Gallery, Sliders, Proofing and
- Fixed in
- 4.5.0
- What to do
- Update Photo Gallery, Sliders, Proofing and to 4.5.0 or newer.
Sep 19, 2026Mailchimp for WooCommerce: Does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routesCVE-2026-92435 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
- Product
- Mailchimp for WooCommerce
- Fixed in
- 6.1.1
- What to do
- Update Mailchimp for WooCommerce to 6.1.1 or newer.
Sep 18, 2026Bookit — Booking & Appointment Calendar: Does not perform a capability check in one of its appointment-deletion functionsCVE-2026-89007 · WordPress plugins & themes · reported by WPScanLow 2.7
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
- Product
- Bookit — Booking & Appointment Calendar
- Fixed in
- 2.6.0.5
- What to do
- Update Bookit — Booking & Appointment Calendar to 2.6.0.5 or newer.
Sep 18, 2026King Addons for Elementor: Does not perform any capabilityCVE-2026-84903 · WordPress plugins & themes · reported by WPScanLow 2.7
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
- Product
- King Addons for Elementor
- Fixed in
- 51.1.81
- What to do
- Update King Addons for Elementor to 51.1.81 or newer.
Sep 18, 2026All-in-One WP Migration and Backup: Does not perform any capability check on several of its AJAX actionsCVE-2026-81810 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.
- Product
- All-in-One WP Migration and Backup
- Fixed in
- 7.111
- What to do
- Update All-in-One WP Migration and Backup to 7.111 or newer.
Sep 18, 2026MasterStudy LMS: Does not perform per-object ownership or capability checksCVE-2026-81340 · WordPress plugins & themes · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.50
- What to do
- Update MasterStudy LMS to 3.7.50 or newer.
Sep 17, 2026Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms: Does not check the user's capabilities in its message deletion AJAX actionCVE-2026-91010 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
- Product
- Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms
- Fixed in
- 5.1.1
- What to do
- Update Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms to 5.1.1 or newer.
Sep 16, 2026Appointment Hour Booking: Does not check every appointment in a booking submission against the capacity configured for its own slotCVE-2026-86475 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.
- Product
- Appointment Hour Booking
- Fixed in
- 1.5.95
- What to do
- Update Appointment Hour Booking to 1.5.95 or newer.
Sep 16, 2026WPBot: Does not perform a capability check on the AJAX action that saves its Claude AI provider settingsCVE-2026-87959 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI requests.
- Product
- WPBot
- Fixed in
- 8.7.6
- What to do
- Update WPBot to 8.7.6 or newer.
Sep 16, 2026Seraphinite Accelerator: Does not perform a capability check on one of its state-update AJAX actionsCVE-2026-87828 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
- Product
- Seraphinite Accelerator
- Fixed in
- 2.29.24
- What to do
- Update Seraphinite Accelerator to 2.29.24 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities before applying a user supplied post status filter in one of its REST routesCVE-2026-86449 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative course toolsCVE-2026-86447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative template handlersCVE-2026-86445 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
- Product
- LearnPress
- Fixed in
- 4.4.7
- What to do
- Update LearnPress to 4.4.7 or newer.
Sep 16, 2026WPLP Cookie Consent: Does not perform CSRF or capability checksCVE-2026-85131 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.4
- What to do
- Update WPLP Cookie Consent to 4.4.4 or newer.
Sep 16, 2026Eventin: Does not verify a user's capability to create accountsCVE-2026-84905 · WordPress plugins & themes · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
- Product
- Eventin
- Fixed in
- 4.1.24
- What to do
- Update Eventin to 4.1.24 or newer.
Sep 13, 2026User Registration & Membership: Does not check the capability of the user making a membership purchaseCVE-2026-86406 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
- Product
- User Registration & Membership
- Fixed in
- 5.2.8
- What to do
- Update User Registration & Membership to 5.2.8 or newer.
Sep 13, 2026Contact Form to Chat Apps | Click to Chat to Order: Does not perform any capabilityCVE-2026-77773 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.
- Product
- Contact Form to Chat Apps | Click to Chat to Order
- Fixed in
- 2.15.8
- What to do
- Update Contact Form to Chat Apps | Click to Chat to Order to 2.15.8 or newer.
