Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

19,102 results · page 31 of 383

Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license keyCVE-2026-18046 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.
Product
Cookie Consent
Fixed in
0.0.10
What to do
Update Cookie Consent to 0.0.10 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Form Maker by 10Web: Does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice fieldCVE-2026-16977 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
Product
Form Maker by 10Web
Fixed in
1.15.45
What to do
Update Form Maker by 10Web to 1.15.45 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Wallet for WooCommerce: Does not verify the amount actually collected for a wallet top-up before crediting the walletCVE-2026-16538 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.
Product
Wallet for WooCommerce
Fixed in
1.6.10
What to do
Update Wallet for WooCommerce to 1.6.10 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026PowerPress Podcasting plugin by Blubrry: Does not validate one of its Podcast Episode URL settings before performing a server-side request with itCVE-2026-16294 · WordPress plugins & themes · reported by WPScanHigh 7.1
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.17.1
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.17.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Total Upkeep: Does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated usersCVE-2026-16253 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin.
Product
Total Upkeep
Fixed in
1.17.3
What to do
Update Total Upkeep to 1.17.3 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Welcart e-Commerce: Does not sanitise or escape a product field before outputting it on the product pagesCVE-2026-16066 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.
Product
Welcart e-Commerce
Fixed in
2.11.34
What to do
Update Welcart e-Commerce to 2.11.34 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026wpmudev-updates: Does not verify the integrity of the packages installed through its remote management interfaceCVE-2026-16051 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).
Product
wpmudev-updates
Fixed in
5.0.1
What to do
Update wpmudev-updates to 5.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Cookie Consent: Does not correctly enforce its intended administrator-only capability check on its consent-settings REST routesCVE-2026-15388 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate, allowing any authenticated user such as a subscriber to update the Cookie Consent WordPress plugin before 0.0.10's consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.
Product
Cookie Consent
Fixed in
0.0.10
What to do
Update Cookie Consent to 0.0.10 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Patterns Kit: Does not escape a link attribute before its client-side script inserts it into the pageCVE-2026-15249 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element.
Product
Patterns Kit
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Patterns Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Import WP: Does not perform any authorization check on one of its export-file download handlersCVE-2026-14925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based download key to be obtained.
Product
Import WP
Fixed in
2.14.23
What to do
Update Import WP to 2.14.23 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026WP Crowdfunding: Does not check the campaign-submission capability in one of its AJAX actionsCVE-2026-14859 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission.
Product
WP Crowdfunding
Fixed in
2.2.1
What to do
Update WP Crowdfunding to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026KiviCare: Does not properly sanitise and escape user-supplied parameters before using them in a SQL queryCVE-2026-13613 · WordPress plugins & themes · reported by WPScanHigh 8.8
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
Product
KiviCare
Fixed in
4.5.2
What to do
Update KiviCare to 4.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026Eventin: Does not perform an authorization check on its waiting-list registration handlerCVE-2026-13171 · WordPress plugins & themes · reported by WPScanHigh 8.2
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
Product
Eventin
Fixed in
4.1.20
What to do
Update Eventin to 4.1.20 or newer.
Full record and what to do →NVD record wpscan.com
Aug 12, 2026LearnPress: Does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson contentCVE-2026-12976 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
Product
LearnPress
Fixed in
4.4.4
What to do
Update LearnPress to 4.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 11, 2026InstaWP Connect – 1-click WP Staging & Migration: Remote Code ExecutionCVE-2026-13457 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
Product
InstaWP Connect – 1-click WP Staging & Migration
Affected
up to 0.1.3.6
What to do
Affects up to 0.1.3.6. Update InstaWP Connect – 1-click WP Staging & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 11, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-16974 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Kirki – Freeform Page Builder, Website Builder & Customizer
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 10, 2026WP Umbrella: Cross-Site Request Forgery (CSRF)CVE-2026-66642 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2.
Product
WP Umbrella
Affected
up to 2.26.2
What to do
Affects up to 2.26.2. Update WP Umbrella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wp-umbrella.com
Aug 10, 2026Duplicate Post: Does not perform per-object authorisation checks in its bulk copy and delete operationsCVE-2026-19077 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.
