Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

1,506 results · page 3 of 31

Jul 31, 2026WP Go Maps: Does not properly sanitise and escape a parameter before using it in a SQL queryCVE-2026-15381 · WordPress plugins & themes · reported by WPScanLow 3.7
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Product
WP Go Maps
Fixed in
10.1.04
What to do
Update WP Go Maps to 10.1.04 or newer.
Full record and what to do →NVD record wpscan.com
Jul 31, 2026Check & Log Email: Does not properly sanitize and escape parameters before using them in SQL queriesCVE-2026-14554 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
Product
Check & Log Email
Fixed in
2.0.15
What to do
Update Check & Log Email to 2.0.15 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026WP Hotel Booking: Does not sanitise and escape a search parameter on an administrative listing before using it in a SQL queryCVE-2026-15153 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
Product
WP Hotel Booking
Fixed in
2.3.2
What to do
Update WP Hotel Booking to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com
Jul 30, 2026Online Scheduling and Appointment Booking System: Does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL queryCVE-2026-13395 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.
Product
Online Scheduling and Appointment Booking System
Fixed in
27.8
What to do
Update Online Scheduling and Appointment Booking System to 27.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 29, 2026wp-media-folder-addon: Does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated usersCVE-2026-11974 · WordPress plugins & themes · reported by WPScanHigh 8.6
The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.
Product
wp-media-folder-addon
Fixed in
4.1.7
What to do
Update wp-media-folder-addon to 4.1.7 or newer.
Full record and what to do →NVD record wpscan.com
Jul 28, 2026Database for Contact Form 7, WPforms, Elementor forms: Does not properly sanitise and escape a parameter before reflecting it back in an admin pageCVE-2026-14870 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Database for Contact Form 7, WPforms, Elementor forms
Fixed in
1.5.3
What to do
Update Database for Contact Form 7, WPforms, Elementor forms to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026FacturaONE para WooCommerce con VeriFactu: Does not authenticate one of its request handlersCVE-2026-14289 · WordPress plugins & themes · reported by WPScanCritical 9
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.
Product
FacturaONE para WooCommerce con VeriFactu
Fixed in
5.37
What to do
Update FacturaONE para WooCommerce con VeriFactu to 5.37 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026MPG: Does not sanitise and escape a parameter before reflecting it back in the responseCVE-2026-13726 · WordPress plugins & themes · reported by WPScanHigh 7.1
The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
Product
MPG
Fixed in
4.1.8
What to do
Update MPG to 4.1.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 27, 2026Advanced Ads: Does not sanitize and escape a shortcode parameter before outputting it in the pageCVE-2026-10082 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.
Product
Advanced Ads
Fixed in
2.0.23
What to do
Update Advanced Ads to 2.0.23 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026Post Status Notifier Lite: Does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`adminCVE-2026-9577 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.
Product
Post Status Notifier Lite
Fixed in
1.13.0
What to do
Update Post Status Notifier Lite to 1.13.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 23, 2026WP Compress: Does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the pageCVE-2026-9066 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
Product
WP Compress
Fixed in
7.10.04
What to do
Update WP Compress to 7.10.04 or newer.
Full record and what to do →NVD record wpscan.com
Jul 21, 2026bpost-shipping-platform: Does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submissionCVE-2026-8082 · WordPress plugins & themes · reported by WPScanHigh 7.5
The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.
Product
bpost-shipping-platform
Fixed in
3.2.3
What to do
Update bpost-shipping-platform to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Tag Groups is the Advanced Way to Display Your Taxonomy Terms: Does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content typeCVE-2026-9833 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
Product
Tag Groups is the Advanced Way to Display Your Taxonomy Terms
Fixed in
2.2.0
What to do
Update Tag Groups is the Advanced Way to Display Your Taxonomy Terms to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026LearnPress: Does not escape a search parameter before reflecting it into an HTML attributeCVE-2026-12970 · WordPress plugins & themes · reported by WPScanHigh 7.1
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
Product
LearnPress
Fixed in
4.4.1
What to do
Update LearnPress to 4.4.1 or newer.
Full record and what to do →NVD record wpscan.com
Jul 20, 2026Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite: Do not sanitise and escape a request parameter before using it in a SQL statementCVE-2026-11349 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database.
Product
Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite
Fixed in
7.34.0
What to do
Update Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite to 7.34.0 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026FunnelKit: Does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actionsCVE-2026-12978 · WordPress plugins & themes · reported by WPScanHigh 7.1
The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.
Product
FunnelKit
Fixed in
3.15.0.6
What to do
Update FunnelKit to 3.15.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Jul 16, 2026WP Job Portal: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-12395 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.
Product
WP Job Portal
Fixed in
2.5.5
What to do
Update WP Job Portal to 2.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Jul 15, 2026Quotes llama: Does not properly sanitize and escape a user-supplied parameter before using it in a SQL queryCVE-2026-12512 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.