Sep 12, 2026WPBot: Does not perform any capability or nonce check on the AJAX action that lists stored chat sessionsCVE-2026-87916 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
- Product
- WPBot
- Fixed in
- 8.6.0
- What to do
- Update WPBot to 8.6.0 or newer.
Sep 12, 2026Rox Appointment Booking: Does not perform any capability or authorization checkCVE-2026-87891 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.
- Product
- Rox Appointment Booking
- Fixed in
- 1.2.0
- What to do
- Update Rox Appointment Booking to 1.2.0 or newer.
Sep 12, 2026Zonify: Does not perform any capability or authentication check before returning the site's stored account login tokenCVE-2026-87842 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
- Product
- Zonify
- Fixed in
- 1.0.5
- What to do
- Update Zonify to 1.0.5 or newer.
Sep 12, 2026Sprout Invoices: Does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actionsCVE-2026-87797 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.
- Product
- Sprout Invoices
- Fixed in
- 20.8.16
- What to do
- Update Sprout Invoices to 20.8.16 or newer.
Sep 12, 2026Add User Autocomplete: Does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied roleCVE-2026-87759 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
- Product
- Add User Autocomplete
- Fixed in
- 1.2
- What to do
- Update Add User Autocomplete to 1.2 or newer.
Sep 12, 2026WP Component: Does not have any capability or nonce checks on one of the actions it makes available to unauthenticated usersCVE-2026-85681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
- Product
- WP Component
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Component to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2026BEAR: Does not verify a CSRF nonce or check user capabilities before updating taxonomy termsCVE-2026-84023 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page.
- Product
- BEAR
- Fixed in
- 1.2.2
- What to do
- Update BEAR to 1.2.2 or newer.
Sep 12, 2026DS Ad Rotator: Does not perform any capability checkCVE-2026-81402 · WordPress plugins & themes · reported by WPScanCritical 9.8
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.
- Product
- DS Ad Rotator
- Affected
- up to 0.8
- What to do
- Affects up to 0.8. Update DS Ad Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycleCVE-2026-86781 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
- Product
- SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Fixed in
- 4.7.40
- What to do
- Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to 4.7.40 or newer.
Sep 11, 2026MultiVendorX: Does not restrict who can update its role and capability settingsCVE-2026-74925 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.
- Product
- MultiVendorX
- Fixed in
- 5.0.16
- What to do
- Update MultiVendorX to 5.0.16 or newer.
Sep 11, 2026advanced-customized-prompts: Does not perform any capabilityCVE-2026-14566 · WordPress plugins & themes · reported by WPScanMedium 4.3
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2026advanced-customized-prompts: Does not perform any capabilityCVE-2026-14565 · WordPress plugins & themes · reported by WPScanMedium 5.4
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
- Product
- advanced-customized-prompts
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update advanced-customized-prompts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2026Notiqoo: Does not have capability checks on several of its AJAX actions and builds the name of the option to write from user inputCVE-2026-19840 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.
- Product
- Notiqoo
- Fixed in
- 1.4.14
- What to do
- Update Notiqoo to 1.4.14 or newer.
Sep 9, 2026PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus: Privilege EscalationCVE-2026-75927 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` la
- Product
- PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus
- Affected
- up to 2.50.0
- What to do
- Affects up to 2.50.0. Update PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on several of its settings AJAX actionsCVE-2026-85133 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent WordPress plugin before 4.4.2's stored configuration.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not perform nonce or capability checks on one of its cookie scanner AJAX actionsCVE-2026-85132 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 9, 2026WPLP Cookie Consent: Does not have capability or nonce checks on some of its A/B testing actionsCVE-2026-82185 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B test results.
- Product
- WPLP Cookie Consent
- Fixed in
- 4.4.2
- What to do
- Update WPLP Cookie Consent to 4.4.2 or newer.
Sep 6, 2026Real Estate Papi: Does not perform capability or CSRF checks on one of its AJAX actionsCVE-2026-13159 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
- Product
- Real Estate Papi
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Real Estate Papi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2026HT Menu: Does not perform any capability or object-ownership checkCVE-2026-84935 · WordPress plugins & themes · reported by WPScanHigh 8
The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that executes in the browser of any visitor, administrators included, who views the affected menu.
