Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

672 results · page 3 of 14

Jul 13, 2026Events Manager: Deserialization of Untrusted DataCVE-2026-57713 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.
Product
Events Manager
Affected
up to 7.3.6
What to do
Affects up to 7.3.6. Update Events Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 13, 2026WPJAM Basic: Deserialization of Untrusted DataCVE-2026-57371 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.
Product
WPJAM Basic
Affected
up to 7.0
What to do
Affects up to 7.0. Update WPJAM Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 9, 2026Age Verification & Identity Verification by Token of Trust: Unauthorized accessCVE-2026-7558 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 4.0.2. This is due to the handle_export_table() function being registered on the WordPress 'init' hook, which fires for all requests, including those from unauthenticated visitors, without any capability check. This makes it possible for unauthenticated attackers to download a CSV file containing sensitive WooCommerce donation data, including order dates, order IDs, charitable donation amounts, and admin-only order edit URLs, simply by visiting any page on the site with the 'tot_export_table' GET parameter set to a numeric value (0–3).
Product
Age Verification & Identity Verification by Token of Trust
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Age Verification & Identity Verification by Token of Trust to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 2, 2026Themify Popup: Deserialization of Untrusted DataCVE-2026-56037 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.
Product
Themify Popup
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Themify Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 2, 2026ARMember Premium: Deserialization of Untrusted DataCVE-2026-27060 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6.
Product
ARMember Premium
Fixed in
7.6
What to do
Update ARMember Premium to 7.6 or newer.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Entrepreneur - Booking for Small Businesses: Deserialization of Untrusted DataCVE-2025-69130 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection. This issue affects Entrepreneur - Booking for Small Businesses WordPress Theme: from n/a before 3.1.5.
Product
Entrepreneur - Booking for Small Businesses
Fixed in
3.1.5
What to do
Update Entrepreneur - Booking for Small Businesses to 3.1.5 or newer.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Creatify: Deserialization of Untrusted DataCVE-2025-60236 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.
Product
Creatify
Affected
up to 1.5
What to do
Affects up to 1.5. Update Creatify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026The Hospital: Deserialization of Untrusted DataCVE-2025-60231 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1.
Product
The Hospital
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update The Hospital to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026The Barber Shop: Deserialization of Untrusted DataCVE-2025-60230 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.
Product
The Barber Shop
Affected
up to 1.9
What to do
Affects up to 1.9. Update The Barber Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Lagom: Deserialization of Untrusted DataCVE-2025-60229 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.
Product
Lagom
Affected
up to 2.0
What to do
Affects up to 2.0. Update Lagom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.CVE-2026-27410 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026Fusion Builder: Deserialization of Untrusted DataCVE-2026-12256 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows Object Injection.This issue affects Fusion Builder: from n/a through 3.15.3.
Product
Fusion Builder
Affected
up to 3.15.3
What to do
Affects up to 3.15.3. Update Fusion Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 17, 2026ThemeREX Addons: Deserialization of Untrusted DataCVE-2025-60205 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.
Product
ThemeREX Addons
Affected
up to 2.36.1.1
What to do
Affects up to 2.36.1.1. Update ThemeREX Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 15, 2026Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.CVE-2026-27333 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.
Affected
up to 7.3.23
What to do
Affects up to 7.3.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Askka: Deserialization of Untrusted DataCVE-2026-39555 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.
Product
Askka
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Askka to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Töbel: Deserialization of Untrusted DataCVE-2026-39551 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.
Product
Töbel
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Töbel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jun 2, 2026Aperitif: Deserialization of Untrusted DataCVE-2026-39550 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6.
Product
Aperitif
Affected
up to 1.6
What to do
Affects up to 1.6. Update Aperitif to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 27, 2026Facebook for WooCommerce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-49059 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommerce allows Phishing. This issue affects Facebook for WooCommerce: from n/a through 3.7.0.
Product
Facebook for WooCommerce
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Facebook for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
May 8, 2026User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration: Deserialization of Untrusted DataCVE-2026-5127 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrusted Data in versions up to, and including, 4.3.1 This is due to insufficient input validation and type checking on the wpuf_files parameter during form submission, combined with unconditional deserialization via maybe_unserialize() when displaying post content. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP objects, which can be leveraged to execute arbitrary code, delete arbitrary files, or perform other malicious actions if a POP chain is present on the target system.
Product
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 21, 2026Responsive Slider by MetaSlider: Deserialization of Untrusted DataCVE-2026-39467 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through 3.106.0.
Product
Responsive Slider by MetaSlider
Affected
up to 3.106.0
What to do
Affects up to 3.106.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 15, 2026Age Verification & Identity Verification by Token of Trust: Stored Cross-Site ScriptingCVE-2026-2834 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all versions up to, and including, 3.32.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Age Verification & Identity Verification by Token of Trust
Affected
up to 3.32.3
What to do
Affects up to 3.32.3. Update Age Verification & Identity Verification by Token of Trust to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2026Hide My WP Ghost: URL Redirection to Untrusted Site ('Open Redirect')CVE-2026-39484 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through < 7.0.00.