Product
Quotes llama
Fixed in
3.1.6
What to do
Update Quotes llama to 3.1.6 or newer.
Full record and what to do →NVD record wpscan.com
Jul 13, 2026Library Management System: Does not sanitize and escape a user-supplied parameter before using it in a SQL statementCVE-2026-12582 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.
Product
Library Management System
Fixed in
3.5.8
What to do
Update Library Management System to 3.5.8 or newer.
Full record and what to do →NVD record wpscan.com
Jul 10, 2026The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4.CVE-2026-15300 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The values were read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing wp_magic_quotes, which does not cover $_SERVER), then passed through bare esc_sql() before being interpolated into unquoted numeric positions in the proximity-search query (HAVING/SELECT clause distance math, BETWEEN bounding-box pre-filter) built by gmw_locations_query() in plugins/posts-locator/includes/class-gmw-wp-query.php. Because esc_sql() only escapes string delimiters and these positions are numeric, payloads such as `1 OR SLEEP(3)` survived sanitization. Fixed in 4.5.5 by adding an upstream is_numeric() guard that short-circuits the WHERE clause to `AND 1 = 0` when either coordinate is non-numeric, and by replacing the three esc_sql() calls with (float) casts.
Affected
up to 4.5.4
Fixed in
4.5.5
What to do
Update the plugin to 4.5.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 30, 2026The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versionCVE-2026-9711 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, granted the "Enable additional search queries" setting is enabled and at least one published event exists.
Affected
up to 5.0.11
What to do
Affects up to 5.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record myeventon.com wordfence.com
Jun 26, 2026SALESmanago & Leadoo: Does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statementCVE-2026-10835 · WordPress plugins & themes · reported by WPScanHigh 7.7
The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.
Product
SALESmanago & Leadoo
Fixed in
3.11.3
What to do
Update SALESmanago & Leadoo to 3.11.3 or newer.
Full record and what to do →NVD record wpscan.com
Jun 26, 2026YMC Filter: Does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameterCVE-2026-10823 · WordPress plugins & themes · reported by WPScanHigh 7.5
The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.
Product
YMC Filter
Fixed in
3.11.3
What to do
Update YMC Filter to 3.11.3 or newer.
Full record and what to do →NVD record wpscan.com
Jun 23, 2026Infility Global: Does not properly sanitize and escape some parameters before using them in SQL statementsCVE-2026-8163 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.
Product
Infility Global
Fixed in
2.15.19
What to do
Update Infility Global to 2.15.19 or newer.
Full record and what to do →NVD record wpscan.com
Jun 23, 2026Infility Global Infility Global: For WordPress does not sanitize or validate the orderby and order parameters in the import_list()CVE-2026-7842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
Product
Infility Global Infility Global
Fixed in
2.15.20
What to do
Update Infility Global Infility Global to 2.15.20 or newer.
Full record and what to do →NVD record wpscan.com
Jun 22, 2026ultimate-woocommerce-auction-pro: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-4259 · WordPress plugins & themes · reported by WPScanHigh 7.1
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
ultimate-woocommerce-auction-pro
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update ultimate-woocommerce-auction-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 22, 2026ultimate-woocommerce-auction-pro: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-4110 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
ultimate-woocommerce-auction-pro
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update ultimate-woocommerce-auction-pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026Taskbuilder: Does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodesCVE-2026-9570 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.
Product
Taskbuilder
Fixed in
5.0.8
What to do
Update Taskbuilder to 5.0.8 or newer.
Full record and what to do →NVD record wpscan.com
Jun 17, 2026weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce: Does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected CVE-2026-8089 · WordPress plugins & themes · reported by WPScanHigh 7.1
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.
Product
weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce
Fixed in
2.1.3
What to do
Update weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce to 2.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Jun 15, 2026the shortcode function that fails to sanitize the calendar parameter before using it in database queries: WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injectionCVE-2016-20069 · WordPress plugins & themes · reported by VulnCheckHigh 8.8
WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.
Product
the shortcode function that fails to sanitize the calendar parameter before using it in database queries
What to do
Update the shortcode function that fails to sanitize the calendar parameter before using it in database queries to the newest version.
Full record and what to do →NVD record wordpress.dwbooster.com exploit-db.com
Jun 13, 2026Store Locator: Does not validate a parameter before using it in a file pathCVE-2026-9062 · WordPress plugins & themes · reported by WPScanLow 3.4
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
Product
Store Locator
Fixed in
1.6.9
What to do
Update Store Locator to 1.6.9 or newer.
Full record and what to do →NVD record wpscan.com
Jun 10, 2026Xstore: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2026-3326 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Xstore
Fixed in
9.7.3
What to do
Update Xstore to 9.7.3 or newer.