- Product
- HT Menu
- Fixed in
- 1.2.7
- What to do
- Update HT Menu to 1.2.7 or newer.
Sep 5, 2026JCH Optimize: Does not perform a capability check on one of its authenticated AJAX actions and lets the request chooseCVE-2026-84934 · WordPress plugins & themes · reported by WPScanHigh 8
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.
- Product
- JCH Optimize
- Fixed in
- 6.0.1
- What to do
- Update JCH Optimize to 6.0.1 or newer.
Sep 5, 2026Search Atlas SEO: Does not perform a nonce or capability check before processing a settings update in one of its early-priority handlersCVE-2026-15247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account credentials.
- Product
- Search Atlas SEO
- Fixed in
- 2.6.24
- What to do
- Update Search Atlas SEO to 2.6.24 or newer.
Sep 4, 2026Xpro Addons — 140+ Widgets for Elementor: Does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifierCVE-2026-84146 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
- Product
- Xpro Addons — 140+ Widgets for Elementor
- Fixed in
- 1.7.8
- What to do
- Update Xpro Addons — 140+ Widgets for Elementor to 1.7.8 or newer.
Sep 2, 2026Rank Math SEO: Does not perform a capability checkCVE-2026-77787 · WordPress plugins & themes · reported by WPScanLow 2.7
The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277
- What to do
- Update Rank Math SEO to 1.0.277 or newer.
Sep 2, 2026JetBackup: Does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privilegesCVE-2026-19453 · WordPress plugins & themes · reported by WPScanHigh 7.1
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
- Product
- JetBackup
- Fixed in
- 3.1.23.5
- What to do
- Update JetBackup to 3.1.23.5 or newer.
Sep 2, 2026Advanced Custom Fields: Extended: Does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capabilityCVE-2026-12526 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.9.2.7
- What to do
- Update Advanced Custom Fields: Extended to 0.9.2.7 or newer.
Aug 29, 2026Frontend Admin by DynamiApps: Does not perform a capability check on one of its AJAX actionsCVE-2026-81346 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.
- Product
- Frontend Admin by DynamiApps
- Fixed in
- 3.29.11
- What to do
- Update Frontend Admin by DynamiApps to 3.29.11 or newer.
Aug 29, 2026Rank Math SEO: Does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changedCVE-2026-77786 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPress itself requires for the settings being changed, allowing users with the Editor role to modify site-wide core WordPress settings that are reserved to administrators.
- Product
- Rank Math SEO
- Fixed in
- 1.0.277
- What to do
- Update Rank Math SEO to 1.0.277 or newer.
Aug 29, 2026Booking for Appointments and Events Calendar: Does not check that a user holds the required capability before letting them change an appointment's statusCVE-2026-77704 · WordPress plugins & themes · reported by WPScanLow 2.7
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.
- Product
- Booking for Appointments and Events Calendar
- Fixed in
- 2.4.9
- What to do
- Update Booking for Appointments and Events Calendar to 2.4.9 or newer.
Aug 29, 2026Newsletters: Does not perform any nonce or capability checkCVE-2026-17522 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.
- Product
- Newsletters
- Fixed in
- 4.17
- What to do
- Update Newsletters to 4.17 or newer.
Aug 29, 2026SmartAIPress: Does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-sideCVE-2026-16600 · WordPress plugins & themes · reported by WPScanHigh 7.7
The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.
- Product
- SmartAIPress
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update SmartAIPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 28, 2026User Registration & Membership: Does not perform a capability checkCVE-2026-79996 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.
- Product
- User Registration & Membership
- Fixed in
- 5.2.6
- What to do
- Update User Registration & Membership to 5.2.6 or newer.
Aug 28, 2026Shared Files WordPress plugin before 1.7.67, shared-files-pro: Do not perform a capability check in their file-upload handlerCVE-2026-12514 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
- Product
- Shared Files WordPress plugin before 1.7.67, shared-files-pro
- Fixed in
- 1.7.67
- What to do
- Update Shared Files WordPress plugin before 1.7.67, shared-files-pro to 1.7.67 or newer.
Aug 27, 2026Finale Lite: Does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post IDCVE-2026-78138 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.
- Product
- Finale Lite
- Fixed in
- 2.21.0
- What to do
- Update Finale Lite to 2.21.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.