Product
Hide My WP Ghost
What to do
Update Hide My WP Ghost to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026JS Archive List: Deserialization of Untrusted DataCVE-2026-32513 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through <= 6.1.7.
Product
JS Archive List
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update JS Archive List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Pelicula: Deserialization of Untrusted DataCVE-2026-32512 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.
Product
Pelicula
What to do
Update Pelicula to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Stål: Deserialization of Untrusted DataCVE-2026-32511 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål stal allows Object Injection.This issue affects Stål: from n/a through < 1.7.
Product
Stål
What to do
Update Stål to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Kamperen: Deserialization of Untrusted DataCVE-2026-32510 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3.
Product
Kamperen
What to do
Update Kamperen to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Gracey: Deserialization of Untrusted DataCVE-2026-32509 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey allows Object Injection.This issue affects Gracey: from n/a through < 1.4.
Product
Gracey
What to do
Update Gracey to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Halstein: Deserialization of Untrusted DataCVE-2026-32508 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Mikado-Themes Halstein halstein allows Object Injection.This issue affects Halstein: from n/a through < 1.8.
Product
Halstein
What to do
Update Halstein to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Leroux: Deserialization of Untrusted DataCVE-2026-32507 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through < 1.4.
Product
Leroux
What to do
Update Leroux to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Archicon: Deserialization of Untrusted DataCVE-2026-32506 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.
Product
Archicon
What to do
Update Archicon to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Borgholm: Deserialization of Untrusted DataCVE-2026-32502 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.
Product
Borgholm
What to do
Update Borgholm to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026weForms: Deserialization of Untrusted DataCVE-2026-32484 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in BoldGrid weForms weforms allows Object Injection.This issue affects weForms: from n/a through <= 1.6.26.
Product
weForms
Affected
up to 1.6.26
What to do
Affects up to 1.6.26. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Bus Ticket Booking with Seat Reservation: Deserialization of Untrusted DataCVE-2026-27095 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.
Product
Bus Ticket Booking with Seat Reservation
Affected
up to 5.6.0
What to do
Affects up to 5.6.0. Update Bus Ticket Booking with Seat Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Buisson: Deserialization of Untrusted DataCVE-2026-27084 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.
Product
Buisson
Affected
up to 1.1.11
What to do
Affects up to 1.1.11. Update Buisson to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Work & Travel Company: Deserialization of Untrusted DataCVE-2026-27083 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
Product
Work & Travel Company
Affected
up to 1.2
What to do
Affects up to 1.2. Update Work & Travel Company to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Love Story: Deserialization of Untrusted DataCVE-2026-27082 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
Product
Love Story
Affected
up to 1.3.12
What to do
Affects up to 1.3.12. Update Love Story to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026WooCommerce Infinite Scroll: Deserialization of Untrusted DataCVE-2026-27045 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a through <= 1.6.2.
Product
WooCommerce Infinite Scroll
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update WooCommerce Infinite Scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Nexa Blocks: Deserialization of Untrusted DataCVE-2026-25429 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
Product
Nexa Blocks
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Nexa Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Apicona: Deserialization of Untrusted DataCVE-2026-25400 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
Product
Apicona
Affected
up to 24.1.0
What to do
Affects up to 24.1.0. Update Apicona to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Vex: Deserialization of Untrusted DataCVE-2026-25360 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
Product
Vex
What to do
Update Vex to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Pendulum: Deserialization of Untrusted DataCVE-2026-25359 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Pendulum pendulum allows Object Injection.This issue affects Pendulum: from n/a through < 3.1.5.
Product
Pendulum
What to do
Update Pendulum to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Meloo: Deserialization of Untrusted DataCVE-2026-25358 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
Product
Meloo
What to do
Update Meloo to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Ricky: Deserialization of Untrusted DataCVE-2026-25032 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
Product
Ricky
What to do
Update Ricky to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Tasty Daily: Deserialization of Untrusted DataCVE-2026-25031 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.
Product
Tasty Daily
What to do
Update Tasty Daily to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Goldish: Deserialization of Untrusted DataCVE-2026-25030 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.
Product
Goldish
What to do
Update Goldish to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026KIDZ: Deserialization of Untrusted DataCVE-2026-25029 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.
Product
KIDZ
Affected
up to 5.24
What to do
Affects up to 5.24. Update KIDZ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026SUMO Affiliates Pro: Deserialization of Untrusted DataCVE-2026-24989 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
Product
SUMO Affiliates Pro
What to do
Update SUMO Affiliates Pro to the newest version.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Visionary Core: Deserialization of Untrusted DataCVE-2026-24981 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.
Product
Visionary Core
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Visionary Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Jobica Core: Deserialization of Untrusted DataCVE-2026-24978 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.
Product
Jobica Core
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Jobica Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 25, 2026Organici Library: Deserialization of Untrusted DataCVE-2026-24976 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
Product
Organici Library
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Organici Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.