Full record and what to do →NVD record wpscan.com
Jun 9, 2026WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameteCVE-2016-20064 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
WP Vault 0.8.6.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting an unescaped parameter in the include functionality. Attackers can supply directory traversal sequences through the wpv-image GET parameter to access sensitive files like system configuration and credentials.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lenonleite.com.br wordpress.org
May 27, 2026EventPress: Does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the responseCVE-2026-6268 · WordPress plugins & themes · reported by WPScanHigh 7.1
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
Product
EventPress
Fixed in
22.2
What to do
Update EventPress to 22.2 or newer.
Full record and what to do →NVD record wpscan.com
May 20, 2026SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') oCVE-2026-9065 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.3
SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'. The root cause is a flawed escaping bypass in the query builder ('wp-query-builder'). Values passed to the 'where()' method are only sanitized via '$wpdb->prepare()' when they do **not** contain a dot ('.') or the WordPress table prefix ('wp_'). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the 'WHERE' clause, allowing full UNION-based extraction of the database.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record tenable.com
May 18, 2026Ajax Load More: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-6495 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Ajax Load More WordPress plugin before 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ajax Load More
Fixed in
7.8.4
What to do
Update Ajax Load More to 7.8.4 or newer.
Full record and what to do →NVD record wpscan.com
May 18, 2026WP Maps: Does not properly sanitize a parameter before using it in a file pathCVE-2026-6381 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks.
Product
WP Maps
Fixed in
4.9.3
What to do
Update WP Maps to 4.9.3 or newer.
Full record and what to do →NVD record wpscan.com
May 18, 2026WP Photo Album Plus: Does not properly sanitize and escape a parameter before using it in a SQL queryCVE-2026-6379 · WordPress plugins & themes · reported by WPScanHigh 8.6
The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Product
WP Photo Album Plus
Fixed in
9.1.11.001
What to do
Update WP Photo Album Plus to 9.1.11.001 or newer.
Full record and what to do →NVD record wpscan.com
May 10, 2026the page parameter of the admin settings interface: WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scriptingCVE-2022-50960 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the admin settings interface. Attackers can inject malicious scripts through the page parameter in class-sms-log-display.php to execute arbitrary JavaScript in administrator browsers.
Product
the page parameter of the admin settings interface
What to do
Update the page parameter of the admin settings interface to the newest version.
Full record and what to do →NVD record wordpress.org exploit-db.com
May 1, 2026Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient inpuCVE-2024-13362 · WordPress plugins & themes · reported by WordfenceMedium 6.1
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 13, 2026Product Filter for WooCommerce by WBW: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2026-3830 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
Product
Product Filter for WooCommerce by WBW
Fixed in
3.1.3
What to do
Update Product Filter for WooCommerce by WBW to 3.1.3 or newer.
Full record and what to do →NVD record wpscan.com
Apr 8, 2026WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4CVE-2026-3396 · WordPress plugins & themes · reported by WordfenceHigh 7.5
WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected
up to 4.2.3
What to do
Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 31, 2026Performance Monitor: Does not validate a parameter before making a request to itCVE-2026-3881 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks
Product
Performance Monitor
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Performance Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 13, 2026the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries: WpDiscuz before 7.6.47 contains an SQL injectionCVE-2026-22193 · WordPress plugins & themes · reported by VulnCheckCritical 9.2
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.
Product
the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries
Fixed in
7.6.47
What to do
Update the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries to 7.6.47 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 11, 2026DukaPress: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2026-2466 · WordPress plugins & themes · reported by WPScanHigh 7.1
The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
DukaPress
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update DukaPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Mar 11, 2026Guest posting / Frontend Posting / Front Editor: Allows passing a URL parameter to regenerate aCVE-2026-1867 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6 allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6's settings, it is possible for an unauthenticated attacker to export and download all of the form data/settings, including the administrator's email address.
Product
Guest posting / Frontend Posting / Front Editor
Fixed in
5.0.6
What to do
Update Guest posting / Frontend Posting / Front Editor to 5.0.6 or newer.
Full record and what to do →NVD record wpscan.com
Feb 22, 2026Conditional CAPTCHA: Does not validate a parameter before redirecting the user to its valueCVE-2026-1369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
Product
Conditional CAPTCHA
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update Conditional CAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Feb 20, 2026RVCFDI para Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69386 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realvirtualmx RVCFDI para Woocommerce rvcfdi-para-woocommerce allows Reflected XSS.This issue affects RVCFDI para Woocommerce: from n/a through <= 8.1.8.
Product
RVCFDI para Woocommerce
Affected
up to 8.1.8
What to do
Affects up to 8.1.8. Update RVCFDI para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Feb 11, 2026plugin settings parameters: Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scriptingCVE-2019-25314 · WordPress plugins & themes · reported by VulnCheckMedium 4.8
Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces.
Product
plugin settings parameters
What to do
Update plugin settings parameters to the newest version.
Full record and what to do →NVD record duplicate-post.lopo.it wordpress.org
Feb 2, 2026Library Viewer: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2025-15396 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Library Viewer
Fixed in
3.2.0
What to do
Update Library Viewer to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.