Product
Duplicate Post
Fixed in
1.5.5
What to do
Update Duplicate Post to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`,CVE-2026-19075 · WordPress plugins & themes · reported by WPScanMedium 5
All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any `aiovg_videos` post (`public/video.php`, `AIOVG_Public_Video::download_video()`), which reads the post's `mp4` meta value and streams that URL's response back to the requester.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Library Management System: Does not sanitize and escape a user-supplied parameter before using it in a SQL statementCVE-2026-18666 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.
Product
Library Management System
Fixed in
3.6.7
What to do
Update Library Management System to 3.6.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Login & Register Forms: Does not enforce its password reset attempt limit against a server-derived valueCVE-2026-18469 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
Product
Login & Register Forms
Fixed in
4.0.2
What to do
Update Login & Register Forms to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Salon Booking System: Does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation stepsCVE-2026-17022 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
Product
Salon Booking System
Fixed in
10.30.34
What to do
Update Salon Booking System to 10.30.34 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Salon Booking System: Does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted bookingCVE-2026-17021 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings.
Product
Salon Booking System
Fixed in
10.30.34
What to do
Update Salon Booking System to 10.30.34 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026CubeWP Framework: Does not perform a per-object read authorization checkCVE-2026-17018 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators.
Product
CubeWP Framework
Affected
up to 1.1.30
What to do
Affects up to 1.1.30. Update CubeWP Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Squeeze: Does not validate the file type or extension of the per-size image data written by one of its attachment-update actionsCVE-2026-16985 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.
Product
Squeeze
Fixed in
1.7.12
What to do
Update Squeeze to 1.7.12 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Customer Reviews for WooCommerce: Does not perform nonce or capability checks on several settings-related AJAX actionsCVE-2026-14941 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.
Product
Customer Reviews for WooCommerce
Fixed in
5.116.0
What to do
Update Customer Reviews for WooCommerce to 5.116.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026Podcast Player: Does not validate the destination of a server-side request built from user-supplied inputCVE-2026-14860 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML.
Product
Podcast Player
Fixed in
8.3.1
What to do
Update Podcast Player to 8.3.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026vitepos WordPress plugin before 3.6.0, Vitepos: Do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability bCVE-2026-14237 · WordPress plugins & themes · reported by WPScanHigh 7.2
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
Product
vitepos WordPress plugin before 3.6.0, Vitepos
Fixed in
3.6.0
What to do
Update vitepos WordPress plugin before 3.6.0, Vitepos to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026AutoNetTV Relay: Does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization taskCVE-2026-13600 · WordPress plugins & themes · reported by WPScanHigh 8.1
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
Product
AutoNetTV Relay
Fixed in
3.0.14
What to do
Update AutoNetTV Relay to 3.0.14 or newer.
Full record and what to do →NVD record wpscan.com
Aug 10, 2026LearnPress: Does not validate a user-supplied URL before the server fetches itCVE-2026-12971 · WordPress plugins & themes · reported by WPScanLow 2.2
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.
Product
LearnPress
Fixed in
4.4.4
What to do
Update LearnPress to 4.4.4 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026Slim SEO: Does not restrict a post-meta preview feature to posts the user is allowed to editCVE-2026-16957 · WordPress plugins & themes · reported by WPScanLow 2.7
The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not own, including password-protected posts and posts of non-public post types.
Product
Slim SEO
Fixed in
4.9.11
What to do
Update Slim SEO to 4.9.11 or newer.
Full record and what to do →NVD record wpscan.com
Aug 9, 2026InfiniteWP Client: Does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installationsCVE-2026-15038 · WordPress plugins & themes · reported by WPScanCritical 9.8
The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection state and the authenticity of requests to its remote-management endpoint on WordPress Multisite installations, allowing unauthenticated attackers to bind their own key, hijack an administrator session, and take over the entire network, leading to remote code execution.
Product
InfiniteWP Client
Fixed in
1.13.6
What to do
Update InfiniteWP Client to 1.13.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026AI Engine: Does not confine a caller-supplied file path before reading it and forwarding the contents to an external serviceCVE-2026-16955 · WordPress plugins & themes · reported by WPScanMedium 5
The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets.
Product
AI Engine
Fixed in
3.6.6
What to do
Update AI Engine to 3.6.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Solace Extra: Does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged usersCVE-2026-16948 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.
Product
Solace Extra
Fixed in
1.6.1
What to do
Update Solace Extra to 1.6.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Download Monitor: Does not perform authorization checks on one of its download-logging AJAX actionsCVE-2026-16608 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.
