Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,629 results · page 3 of 73
Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.CVE-2026-57757 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.CVE-2026-57751 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.
- What to do
- Update the plugin to the newest version.
Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.CVE-2026-57747 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.
- What to do
- Update the plugin to the newest version.
Jul 2, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.CVE-2026-57690 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.
- What to do
- Update the plugin to the newest version.
Jul 1, 2026VikBooking Hotel Booking Engine & PMS: Cross-Site Request Forgery (CSRF)CVE-2026-57723 · WordPress plugins & themes · reported by PatchstackHigh 7.4
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.
- Product
- VikBooking Hotel Booking Engine & PMS
- Affected
- up to 1.8.12
- What to do
- Affects up to 1.8.12. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 29, 2026F4 Post Tree: Does not perform capability checks or CSRF/nonce verification on one of its AJAX actionsCVE-2026-9676 · WordPress plugins & themes · reported by WPScanMedium 4.3
The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.
- Product
- F4 Post Tree
- Fixed in
- 2.0.5
- What to do
- Update F4 Post Tree to 2.0.5 or newer.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.CVE-2026-57659 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.CVE-2026-57657 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.CVE-2026-57655 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.CVE-2026-57641 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.CVE-2026-57637 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.CVE-2026-57635 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.CVE-2025-68052 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.
- Affected
- up to 1.3.4.3
- What to do
- Affects up to 1.3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 24, 2026MP Customize Login Page: Cross-Site Request Forgery (CSRF)CVE-2026-6292 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a completely broken nonce validation in the enter_mpclp_login_options() function, which contains an inverted check (if wp_verify_nonce(...) { return false; }) and is missing the required action parameter for wp_verify_nonce(). As a result, the nonce check is effectively dead code: it never blocks malicious requests because a CSRF-supplied empty/invalid nonce always returns false, satisfying the inverted condition to continue execution. Furthermore, the settings-update handler is hooked on init without any capability check. This makes it possible for unauthenticated attackers to modify all plugin setting, including login page background, logo URL, image dimensions, button colors, and login message, by tricking a logged-in administrator into submitting a crafted request.
- Product
- MP Customize Login Page
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update MP Customize Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 22, 2026Motors: Does not have proper authorisation and CSRF checks on one of its AJAX actionsCVE-2026-7859 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary post metadata, such as the gallery, featured image and, on WooCommerce sites, product prices.
- Product
- Motors
- Fixed in
- 1.4.110
- What to do
- Update Motors to 1.4.110 or newer.
Jun 18, 2026WP EasyPay: Cross-Site Request Forgery (CSRF)CVE-2026-56024 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4.5.0.
- Product
- WP EasyPay
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update WP EasyPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.CVE-2026-22342 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.
- Affected
- up to 11.2.0
- What to do
- Affects up to 11.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Emergency Password Reset: Cross-Site request forgery (CSRF)CVE-2024-35648 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site request forgery (CSRF) vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery. This issue affects Emergency Password Reset: from n/a through 8.0.
- Product
- Emergency Password Reset
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Emergency Password Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2026Skyline WP: Cross-Site request forgery (CSRF)CVE-2024-34810 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This issue affects Skyline WP: from n/a through 1.0.10.
- Product
- Skyline WP
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Skyline WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.CVE-2026-49043 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions.
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF tokCVE-2016-20083 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests to the options-general.php endpoint.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Jun 11, 2026WooCommerce Conversion Tracking: Cross-Site request forgery (CSRF)CVE-2022-47150 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site request forgery (CSRF) vulnerability in weDevs WooCommerce Conversion Tracking allows Cross Site Request Forgery. This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.10.
- Product
- WooCommerce Conversion Tracking
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update WooCommerce Conversion Tracking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026YITH WooCommerce Product Slider Carousel: Cross-Site request forgery (CSRF)CVE-2022-44630 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery. This issue affects YITH WooCommerce Product Slider Carousel: from n/a through 1.16.0.
- Product
- YITH WooCommerce Product Slider Carousel
- Affected
- up to 1.16.0
- What to do
- Affects up to 1.16.0. Update YITH WooCommerce Product Slider Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 11, 2026WpEvently: Cross-Site request forgery (CSRF)CVE-2024-32110 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site request forgery (CSRF) vulnerability in Magepeople inc. WpEvently allows Cross Site Request Forgery. This issue affects WpEvently: from n/a through 4.1.2.
- Product
- WpEvently
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update WpEvently to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 26, 2026Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).CVE-2026-8174 · WordPress plugins & themes · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.7
Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wordpress plugin versions before 1.6.2.
- Fixed in
- 1.6.2
- What to do
- Update the plugin to 1.6.2 or newer.
May 25, 2026CformsII: Cross-Site Request Forgery (CSRF)CVE-2026-39436 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bgermann CformsII allows Cross Site Request Forgery. This issue affects CformsII: from n/a through 15.1.3.
- Product
- CformsII
- Affected
- up to 15.1.3
- What to do
- Affects up to 15.1.3. Update CformsII to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026WPSubscription: Cross-Site Request Forgery (CSRF)CVE-2026-24554 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Convers Lab WPSubscription allows Cross Site Request Forgery. This issue affects WPSubscription: from n/a through 1.9.1.
- Product
- WPSubscription
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update WPSubscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026Organization chart: Cross-Site Request Forgery (CSRF)CVE-2026-24597 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Organization chart allows Cross Site Request Forgery. This issue affects Organization chart: from n/a through 1.7.5.
- Product
- Organization chart
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Organization chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 25, 2026Export WP Page to Static HTML/CSS: Cross-Site Request Forgery (CSRF)CVE-2026-24574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Recorp Export WP Page to Static HTML/CSS allows Cross Site Request Forgery. This issue affects Export WP Page to Static HTML/CSS: from n/a through 6.0.0.