Product
Download Monitor
Fixed in
5.2.6
What to do
Update Download Monitor to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026YMC Filter: Does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged usersCVE-2026-16559 · WordPress plugins & themes · reported by WPScanMedium 6.8
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
Product
YMC Filter
Fixed in
3.12.9
What to do
Update YMC Filter to 3.12.9 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Appointment Hour Booking: Does not validate a client-supplied booking price against the server-side configured service priceCVE-2026-16282 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price (including zero or negative) that is stored as the authoritative booking price, corrupting booking and payment records.
Product
Appointment Hour Booking
Fixed in
1.5.88
What to do
Update Appointment Hour Booking to 1.5.88 or newer.
Full record and what to do →NVD record wpscan.com
Aug 8, 2026Easy Accordion: Stored Cross-Site ScriptingCVE-2026-18988 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordion_header_renderer() function, which emits the attacker-supplied tag name using esc_attr() in an HTML tag-name context instead of tag_escape(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Easy Accordion
Affected
up to 3.1.8
What to do
Affects up to 3.1.8. Update Easy Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 7, 2026WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.CVE-2026-64638 · WordPress plugins & themes · reported by support@hackerone.comHigh 8.9
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record hackerone.com wordpress.org
Aug 7, 2026The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post contentCVE-2026-48093 · WordPress plugins & themes · reported by GitHubMedium 6.5
The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting (XSS) through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without output sanitization or an `unfiltered_html` capability check. This allows a Contributor attacker to submit a pending post containing an inert-looking URL token that executes attacker-controlled JavaScript when an Administrator or Editor previews or reviews the post. This is distinct from CVE-2026-2512, which affected custom field meta values up to version 2.5.1. This vector affects version 2.6 and uses the documented external URL embed feature in post content. This particular issue is patched in version 2.6.1.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Aug 7, 2026The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping CVE-2026-48094 · WordPress plugins & themes · reported by GitHubMedium 5.3
The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp->request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin's sharing link is displayed. WordPress's security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `"`, `<`, `>` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Aug 7, 2026Simple CAPTCHA with Cloudflare Turnstile: Does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integrationCVE-2026-15239 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.
Product
Simple CAPTCHA with Cloudflare Turnstile
Fixed in
1.42.0
What to do
Update Simple CAPTCHA with Cloudflare Turnstile to 1.42.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscriptions for WooCommerce: Does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the orCVE-2026-15211 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order being completed on the WooCommerce order-received flow: it captures a client-supplied token and marks the order paid whenever the capture status is COMPLETED, without comparing the captured amount to the order total. This allows an attacker (unauthenticated where guest checkout is enabled) to substitute an approved, uncaptured PayPal order token and have an expensive order marked paid without paying its price.
Product
Subscriptions for WooCommerce
Fixed in
2.0.1
What to do
Update Subscriptions for WooCommerce to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026WP Maps: Does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusionCVE-2026-16263 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server.
Product
WP Maps
Fixed in
4.9.7
What to do
Update WP Maps to 4.9.7 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026MStore API: Does not perform authorization or purchase-ownership checks on its REST product-review creation routeCVE-2026-16041 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.
Product
MStore API
Fixed in
4.21.0
What to do
Update MStore API to 4.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026MStore API: Does not restrict its vendor-orders endpoint to the caller's own ordersCVE-2026-16039 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.
Product
MStore API
Fixed in
4.21.0
What to do
Update MStore API to 4.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026MStore API: Does not correctly verify the cryptographic signature of the token used to authenticate its phone-based loginCVE-2026-16030 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.
Product
MStore API
Fixed in
4.21.0
What to do
Update MStore API to 4.21.0 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Content Views: Does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL queryCVE-2026-15361 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.
Product
Content Views
Fixed in
4.5
What to do
Update Content Views to 4.5 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Comments: Does not properly escape a user-supplied URL before outputting it inside an HTML attributeCVE-2026-15032 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.
Product
Comments
Fixed in
7.6.60
What to do
Update Comments to 7.6.60 or newer.
Full record and what to do →NVD record wpscan.com
Aug 7, 2026Subscribe2: Does not properly escape a user-supplied value before reflecting it into a public subscription formCVE-2026-14331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.
Product
Subscribe2
Fixed in
10.46
What to do
Update Subscribe2 to 10.46 or newer.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.