- Product
- Export WP Page to Static HTML/CSS
- Affected
- up to 6.0.0
- What to do
- Affects up to 6.0.0. Update Export WP Page to Static HTML/CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 20, 2026Anomify AI – Anomaly Detection and Alerting: Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)CVE-2026-6405 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in versions up to and including 0.3.6. This is due to missing nonce verification on the settings page handler and insufficient output escaping in the admin_options.php template. The settings form includes no wp_nonce_field() and the handler performs no check_admin_referer() check, meaning any cross-origin POST can modify plugin settings. The API key field is sanitized only with sanitize_text_field(), which strips HTML tags but does not encode double-quote characters; the value is then rendered into an HTML attribute via bare echo without esc_attr(), allowing a double-quote attribute-escape payload to survive both sanitization and storage. This makes it possible for unauthenticated attackers to inject arbitrary web scripts by tricking a logged-in administrator into visiting a malicious page that submits a forged request, storing the payload in the database and causing it to execute in the administrator's browser whenever the plugin settings page is visited.
- Product
- Anomify AI – Anomaly Detection and Alerting
- Affected
- up to 0.3.6
- What to do
- Affects up to 0.3.6. Update Anomify AI – Anomaly Detection and Alerting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2026BEAR: Cross-Site Request Forgery (CSRF)CVE-2026-27415 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5.
- Product
- BEAR
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2026WPGraphQL: Cross-Site Request Forgery (CSRF)CVE-2025-68604 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows Cross Site Request Forgery. This issue affects WPGraphQL: from n/a through 2.5.3.
- Product
- WPGraphQL
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WPGraphQL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 29, 2026Barcode Scanner with Inventory & Order Manager: Cross-Site Request Forgery (CSRF)CVE-2026-42645 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Cross Site Request Forgery.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.11.0.
- Product
- Barcode Scanner with Inventory & Order Manager
- Affected
- up to 1.11.0
- What to do
- Affects up to 1.11.0. Update Barcode Scanner with Inventory & Order Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2026Avada: Cross-Site Request Forgery (CSRF)CVE-2025-58922 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affects Avada: from n/a before 7.13.2.
- Product
- Avada
- Fixed in
- 7.13.2
- What to do
- Update Avada to 7.13.2 or newer.
Apr 15, 2026Smart Online Order for Clover: Cross-Site Request Forgery (CSRF)CVE-2025-15635 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request Forgery.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0.
- Product
- Smart Online Order for Clover
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Smart Online Order for Clover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2026Userpro: Cross-Site Request Forgery (CSRF)CVE-2025-53444 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DeluxeThemes Userpro userpro allows Cross Site Request Forgery.This issue affects Userpro: from n/a through < 5.1.11.
- Product
- Userpro
- What to do
- Update Userpro to the newest version.
Apr 15, 2026Contact Form by WPForms: Cross-Site Request Forgery (CSRF)CVE-2026-40764 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.
- Product
- Contact Form by WPForms
- Affected
- up to 1.10.0.2
- What to do
- Affects up to 1.10.0.2. Update Contact Form by WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026RT-Theme 18 | Extensions: Cross-Site Request Forgery (CSRF)CVE-2026-39710 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Cross Site Request Forgery.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
- Product
- RT-Theme 18 | Extensions
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update RT-Theme 18 | Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Extra Fees Plugin for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2026-39671 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery.This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.
- Product
- Extra Fees Plugin for WooCommerce
- Affected
- up to 4.3.3
- What to do
- Affects up to 4.3.3. Update Extra Fees Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Blackfyre: Cross-Site Request Forgery (CSRF)CVE-2026-39641 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a through <= 2.5.4.
- Product
- Blackfyre
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Blackfyre to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Theme Editor: Cross-Site Request Forgery (CSRF)CVE-2026-39640 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.
- Product
- Theme Editor
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update Theme Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Grand Magazine: Cross-Site Request Forgery (CSRF)CVE-2026-39635 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.
- Product
- Grand Magazine
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update Grand Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Grand Portfolio: Cross-Site Request Forgery (CSRF)CVE-2026-39634 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.
- Product
- Grand Portfolio
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Grand Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Grand Car Rental: Cross-Site Request Forgery (CSRF)CVE-2026-39633 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through <= 3.6.9.
- Product
- Grand Car Rental
- Affected
- up to 3.6.9
- What to do
- Affects up to 3.6.9. Update Grand Car Rental to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Grand Blog: Cross-Site Request Forgery (CSRF)CVE-2026-39632 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.
- Product
- Grand Blog
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Grand Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026SpicePress: Cross-Site Request Forgery (CSRF)CVE-2026-39621 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.
- Product
- SpicePress
- Affected
- up to 2.3.2.5
- What to do
- Affects up to 2.3.2.5. Update SpicePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Appointment: Cross-Site Request Forgery (CSRF)CVE-2026-39620 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through <= 3.5.5.
- Product
- Appointment
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update Appointment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Busiprof: Cross-Site Request Forgery (CSRF)CVE-2026-39619 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: from n/a through <= 2.5.2.
- Product
- Busiprof
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Busiprof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026NewsExo: Cross-Site Request Forgery (CSRF)CVE-2026-39618 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in themearile NewsExo newsexo allows Cross Site Request Forgery.This issue affects NewsExo: from n/a through <= 7.1.
- Product
- NewsExo
- Affected
- up to 7.1
- What to do
- Affects up to 7.1. Update NewsExo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2026Bluestreet: Cross-Site Request Forgery (CSRF)CVE-2026-39617 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from n/a through <= 1.7.3.
- Product
- Bluestreet
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Bluestreet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.